General
- Target 2026-10-26_6aa629a1b4d6e7da0d89bae60c17cca2_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee
- Size 445KB
- Sample261027-spknnssw7l
- SHA256 a37ee4036267caad18a379bf999d8b562be4ceb16539a2d13991a2918ecc24f5
- MD5 6aa629a1b4d6e7da0d89bae60c17cca2
- SHA1 93f9b681fd02dc162be3e8064a3667ba2281d3f6
- SHA512 b66d4838458029c6673b9f16199f80f712dc0f18f82fdf80fb69742f59d4b16562784016b188ae7009148c1b3f5cd82139179cc823a7e8ff3a285eddf39c2b67
- SSDEEP 6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGGMI2Y:rKf1PyKa2H3hOHOHz9JQ6zBn2Y
- TLSH T150A4BE2562808436F76A0B3049A5E6F50868BC392BA5E58FF378BD392D701D35A7335F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-26_6aa629a1b4d6e7da0d89bae60c17cca2_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
1.234.83.146
-
133.242.129.155
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-10-26_6aa629a1b4d6e7da0d89bae60c17cca2_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee
- Size 445KB
- SHA256 a37ee4036267caad18a379bf999d8b562be4ceb16539a2d13991a2918ecc24f5
- MD5 6aa629a1b4d6e7da0d89bae60c17cca2
- SHA1 93f9b681fd02dc162be3e8064a3667ba2281d3f6
- SHA512 b66d4838458029c6673b9f16199f80f712dc0f18f82fdf80fb69742f59d4b16562784016b188ae7009148c1b3f5cd82139179cc823a7e8ff3a285eddf39c2b67
- SSDEEP 6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGGMI2Y:rKf1PyKa2H3hOHOHz9JQ6zBn2Y
- TLSH T150A4BE2562808436F76A0B3049A5E6F50868BC392BA5E58FF378BD392D701D35A7335F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE