General
- Target 2026-10-30_12eef9f92e074c32895acef06e7ef82e_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 4.2MB
- Sample261101-gssynsbd63
- SHA256 0abcdfeb99ce9a5b8e977fd725a2cb9ab7b7ddae9d940e4c4c01ae1dca4064fb
- MD5 12eef9f92e074c32895acef06e7ef82e
- SHA1 0c63c1df795812ffb755b994a57a8b0c7a1ccdc7
- SHA512 7b4e40be581964fb6f0649d15bf9bf27b58054d1c9343675766831f79a83ad50d0aa0b6b0039fbb59050e1c94192c6fe332bb1e4048122bfb42026edcd057285
- SSDEEP 24576:0aEcRxp6zm9we/6MMh3Qh3OFZr8Eu8MdoHQhUp5DBMYjvDwl:ScRH6z5eG6wZM8HHQkaYa
- TLSH T19916D31173F94895F6F36B30AEB081555F36BDA89EF6C62D3144128E0DB6A50BE31B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-30_12eef9f92e074c32895acef06e7ef82e_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-10-30_12eef9f92e074c32895acef06e7ef82e_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 4.2MB
- SHA256 0abcdfeb99ce9a5b8e977fd725a2cb9ab7b7ddae9d940e4c4c01ae1dca4064fb
- MD5 12eef9f92e074c32895acef06e7ef82e
- SHA1 0c63c1df795812ffb755b994a57a8b0c7a1ccdc7
- SHA512 7b4e40be581964fb6f0649d15bf9bf27b58054d1c9343675766831f79a83ad50d0aa0b6b0039fbb59050e1c94192c6fe332bb1e4048122bfb42026edcd057285
- SSDEEP 24576:0aEcRxp6zm9we/6MMh3Qh3OFZr8Eu8MdoHQhUp5DBMYjvDwl:ScRH6z5eG6wZM8HHQkaYa
- TLSH T19916D31173F94895F6F36B30AEB081555F36BDA89EF6C62D3144128E0DB6A50BE31B32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables referencing many IR and analysis tools
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE