General
- Target 2026-07-04_5b5f309b53b77ae3e4cfbdc537402ee3_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- Sample260704-ssqdbsg151
- SHA256 7bfcecaaf4ad51ee106bcdb1fa2f8641cc2f1b90aa02d96b233d2f58a99da186
- MD5 5b5f309b53b77ae3e4cfbdc537402ee3
- SHA1 c93a284d2049f47ef982c2ee7358ee0544b46e5f
- SHA512 1a2423a63b8b8aacff2f859fa2b628960e913f5002277b79825c49fd8e71530fde5beb4920dfe872205435c9627c7b0182f623b0c8c36e628ea6c73de7983b8c
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXe8:UIfjoga66AVDKUTbQIzFLwL8
- TLSH T11B850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-04_5b5f309b53b77ae3e4cfbdc537402ee3_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-07-04_5b5f309b53b77ae3e4cfbdc537402ee3_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- SHA256 7bfcecaaf4ad51ee106bcdb1fa2f8641cc2f1b90aa02d96b233d2f58a99da186
- MD5 5b5f309b53b77ae3e4cfbdc537402ee3
- SHA1 c93a284d2049f47ef982c2ee7358ee0544b46e5f
- SHA512 1a2423a63b8b8aacff2f859fa2b628960e913f5002277b79825c49fd8e71530fde5beb4920dfe872205435c9627c7b0182f623b0c8c36e628ea6c73de7983b8c
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXe8:UIfjoga66AVDKUTbQIzFLwL8
- TLSH T11B850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE