General
- Target 2026-10-28_639b633a592e6b186d2fd825b8e3afbd_amadey_elex_smoke-loader_stop
- Size 504KB
- Sample261030-dswssagy81
- SHA256 7eeab1ae9468ecc86638db754167acba1721ae75c766a3aa51f6acf2c3f17c37
- MD5 639b633a592e6b186d2fd825b8e3afbd
- SHA1 d0dc8ac652a2a0993ee50d05805672f43b75a651
- SHA512 e061d17f105dae426b0812bfd12adac31214ff66c92392252738e9073870c41e232fd85b8a470cf5b76d011f97338ae9a650c91eae06e68d3960340676f764dd
- SSDEEP 12288:IdBNKTCqqwXCcdgT89+MvA+BisqYpxHtq:ILjQC+fs0A
- TLSH T110B4C0103A90C076E3662B314996F6F11AA97C3446A4E68FF7783E3A5D31193963B34F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-28_639b633a592e6b186d2fd825b8e3afbd_amadey_elex_smoke-loader_stop.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
1.234.83.146
-
133.242.129.155
-
218.54.31.226
-
218.54.31.165
Targets
-
- Target 2026-10-28_639b633a592e6b186d2fd825b8e3afbd_amadey_elex_smoke-loader_stop
- Size 504KB
- SHA256 7eeab1ae9468ecc86638db754167acba1721ae75c766a3aa51f6acf2c3f17c37
- MD5 639b633a592e6b186d2fd825b8e3afbd
- SHA1 d0dc8ac652a2a0993ee50d05805672f43b75a651
- SHA512 e061d17f105dae426b0812bfd12adac31214ff66c92392252738e9073870c41e232fd85b8a470cf5b76d011f97338ae9a650c91eae06e68d3960340676f764dd
- SSDEEP 12288:IdBNKTCqqwXCcdgT89+MvA+BisqYpxHtq:ILjQC+fs0A
- TLSH T110B4C0103A90C076E3662B314996F6F11AA97C3446A4E68FF7783E3A5D31193963B34F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE