General
- Target 2026-10-30_96cfd4484d15465960d5507fc4c2b292_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 4.2MB
- Sample261031-2hblvsgv9n
- SHA256 958db2d26b31db0233435081c1453e4f3de6575f1f42e6be82a262701f60c185
- MD5 96cfd4484d15465960d5507fc4c2b292
- SHA1 1c49217fdb588095dfc0924cfc3850c80bdf7553
- SHA512 70a1fc44c02175c63213198ebc78dc7a3a09b3e88cdd9f2cb73633f242cb06572845217e49b0221829c608c8b1bcf85f2af45676ab4cfa1b63cf67df37f034a2
- SSDEEP 24576:0aEcRxp6zm9we/6MMh3Qh3OFZr8Eu8MdoHQhUp5DBMYjvDwC:ScRH6z5eG6wZM8HHQkaYt
- TLSH T15516D31173F94895F6F36B30AEB081555F36BDA89EF6C62D3144128E0DB6A50BE31B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-30_96cfd4484d15465960d5507fc4c2b292_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-10-30_96cfd4484d15465960d5507fc4c2b292_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 4.2MB
- SHA256 958db2d26b31db0233435081c1453e4f3de6575f1f42e6be82a262701f60c185
- MD5 96cfd4484d15465960d5507fc4c2b292
- SHA1 1c49217fdb588095dfc0924cfc3850c80bdf7553
- SHA512 70a1fc44c02175c63213198ebc78dc7a3a09b3e88cdd9f2cb73633f242cb06572845217e49b0221829c608c8b1bcf85f2af45676ab4cfa1b63cf67df37f034a2
- SSDEEP 24576:0aEcRxp6zm9we/6MMh3Qh3OFZr8Eu8MdoHQhUp5DBMYjvDwC:ScRH6z5eG6wZM8HHQkaYt
- TLSH T15516D31173F94895F6F36B30AEB081555F36BDA89EF6C62D3144128E0DB6A50BE31B32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables referencing many IR and analysis tools
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE