General
- Target 2026-08-03_846da3864f6955288d62e5e3918a9500_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- Sample260804-m5sfkayckb
- SHA256 4b1f0c606e096a01001bf4b7557f569d698388963aa6bc01908f14f4034b17de
- MD5 846da3864f6955288d62e5e3918a9500
- SHA1 0bc38dcbe63da10348c952fe54dc886c65a6c4de
- SHA512 d1bba580ff2af0fea2c576d961512483ad421c2fff4f2c64522a73e4cf21fd74e5ff3e11d9279767ed278188ca51a510c4eed5756b17d87d99e26a3e00db44e0
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXed:UIfjoga66AVDKUTbQIzFLwLd
- TLSH T105850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-03_846da3864f6955288d62e5e3918a9500_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-03_846da3864f6955288d62e5e3918a9500_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- SHA256 4b1f0c606e096a01001bf4b7557f569d698388963aa6bc01908f14f4034b17de
- MD5 846da3864f6955288d62e5e3918a9500
- SHA1 0bc38dcbe63da10348c952fe54dc886c65a6c4de
- SHA512 d1bba580ff2af0fea2c576d961512483ad421c2fff4f2c64522a73e4cf21fd74e5ff3e11d9279767ed278188ca51a510c4eed5756b17d87d99e26a3e00db44e0
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXed:UIfjoga66AVDKUTbQIzFLwLd
- TLSH T105850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE