General
- Target 2026-11-01_ef64242fd4b93e34f0eaccdc94760cf5_amadey_elex_rhadamanthys_smoke-loader_stop
- Size 592KB
- Sample261102-ecrdssgz6m
- SHA256 afa874fc5074ee69db2f3b137633137e5758dab304dc8bb5404568d0b84b0596
- MD5 ef64242fd4b93e34f0eaccdc94760cf5
- SHA1 82ee933cfd68c1b87b6d7584a5c88961c77a3fa7
- SHA512 14e3c3f4b0963b3b78cf5cf5060b704f453548448dfbdc1b8d0a94ec84c9f899003a582dfba7f6fd583111958f13094b17f15afa1d081a8f59be8c7a88b1ca24
- SSDEEP 6144:KzU7blKaPcbhj+bB7ktZeRnVDJm0oNjOPdInpBo:MU7MLb4BQkntwNjqdp
- TLSH T1A6D4CF263580C436F72A07364441E6F00AA9AC3D19D9E54FF7B87E7969301A78B3B24F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-01_ef64242fd4b93e34f0eaccdc94760cf5_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.226
-
218.54.31.165
Targets
-
- Target 2026-11-01_ef64242fd4b93e34f0eaccdc94760cf5_amadey_elex_rhadamanthys_smoke-loader_stop
- Size 592KB
- SHA256 afa874fc5074ee69db2f3b137633137e5758dab304dc8bb5404568d0b84b0596
- MD5 ef64242fd4b93e34f0eaccdc94760cf5
- SHA1 82ee933cfd68c1b87b6d7584a5c88961c77a3fa7
- SHA512 14e3c3f4b0963b3b78cf5cf5060b704f453548448dfbdc1b8d0a94ec84c9f899003a582dfba7f6fd583111958f13094b17f15afa1d081a8f59be8c7a88b1ca24
- SSDEEP 6144:KzU7blKaPcbhj+bB7ktZeRnVDJm0oNjOPdInpBo:MU7MLb4BQkntwNjqdp
- TLSH T1A6D4CF263580C436F72A07364441E6F00AA9AC3D19D9E54FF7B87E7969301A78B3B24F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE