General
- Target 2026-11-12_56eb2e0b87f29abef961a9c6de2b0afa_amadey_elex_rhadamanthys_smoke-loader_stop
- Size 354KB
- Sample261113-c6rkjsft8p
- SHA256 b84b42f7e75aa913d2f9c1da77e94f7343741ba821b68bcbac3af49ca7ff45d5
- MD5 56eb2e0b87f29abef961a9c6de2b0afa
- SHA1 a794d0a6c6c28aa6dd9c9cfbbbcf329f9ed21e08
- SHA512 eb503d892e270edc78dd8e3099808237523e7629e6d2a151d67d70e1b7122bd88cfe9cefe994c09c6c29edc18636b4ff8cc6f06534221f519e29aac98194772c
- SSDEEP 3072:wdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDKCZ4:wd7rpL43btmQ58Z27zw3eZ4
- TLSH T118748D253580C475F32A07314446EAF00A66BC391A99E54FFBB8BD79AD311978B3B24F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-12_56eb2e0b87f29abef961a9c6de2b0afa_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-11-12_56eb2e0b87f29abef961a9c6de2b0afa_amadey_elex_rhadamanthys_smoke-loader_stop
- Size 354KB
- SHA256 b84b42f7e75aa913d2f9c1da77e94f7343741ba821b68bcbac3af49ca7ff45d5
- MD5 56eb2e0b87f29abef961a9c6de2b0afa
- SHA1 a794d0a6c6c28aa6dd9c9cfbbbcf329f9ed21e08
- SHA512 eb503d892e270edc78dd8e3099808237523e7629e6d2a151d67d70e1b7122bd88cfe9cefe994c09c6c29edc18636b4ff8cc6f06534221f519e29aac98194772c
- SSDEEP 3072:wdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDKCZ4:wd7rpL43btmQ58Z27zw3eZ4
- TLSH T118748D253580C475F32A07314446EAF00A66BC391A99E54FFBB8BD79AD311978B3B24F
- MD5 SHA1 SHA512 SSDEEP TLSH
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE