General
- Target 2026-06-04_0829789207332a7d72622ab0ff7f995f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260604-kr3chacw7q
- SHA256 99420b60cbdb445a2196156ba4aee9c8a3f1e16be744d6704336a20a20847a86
- MD5 0829789207332a7d72622ab0ff7f995f
- SHA1 17b2d10617f59adf2ce0276df75eb848e5e1cd26
- SHA512 6d1773cecedec8c76305fe8dbd0f01f822b590a86247059580cae77e4ae741181e4e6078a5fbdc745fa4a0c5c98b72d32a88aef5fce73e3177cd697ccd1cf876
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMU:AIfjoga6u1AVDU
- TLSH T1C065D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-06-04_0829789207332a7d72622ab0ff7f995f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-06-04_0829789207332a7d72622ab0ff7f995f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 99420b60cbdb445a2196156ba4aee9c8a3f1e16be744d6704336a20a20847a86
- MD5 0829789207332a7d72622ab0ff7f995f
- SHA1 17b2d10617f59adf2ce0276df75eb848e5e1cd26
- SHA512 6d1773cecedec8c76305fe8dbd0f01f822b590a86247059580cae77e4ae741181e4e6078a5fbdc745fa4a0c5c98b72d32a88aef5fce73e3177cd697ccd1cf876
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMU:AIfjoga6u1AVDU
- TLSH T1C065D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE