General
- Target 2026-07-30_2295a7d1ec3957790c85e567819de765_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260730-edsy1syfre
- SHA256 26118630659e47d0dba63a18cc789918c52407a113e1bb7babd0260ff0a7a1e3
- MD5 2295a7d1ec3957790c85e567819de765
- SHA1 408332f3805abfa05bf770e89f5758f6b949957b
- SHA512 c9b8dcb25add47d18ae80c3fe6a6fa79d86fa738177279240017a34f255b71efc126dd0b07f31cb0c745a49704f8344403302faed7dcf2859c936f7e1d7deede
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMI:AIfjoga6u1AVDI
- TLSH T14565D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-30_2295a7d1ec3957790c85e567819de765_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-07-30_2295a7d1ec3957790c85e567819de765_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 26118630659e47d0dba63a18cc789918c52407a113e1bb7babd0260ff0a7a1e3
- MD5 2295a7d1ec3957790c85e567819de765
- SHA1 408332f3805abfa05bf770e89f5758f6b949957b
- SHA512 c9b8dcb25add47d18ae80c3fe6a6fa79d86fa738177279240017a34f255b71efc126dd0b07f31cb0c745a49704f8344403302faed7dcf2859c936f7e1d7deede
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMI:AIfjoga6u1AVDI
- TLSH T14565D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE