General
- Target 2026-07-13_49b8ffd61b396a9bf412dd00839faf10_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260714-bt84dset3w
- SHA256 0547c37f839d8c6238f3e4c15c36d6d97e4fcdbee4fd5f5ebfc6be4a278b00bc
- MD5 49b8ffd61b396a9bf412dd00839faf10
- SHA1 a8adde65def6180ee4128c2cb6a272138b36eb29
- SHA512 37ca92163791bb17ce58e2a098c794a7237e27e5076f5107a21f924fb735a51cafce3b84316276bdee65d9a8cef0d6ce927ffb900428cabb6891fbfdb3ce15e9
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMy:AIfjoga6u1AVDy
- TLSH T19765D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-13_49b8ffd61b396a9bf412dd00839faf10_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-07-13_49b8ffd61b396a9bf412dd00839faf10_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 0547c37f839d8c6238f3e4c15c36d6d97e4fcdbee4fd5f5ebfc6be4a278b00bc
- MD5 49b8ffd61b396a9bf412dd00839faf10
- SHA1 a8adde65def6180ee4128c2cb6a272138b36eb29
- SHA512 37ca92163791bb17ce58e2a098c794a7237e27e5076f5107a21f924fb735a51cafce3b84316276bdee65d9a8cef0d6ce927ffb900428cabb6891fbfdb3ce15e9
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMy:AIfjoga6u1AVDy
- TLSH T19765D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE