General
- Target 2026-07-31_891cab0e14139e7c3c84f45bfd2d98e0_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260731-gcbz8aveka
- SHA256 accee72036e16096e2e92782abcd77abf6a351ff9568218a51ba04194ab4fffc
- MD5 891cab0e14139e7c3c84f45bfd2d98e0
- SHA1 9966acef724535afee799c956a41c248ad6578d9
- SHA512 d295b8aa36541b8ef5a18b733d0b3ed27c10650483d1fce2ce245cbc5f66409879a53bbce1f641eaf32bf8f9cdac1cc9b84270fb9c32f4db2d60303511391381
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DM5:AIfjoga6u1AVD5
- TLSH T1E165D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-31_891cab0e14139e7c3c84f45bfd2d98e0_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-07-31_891cab0e14139e7c3c84f45bfd2d98e0_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 accee72036e16096e2e92782abcd77abf6a351ff9568218a51ba04194ab4fffc
- MD5 891cab0e14139e7c3c84f45bfd2d98e0
- SHA1 9966acef724535afee799c956a41c248ad6578d9
- SHA512 d295b8aa36541b8ef5a18b733d0b3ed27c10650483d1fce2ce245cbc5f66409879a53bbce1f641eaf32bf8f9cdac1cc9b84270fb9c32f4db2d60303511391381
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DM5:AIfjoga6u1AVD5
- TLSH T1E165D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE