General
- Target 2026-06-28_58e25eaa67cb7ae31515e6bd1eafffb5_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260628-2dpypafv31
- SHA256 f013460ccaab53b9515d1ae90b9ed1acb530666dc86fcd6ab92ce6d648cc1aa6
- MD5 58e25eaa67cb7ae31515e6bd1eafffb5
- SHA1 de02db28d29ccbcd4efd909b8e785fea751fe9f6
- SHA512 0f5b4f7b0e5cf7dd472af022cd87958f3b520026969ab988df9b241418d69c2ada373eb2aca02d1372e0a7546022ced85cdd4df1b2b43a0f34c90b565eeef5dc
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMh:AIfjoga6u1AVDh
- TLSH T13A65D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-06-28_58e25eaa67cb7ae31515e6bd1eafffb5_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-06-28_58e25eaa67cb7ae31515e6bd1eafffb5_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 f013460ccaab53b9515d1ae90b9ed1acb530666dc86fcd6ab92ce6d648cc1aa6
- MD5 58e25eaa67cb7ae31515e6bd1eafffb5
- SHA1 de02db28d29ccbcd4efd909b8e785fea751fe9f6
- SHA512 0f5b4f7b0e5cf7dd472af022cd87958f3b520026969ab988df9b241418d69c2ada373eb2aca02d1372e0a7546022ced85cdd4df1b2b43a0f34c90b565eeef5dc
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMh:AIfjoga6u1AVDh
- TLSH T13A65D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE