General
- Target 2026-07-05_ac2a8a290f84ee06baab8e6c4df0d615_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- Sample260705-d4xt8acx5k
- SHA256 14d841d03bbec544f993d225cbfc384c2841412c913fee71670d3414cb06cc1d
- MD5 ac2a8a290f84ee06baab8e6c4df0d615
- SHA1 564fba3127ca9a92f22813ac34ffdc835feef0d2
- SHA512 3369aedc85aaedbc2064999dd124f74327353804bba960725c718bfe4a9977b024620e0dd467568e91303358d20739cf0f3bfeadf1d743bea40430b1e9e78a22
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXeE:UIfjoga66AVDKUTbQIzFLwLE
- TLSH T1ED850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-05_ac2a8a290f84ee06baab8e6c4df0d615_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-07-05_ac2a8a290f84ee06baab8e6c4df0d615_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- SHA256 14d841d03bbec544f993d225cbfc384c2841412c913fee71670d3414cb06cc1d
- MD5 ac2a8a290f84ee06baab8e6c4df0d615
- SHA1 564fba3127ca9a92f22813ac34ffdc835feef0d2
- SHA512 3369aedc85aaedbc2064999dd124f74327353804bba960725c718bfe4a9977b024620e0dd467568e91303358d20739cf0f3bfeadf1d743bea40430b1e9e78a22
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXeE:UIfjoga66AVDKUTbQIzFLwLE
- TLSH T1ED850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE