General
- Target 2026-11-05_2b2ebe0eb02a87128b0325f100c86cba_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 4.2MB
- Sample261107-gp9f9aa12j
- SHA256 82e382e4e66fd84145146ea9fa9800bc993b494950a4297fe3b25a7f560f7392
- MD5 2b2ebe0eb02a87128b0325f100c86cba
- SHA1 f180a98ffe2a766ae0130f89d54805e3de3a4afc
- SHA512 705ab6a83ea7082afe8dd1451feed404eb4bec3b32ead36d8bc3b3ae931abe905282692995db50d01534b99ee5141ff6b7f23003992a8f6cf30e5158927a0e8b
- SSDEEP 24576:0aEcRxp6zm9we/6MMh3Qh3OFZr8Eu8MdoHQhUp5DBMYjvDwN:ScRH6z5eG6wZM8HHQkaYU
- TLSH T10E16D31173F94895F6F36B30AEB081555F36BDA89EF6C62D3144128E0DB6A50BE31B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-05_2b2ebe0eb02a87128b0325f100c86cba_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-11-05_2b2ebe0eb02a87128b0325f100c86cba_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 4.2MB
- SHA256 82e382e4e66fd84145146ea9fa9800bc993b494950a4297fe3b25a7f560f7392
- MD5 2b2ebe0eb02a87128b0325f100c86cba
- SHA1 f180a98ffe2a766ae0130f89d54805e3de3a4afc
- SHA512 705ab6a83ea7082afe8dd1451feed404eb4bec3b32ead36d8bc3b3ae931abe905282692995db50d01534b99ee5141ff6b7f23003992a8f6cf30e5158927a0e8b
- SSDEEP 24576:0aEcRxp6zm9we/6MMh3Qh3OFZr8Eu8MdoHQhUp5DBMYjvDwN:ScRH6z5eG6wZM8HHQkaYU
- TLSH T10E16D31173F94895F6F36B30AEB081555F36BDA89EF6C62D3144128E0DB6A50BE31B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Custom signature
Detects executables referencing many IR and analysis tools
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE