General
- Target 2026-07-31_dfe338bf55de65ee21011f92e537abd8_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- Sample260731-myteaaha55
- SHA256 be6240bc8811db0a83b4e6793e0d80c60ffb17d72f26120fc2e6561d5c9adb0b
- MD5 dfe338bf55de65ee21011f92e537abd8
- SHA1 04f4b170028e350bfda8d599bebc6f69ff9272ff
- SHA512 77c923ddf778c53176dc29c9053ea0b8cc0c6f265ed986cc58b6ec53290b196652889a21a84c718f4e1fd4c013efdcff9744d8af48506d529148136a9ed9936f
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXeZ:UIfjoga66AVDKUTbQIzFLwLZ
- TLSH T115850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-31_dfe338bf55de65ee21011f92e537abd8_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-07-31_dfe338bf55de65ee21011f92e537abd8_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- SHA256 be6240bc8811db0a83b4e6793e0d80c60ffb17d72f26120fc2e6561d5c9adb0b
- MD5 dfe338bf55de65ee21011f92e537abd8
- SHA1 04f4b170028e350bfda8d599bebc6f69ff9272ff
- SHA512 77c923ddf778c53176dc29c9053ea0b8cc0c6f265ed986cc58b6ec53290b196652889a21a84c718f4e1fd4c013efdcff9744d8af48506d529148136a9ed9936f
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXeZ:UIfjoga66AVDKUTbQIzFLwLZ
- TLSH T115850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE