General
- Target 2026-08-03_e59db317f4b27240d2dcd72d66cce750_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- Sample260803-g8nnwsdc83
- SHA256 b9c15b76aed39d7b2c2408658197748026c75f5992cb23348beaaeb80e700428
- MD5 e59db317f4b27240d2dcd72d66cce750
- SHA1 79bcc9fee7f9eb820e57bca46ca50b8eb5b047a7
- SHA512 6fef4ac4a0f06534dfb85f9900afabab6c162da2d6c0639b80204dcc521d02c7840ad350ca09a5f5a6fe174b95df099fe05637078d906bfb22b4dc0da2699d85
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXes:UIfjoga66AVDKUTbQIzFLwLs
- TLSH T116850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-03_e59db317f4b27240d2dcd72d66cce750_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-03_e59db317f4b27240d2dcd72d66cce750_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- SHA256 b9c15b76aed39d7b2c2408658197748026c75f5992cb23348beaaeb80e700428
- MD5 e59db317f4b27240d2dcd72d66cce750
- SHA1 79bcc9fee7f9eb820e57bca46ca50b8eb5b047a7
- SHA512 6fef4ac4a0f06534dfb85f9900afabab6c162da2d6c0639b80204dcc521d02c7840ad350ca09a5f5a6fe174b95df099fe05637078d906bfb22b4dc0da2699d85
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXes:UIfjoga66AVDKUTbQIzFLwLs
- TLSH T116850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE