General
- Target 2026-07-28_5dbf325ecac723da79644b8ebf4fda8f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260728-fd79daybng
- SHA256 d398135537c57037e55260044326cab6200e7ef362583b632729f7d087942838
- MD5 5dbf325ecac723da79644b8ebf4fda8f
- SHA1 88b05130a8b7d57281f6e5d1e1a89ec42cda5422
- SHA512 08e8cf8d71a97ae45aa6d6bbe51be52592c9dd66eefe186ecad0b50875ebc44d89909b2c6af2c0e669238a6780e10a31a5536488492944e33d88c5f3e3ed8e85
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DM8:AIfjoga6u1AVD8
- TLSH T1EB65D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-28_5dbf325ecac723da79644b8ebf4fda8f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-07-28_5dbf325ecac723da79644b8ebf4fda8f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 d398135537c57037e55260044326cab6200e7ef362583b632729f7d087942838
- MD5 5dbf325ecac723da79644b8ebf4fda8f
- SHA1 88b05130a8b7d57281f6e5d1e1a89ec42cda5422
- SHA512 08e8cf8d71a97ae45aa6d6bbe51be52592c9dd66eefe186ecad0b50875ebc44d89909b2c6af2c0e669238a6780e10a31a5536488492944e33d88c5f3e3ed8e85
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DM8:AIfjoga6u1AVD8
- TLSH T1EB65D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE