General
- Target 2026-10-28_b0ce3096e0ecbf326080f116fbc8508b_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee
- Size 364KB
- Sample261029-zlt69sts8k
- SHA256 e00979527b6bb4dfa7ec996734c03424095276759201015babcb02fb4ee2b811
- MD5 b0ce3096e0ecbf326080f116fbc8508b
- SHA1 c458cf739bc96183fc8d3e7a50ec7c28170e638c
- SHA512 851bed92329299fe8c5ed8f89f1b02ba36bcbb4e80fa001fd90f0f3d95c88eb02d257de3f6cd700e93d8fc2898440c1a0c7e9c812c0e390832d003320859bd58
- SSDEEP 6144:1o3whi+1Py3V0a24kOn+Sr72iyjmhuKtUYiw52hVOcvBRMHkWYHpH:YKf1PyKa2anKjm3OYZ2hocvHd
- TLSH T19784AE256240807AF36A0B3059A5E6E5086C7C391BA4E48FF778BE391D701D39A7739F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-28_b0ce3096e0ecbf326080f116fbc8508b_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
1.234.83.146
-
133.242.129.155
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-10-28_b0ce3096e0ecbf326080f116fbc8508b_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee
- Size 364KB
- SHA256 e00979527b6bb4dfa7ec996734c03424095276759201015babcb02fb4ee2b811
- MD5 b0ce3096e0ecbf326080f116fbc8508b
- SHA1 c458cf739bc96183fc8d3e7a50ec7c28170e638c
- SHA512 851bed92329299fe8c5ed8f89f1b02ba36bcbb4e80fa001fd90f0f3d95c88eb02d257de3f6cd700e93d8fc2898440c1a0c7e9c812c0e390832d003320859bd58
- SSDEEP 6144:1o3whi+1Py3V0a24kOn+Sr72iyjmhuKtUYiw52hVOcvBRMHkWYHpH:YKf1PyKa2anKjm3OYZ2hocvHd
- TLSH T19784AE256240807AF36A0B3059A5E6E5086C7C391BA4E48FF778BE391D701D39A7739F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE