General
- Target 2026-10-28_4cb80ec240d649ca830e258ee84a1b4b_amadey_elex_smoke-loader_stop
- Size 504KB
- Sample261030-fpf92aht4y
- SHA256 d1a67841faa3654b9df582d4fabef9d7e351bf038e47fd90d3c51bdde99eea65
- MD5 4cb80ec240d649ca830e258ee84a1b4b
- SHA1 17319e967a182ae7a64fbd09565866ae66bde902
- SHA512 983b8961425156a34e795712f748fb60c02dea8a0473ba221fa506fbbc0f52f980ad17852d7d0d6451d2f1709a2e90d91ae534f3e1f8c0669fd6ba5384bbaf3c
- SSDEEP 12288:IdBNKTCqqwXCcdgT89+MvA+BisqYpxHt6:ILjQC+fs0A
- TLSH T169B4C0103A90C076E3662B314996F6F11AA97C3446A4E68FF7783E3A5D31193963B34F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-28_4cb80ec240d649ca830e258ee84a1b4b_amadey_elex_smoke-loader_stop.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
1.234.83.146
-
133.242.129.155
-
218.54.31.226
-
218.54.31.165
Targets
-
- Target 2026-10-28_4cb80ec240d649ca830e258ee84a1b4b_amadey_elex_smoke-loader_stop
- Size 504KB
- SHA256 d1a67841faa3654b9df582d4fabef9d7e351bf038e47fd90d3c51bdde99eea65
- MD5 4cb80ec240d649ca830e258ee84a1b4b
- SHA1 17319e967a182ae7a64fbd09565866ae66bde902
- SHA512 983b8961425156a34e795712f748fb60c02dea8a0473ba221fa506fbbc0f52f980ad17852d7d0d6451d2f1709a2e90d91ae534f3e1f8c0669fd6ba5384bbaf3c
- SSDEEP 12288:IdBNKTCqqwXCcdgT89+MvA+BisqYpxHt6:ILjQC+fs0A
- TLSH T169B4C0103A90C076E3662B314996F6F11AA97C3446A4E68FF7783E3A5D31193963B34F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE