Extracted

Extracted

Extracted

• • Target
    2026-08-23_0a9b05da0568792c8c5de28e8efcd823_amadey_elex_glassworm_karagany_njrat_rhadamanthys_smoke-loader_stop
  • Size 220KB
  • SHA256 5748b46714e260c4c961c5cae19d4d82c16527b1e2cb1854d79f01ea0a830810
  • MD5 0a9b05da0568792c8c5de28e8efcd823
  • SHA1 267d2acda07cf86d993e2aa868a5a4b57b1262cb
  • SHA512 b6b49ee01905f6b99760ccbf530f4b8afd9f015979ad1dcc8479fc115e06da66cf082af93af38373f688e6baae00fc9b486848e1449283b0a408f1e24dbf3ea7
  • SSDEEP 3072:zMSncRaSw1bvc5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/YIU0wn8PQtv:ISncR41bvUS7BqjjYHdrqkL/zL
  • TLSH
    T17824D5243AFA9029F173EF755FE47596DA6FF6633B07949E1080034A0B13A81DE9163E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  9gztcediscoveryexecutionarrowratlimeratpersistenceransomwarerat

  • Family: ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Family: LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat
  • Custom signature

    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Custom signature

    Detects executables containing URLs to raw contents of a Github gist

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2