General
- Target 2026-08-02_10f0d4edf0db2928cfcdaa065bc28bf8_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- Sample260802-pc4z1ay1bz
- SHA256 079d7a9d7ffe5455ffa381cde036ed1627b3d889c967403901e844e9a930e076
- MD5 10f0d4edf0db2928cfcdaa065bc28bf8
- SHA1 fbd0343acd5ba829dd29729982c9c926802f6f24
- SHA512 a791a800cf7481312ee67976a1b70cd3323a6c93c6e3324f85d6e3a63c2e37b19c9e5ca3f27116542f4ad214e54f321c57f74ea35c562a80ebdbb5d4fbc2011c
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXe8:UIfjoga66AVDKUTbQIzFLwL8
- TLSH T1AD850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-02_10f0d4edf0db2928cfcdaa065bc28bf8_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-02_10f0d4edf0db2928cfcdaa065bc28bf8_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- SHA256 079d7a9d7ffe5455ffa381cde036ed1627b3d889c967403901e844e9a930e076
- MD5 10f0d4edf0db2928cfcdaa065bc28bf8
- SHA1 fbd0343acd5ba829dd29729982c9c926802f6f24
- SHA512 a791a800cf7481312ee67976a1b70cd3323a6c93c6e3324f85d6e3a63c2e37b19c9e5ca3f27116542f4ad214e54f321c57f74ea35c562a80ebdbb5d4fbc2011c
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXe8:UIfjoga66AVDKUTbQIzFLwL8
- TLSH T1AD850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE