General
- Target 2026-10-28_6a28ecaf8a35100c66c3edbc823635b6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 400KB
- Sample261028-mx6yzszs3j
- SHA256 05b1be7e29adc038e5746827940af5ef119d992d8fd1b4d3e7b213ddd0916d39
- MD5 6a28ecaf8a35100c66c3edbc823635b6
- SHA1 d9f617a6146fe130afda75bfba3093091f95b98c
- SHA512 a3b052d8c46db3938ec36e7d7348035781b98701e06c00fc9b01fccd2283f64d6de6ca6b2312d00d2c9ef1b19c0f05bec8f6900469779067252e5339b713248b
- SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvO:yIfBoDWoyFboU6hAJQnrj
- TLSH T1CF94BD253140C436F32A0B354456EAB149A9BC3915D9E48FF778BE7A5E311938B3B28F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-28_6a28ecaf8a35100c66c3edbc823635b6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-10-28_6a28ecaf8a35100c66c3edbc823635b6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 400KB
- SHA256 05b1be7e29adc038e5746827940af5ef119d992d8fd1b4d3e7b213ddd0916d39
- MD5 6a28ecaf8a35100c66c3edbc823635b6
- SHA1 d9f617a6146fe130afda75bfba3093091f95b98c
- SHA512 a3b052d8c46db3938ec36e7d7348035781b98701e06c00fc9b01fccd2283f64d6de6ca6b2312d00d2c9ef1b19c0f05bec8f6900469779067252e5339b713248b
- SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvO:yIfBoDWoyFboU6hAJQnrj
- TLSH T1CF94BD253140C436F32A0B354456EAB149A9BC3915D9E48FF778BE7A5E311938B3B28F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE