General
- Target 2026-07-30_735b383f478b0010dbd5cbf176315b89_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- Sample260730-stlrjabe94
- SHA256 4934d9807b3bf47bfd54f9fadbadfa4e267d480327935ca378ed18ca719aae6c
- MD5 735b383f478b0010dbd5cbf176315b89
- SHA1 1935842c0681cc5c91b145fb80c850fd80a28fba
- SHA512 1b1e3f724a1392a59566711f891c3b76ae5571c3340dd96eb05c53c80256f8ee35fcb1aec52134d42ab9857a1b2260027336637aa27e49030fb4c2e632cbd4d9
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXe/:UIfjoga66AVDKUTbQIzFLwL/
- TLSH T135850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-30_735b383f478b0010dbd5cbf176315b89_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-07-30_735b383f478b0010dbd5cbf176315b89_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- SHA256 4934d9807b3bf47bfd54f9fadbadfa4e267d480327935ca378ed18ca719aae6c
- MD5 735b383f478b0010dbd5cbf176315b89
- SHA1 1935842c0681cc5c91b145fb80c850fd80a28fba
- SHA512 1b1e3f724a1392a59566711f891c3b76ae5571c3340dd96eb05c53c80256f8ee35fcb1aec52134d42ab9857a1b2260027336637aa27e49030fb4c2e632cbd4d9
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXe/:UIfjoga66AVDKUTbQIzFLwL/
- TLSH T135850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE