General
- Target 2026-07-12_f347532915cf2a1b15fd719856905947_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260712-s7krdscv5n
- SHA256 489f0d30df54ac0ef30db75fa52eee96e6c72e5997110b1e3a40cc3109d9ece4
- MD5 f347532915cf2a1b15fd719856905947
- SHA1 1c1aee87049c560facbdeec877567d2144633860
- SHA512 48fb00fd7a1a41ca4b66d4a3930c5c4c60b6fd22dad45e0a6012d2153a6f4ef17acdc9cb3f08f7595266cfdd4c1870c3dacbb8ab35188aa8b48b2aca307f97e2
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DML:AIfjoga6u1AVDL
- TLSH T1FE65D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-12_f347532915cf2a1b15fd719856905947_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-07-12_f347532915cf2a1b15fd719856905947_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 489f0d30df54ac0ef30db75fa52eee96e6c72e5997110b1e3a40cc3109d9ece4
- MD5 f347532915cf2a1b15fd719856905947
- SHA1 1c1aee87049c560facbdeec877567d2144633860
- SHA512 48fb00fd7a1a41ca4b66d4a3930c5c4c60b6fd22dad45e0a6012d2153a6f4ef17acdc9cb3f08f7595266cfdd4c1870c3dacbb8ab35188aa8b48b2aca307f97e2
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DML:AIfjoga6u1AVDL
- TLSH T1FE65D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE