General
- Target 2026-10-30_f9d1e38618c9a2e63911e296604c4cf2_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 4.2MB
- Sample261031-vg68taex2j
- SHA256 a5cd22c865cbeb3280df8345d3f8f3a90916c05842f974ff65bbe76f9f8c6bc3
- MD5 f9d1e38618c9a2e63911e296604c4cf2
- SHA1 56b5c086ec2e9ee89d4aff52923fc872b3e851bc
- SHA512 3250a2e500f0c33dfd99ed02833619e8e8073bfab1c13ab2679d9f4f21d51b6f0aa8bf457025a31216bc2884bb6c5c484ef55abc0862f6278439b45c5eae9b66
- SSDEEP 24576:0aEcRxp6zm9we/6MMh3Qh3OFZr8Eu8MdoHQhUp5DBMYjvDwq:ScRH6z5eG6wZM8HHQkaYx
- TLSH T12A16D31173F94895F6F36B30AEB081555F36BDA89EF6C62D3144128E0DB6A50BE31B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-30_f9d1e38618c9a2e63911e296604c4cf2_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-10-30_f9d1e38618c9a2e63911e296604c4cf2_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 4.2MB
- SHA256 a5cd22c865cbeb3280df8345d3f8f3a90916c05842f974ff65bbe76f9f8c6bc3
- MD5 f9d1e38618c9a2e63911e296604c4cf2
- SHA1 56b5c086ec2e9ee89d4aff52923fc872b3e851bc
- SHA512 3250a2e500f0c33dfd99ed02833619e8e8073bfab1c13ab2679d9f4f21d51b6f0aa8bf457025a31216bc2884bb6c5c484ef55abc0862f6278439b45c5eae9b66
- SSDEEP 24576:0aEcRxp6zm9we/6MMh3Qh3OFZr8Eu8MdoHQhUp5DBMYjvDwq:ScRH6z5eG6wZM8HHQkaYx
- TLSH T12A16D31173F94895F6F36B30AEB081555F36BDA89EF6C62D3144128E0DB6A50BE31B32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables referencing many IR and analysis tools
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE