General
- Target 2026-08-03_3f4b501dd834c53a7436485a61a827d0_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260804-pg5r4awwat
- SHA256 1d9b8e7a5089b81b3642e0d6c53c65c6dc89b7bd5e5cc5d9b066b53f33c71396
- MD5 3f4b501dd834c53a7436485a61a827d0
- SHA1 d96a3928649df9f59e09b9a7f0819a0d2f156282
- SHA512 b17fe9b8e9b0249c632f36e973a8059b369e017552fbf8009c2c4f3fdc7ecd165540f387c5f0933da69f8fb6281f57554f0edb489a365ffe084af58c3a2b7166
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMx:AIfjoga6u1AVDx
- TLSH T1EF65D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-03_3f4b501dd834c53a7436485a61a827d0_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-03_3f4b501dd834c53a7436485a61a827d0_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 1d9b8e7a5089b81b3642e0d6c53c65c6dc89b7bd5e5cc5d9b066b53f33c71396
- MD5 3f4b501dd834c53a7436485a61a827d0
- SHA1 d96a3928649df9f59e09b9a7f0819a0d2f156282
- SHA512 b17fe9b8e9b0249c632f36e973a8059b369e017552fbf8009c2c4f3fdc7ecd165540f387c5f0933da69f8fb6281f57554f0edb489a365ffe084af58c3a2b7166
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMx:AIfjoga6u1AVDx
- TLSH T1EF65D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE