General
- Target 2026-11-05_36fd9f998a7c3385465f702b7d42b72e_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 4.2MB
- Sample261107-e5axhsaw9k
- SHA256 697c224ca3586a60065f2fcab4f0f60f4151251570bb28e4ca23624639077805
- MD5 36fd9f998a7c3385465f702b7d42b72e
- SHA1 e106930392d0761c635bf69bb66a5e94d1c80e1c
- SHA512 d9dfdf17f50b069987a1fc1135e9377d9e867647ac73eb91f192c332b280068069b7ca66fb02ae6b6e8607f3d2c6057961273c955cf3148667ea24bbbd5fcbd7
- SSDEEP 24576:0aEcRxp6zm9we/6MMh3Qh3OFZr8Eu8MdoHQhUp5DBMYjvDwu:ScRH6z5eG6wZM8HHQkaYN
- TLSH T1F016D31173F94895F6F36B30AEB081555F36BDA89EF6C62D3144128E0DB6A50BE31B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-05_36fd9f998a7c3385465f702b7d42b72e_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-11-05_36fd9f998a7c3385465f702b7d42b72e_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 4.2MB
- SHA256 697c224ca3586a60065f2fcab4f0f60f4151251570bb28e4ca23624639077805
- MD5 36fd9f998a7c3385465f702b7d42b72e
- SHA1 e106930392d0761c635bf69bb66a5e94d1c80e1c
- SHA512 d9dfdf17f50b069987a1fc1135e9377d9e867647ac73eb91f192c332b280068069b7ca66fb02ae6b6e8607f3d2c6057961273c955cf3148667ea24bbbd5fcbd7
- SSDEEP 24576:0aEcRxp6zm9we/6MMh3Qh3OFZr8Eu8MdoHQhUp5DBMYjvDwu:ScRH6z5eG6wZM8HHQkaYN
- TLSH T1F016D31173F94895F6F36B30AEB081555F36BDA89EF6C62D3144128E0DB6A50BE31B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Custom signature
Detects executables referencing many IR and analysis tools
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE