General
- Target 2026-07-14_6aee9d73ebd670959790420e1823c73f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260714-vec7ysgz8l
- SHA256 09697b28011532aa26ac7b71e1fc0b0088917a96de197f1c3ae528859554127f
- MD5 6aee9d73ebd670959790420e1823c73f
- SHA1 9663b726d563f3a0030cc023af5699960bf6d874
- SHA512 6e15db6763536dd8c6e1081caccf6100d2f284a9f873e38a20282cdaf5959f20a5362ccf0facbd5e0feb899b986e0ef7da464d86300db3fbf7e005e7f8080710
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DM9:AIfjoga6u1AVD9
- TLSH T1F165D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-14_6aee9d73ebd670959790420e1823c73f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-07-14_6aee9d73ebd670959790420e1823c73f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 09697b28011532aa26ac7b71e1fc0b0088917a96de197f1c3ae528859554127f
- MD5 6aee9d73ebd670959790420e1823c73f
- SHA1 9663b726d563f3a0030cc023af5699960bf6d874
- SHA512 6e15db6763536dd8c6e1081caccf6100d2f284a9f873e38a20282cdaf5959f20a5362ccf0facbd5e0feb899b986e0ef7da464d86300db3fbf7e005e7f8080710
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DM9:AIfjoga6u1AVD9
- TLSH T1F165D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE