General
- Target 2026-06-12_d0d60bd184fc8a1c23f3e0c1a0f0023d_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260612-ql2rnsey5m
- SHA256 96ef05557b83615d476dcd0caaf2c96a21914451e4218298458d28890b33c5a2
- MD5 d0d60bd184fc8a1c23f3e0c1a0f0023d
- SHA1 7352333913de8c0b8951738e3e7f11e3832d068b
- SHA512 1d9c61b32d2b3e2eebe6365f8b3751b799fb915dc1b7ea3c4a82466b092c78d9c281ed18ff61b050e27f3b1fae12578746d4a5462d9a4a4f8a7d88405e314cc1
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DM2:AIfjoga6u1AVD2
- TLSH T14865D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-06-12_d0d60bd184fc8a1c23f3e0c1a0f0023d_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-06-12_d0d60bd184fc8a1c23f3e0c1a0f0023d_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 96ef05557b83615d476dcd0caaf2c96a21914451e4218298458d28890b33c5a2
- MD5 d0d60bd184fc8a1c23f3e0c1a0f0023d
- SHA1 7352333913de8c0b8951738e3e7f11e3832d068b
- SHA512 1d9c61b32d2b3e2eebe6365f8b3751b799fb915dc1b7ea3c4a82466b092c78d9c281ed18ff61b050e27f3b1fae12578746d4a5462d9a4a4f8a7d88405e314cc1
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DM2:AIfjoga6u1AVD2
- TLSH T14865D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE