General
- Target 2026-11-01_c1a7d2ce016488474720bbef312ed224_amadey_elex_smoke-loader_stealc_stop
- Size 511KB
- Sample261102-lnqpzat19j
- SHA256 05d31949a4fbab74b89f6d9f1949acff92043db27e652d2530da156a525961f7
- MD5 c1a7d2ce016488474720bbef312ed224
- SHA1 20f44b8db27e8af81cd13aad101ca8e3606494d6
- SHA512 505889e208f15f2814856a618755f413f890de28484d6723bf528420cd46a9da907ecb6e49697e33a1b3897562881053eb1d9c2a5e8dab5d73935266b8a92510
- SSDEEP 12288:j/fCEOMsm8nc3qWQ8wqKhb43nLl5tDrXlFq:j/D0caF8wvhb43pDbq
- TLSH T12FB4BE113650C436E32A177148C6FBF46AA9BC3549A5E64FFA787F395E301934A2B20F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-01_c1a7d2ce016488474720bbef312ed224_amadey_elex_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
1.234.83.146
-
133.242.129.155
-
218.54.31.226
-
218.54.30.235
-
218.54.31.165
Targets
-
- Target 2026-11-01_c1a7d2ce016488474720bbef312ed224_amadey_elex_smoke-loader_stealc_stop
- Size 511KB
- SHA256 05d31949a4fbab74b89f6d9f1949acff92043db27e652d2530da156a525961f7
- MD5 c1a7d2ce016488474720bbef312ed224
- SHA1 20f44b8db27e8af81cd13aad101ca8e3606494d6
- SHA512 505889e208f15f2814856a618755f413f890de28484d6723bf528420cd46a9da907ecb6e49697e33a1b3897562881053eb1d9c2a5e8dab5d73935266b8a92510
- SSDEEP 12288:j/fCEOMsm8nc3qWQ8wqKhb43nLl5tDrXlFq:j/D0caF8wvhb43pDbq
- TLSH T12FB4BE113650C436E32A177148C6FBF46AA9BC3549A5E64FFA787F395E301934A2B20F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE