General
- Target 2026-11-05_a20e3f77b83f63ea4779db3c0cf964e3_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 4.2MB
- Sample261106-rldwaaca79
- SHA256 e7a1329e642d549239bd98f1f0f4de6438d07722d8103d966af5854e85020bdc
- MD5 a20e3f77b83f63ea4779db3c0cf964e3
- SHA1 588d5c6a80ea5797918910bbe14081a38101aad8
- SHA512 77363c7793ff9f12e8f1f0a24fe771e790dd3a3318b61e633f25c52f8f230dd9e9b42a9f83c15f2a6da786768e8a3c3c00b721a3226af7dc8298e5874b2b361d
- SSDEEP 24576:0aEcRxp6zm9we/6MMh3Qh3OFZr8Eu8MdoHQhUp5DBMYjvDwT:ScRH6z5eG6wZM8HHQkaYg
- TLSH T1A216D31173F94895F6F36B30AEB081555F36BDA89EF6C62D3144128E0DB6A50BE31B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-05_a20e3f77b83f63ea4779db3c0cf964e3_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-11-05_a20e3f77b83f63ea4779db3c0cf964e3_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 4.2MB
- SHA256 e7a1329e642d549239bd98f1f0f4de6438d07722d8103d966af5854e85020bdc
- MD5 a20e3f77b83f63ea4779db3c0cf964e3
- SHA1 588d5c6a80ea5797918910bbe14081a38101aad8
- SHA512 77363c7793ff9f12e8f1f0a24fe771e790dd3a3318b61e633f25c52f8f230dd9e9b42a9f83c15f2a6da786768e8a3c3c00b721a3226af7dc8298e5874b2b361d
- SSDEEP 24576:0aEcRxp6zm9we/6MMh3Qh3OFZr8Eu8MdoHQhUp5DBMYjvDwT:ScRH6z5eG6wZM8HHQkaYg
- TLSH T1A216D31173F94895F6F36B30AEB081555F36BDA89EF6C62D3144128E0DB6A50BE31B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Custom signature
Detects executables referencing many IR and analysis tools
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE