General
- Target 2026-08-02_ed48b56a10f6f4c048e5b4a38177997e_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260802-3fhstsgq81
- SHA256 3b2b30877e29836c530a9e09358ff28182caa594dd399799081b62595f1e14ec
- MD5 ed48b56a10f6f4c048e5b4a38177997e
- SHA1 2a4d06cb2b4e05831afcdcca223001cf6310cdc6
- SHA512 aa64685add3a202b0cbfa1d692251557b7606a4f84203d772d372cc052523b191360bd9e1c2b091ac7e06006451dfae7475ffc45ce91fe78320b641111684b11
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMy:AIfjoga6u1AVDy
- TLSH T1F965D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-02_ed48b56a10f6f4c048e5b4a38177997e_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-02_ed48b56a10f6f4c048e5b4a38177997e_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 3b2b30877e29836c530a9e09358ff28182caa594dd399799081b62595f1e14ec
- MD5 ed48b56a10f6f4c048e5b4a38177997e
- SHA1 2a4d06cb2b4e05831afcdcca223001cf6310cdc6
- SHA512 aa64685add3a202b0cbfa1d692251557b7606a4f84203d772d372cc052523b191360bd9e1c2b091ac7e06006451dfae7475ffc45ce91fe78320b641111684b11
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMy:AIfjoga6u1AVDy
- TLSH T1F965D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE