General
- Target 2026-10-30_67c6f946962f05e1654846569ad2c7ec_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 405KB
- Sample261031-ca6plat12p
- SHA256 1389cff072bc02528e6b58a9b1b8f556aa467ca8c4566a1782ad2cea104ebf94
- MD5 67c6f946962f05e1654846569ad2c7ec
- SHA1 6faec2ea6ab1324e2c6759eb81b7f8742406624d
- SHA512 ac19ae3edf1d4bf9b53c380652aab8c747afdc862c877d5995ff2a2b42c0fbfa0c0e90fa8aea900ee7526e827ac1ffb6dff6c8bed821b4518c4119aacbd235ab
- SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohS:YIfBoDWoyFbkU6hAJQnaU
- TLSH T13794BE253540C436F3290B354855EAB10AA9BC3914D9E48FF778BE7A6D321938B7B24F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-30_67c6f946962f05e1654846569ad2c7ec_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-10-30_67c6f946962f05e1654846569ad2c7ec_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 405KB
- SHA256 1389cff072bc02528e6b58a9b1b8f556aa467ca8c4566a1782ad2cea104ebf94
- MD5 67c6f946962f05e1654846569ad2c7ec
- SHA1 6faec2ea6ab1324e2c6759eb81b7f8742406624d
- SHA512 ac19ae3edf1d4bf9b53c380652aab8c747afdc862c877d5995ff2a2b42c0fbfa0c0e90fa8aea900ee7526e827ac1ffb6dff6c8bed821b4518c4119aacbd235ab
- SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohS:YIfBoDWoyFbkU6hAJQnaU
- TLSH T13794BE253540C436F3290B354855EAB10AA9BC3914D9E48FF778BE7A6D321938B7B24F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE