General
- Target 2026-07-28_958f2f607c15271d647a047f11ecbac9_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- Sample260728-vlsk8asshz
- SHA256 177a102919ae41f0bb7020a53af84866a37176f88523e3d78d8bcf587beefd5a
- MD5 958f2f607c15271d647a047f11ecbac9
- SHA1 38e067becabe0ffaf519228c8ee4fa761faebeea
- SHA512 cd92a590dc255d0103bf2cfb5bee7f21e4ad0e5ea48beaaa7ac585b9a4e7ccd1428006dd861fd1fe29dec24d466905d9db7c0cccf7b8561ad53c4148e8474658
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXeI:UIfjoga66AVDKUTbQIzFLwLI
- TLSH T1E4850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-28_958f2f607c15271d647a047f11ecbac9_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-07-28_958f2f607c15271d647a047f11ecbac9_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- SHA256 177a102919ae41f0bb7020a53af84866a37176f88523e3d78d8bcf587beefd5a
- MD5 958f2f607c15271d647a047f11ecbac9
- SHA1 38e067becabe0ffaf519228c8ee4fa761faebeea
- SHA512 cd92a590dc255d0103bf2cfb5bee7f21e4ad0e5ea48beaaa7ac585b9a4e7ccd1428006dd861fd1fe29dec24d466905d9db7c0cccf7b8561ad53c4148e8474658
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXeI:UIfjoga66AVDKUTbQIzFLwLI
- TLSH T1E4850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE