General
- Target 2026-08-04_38e474ee208bc495a2abf22cef4b09ea_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- Sample260805-bfvzlsvfkf
- SHA256 e9656d765f5db41510273b3f9880f122492fb001ebc284d67df64efbad98446f
- MD5 38e474ee208bc495a2abf22cef4b09ea
- SHA1 4f3ab24b963382e81947416bd437b6889fec8fd5
- SHA512 bafc9291033a271a3b85688b1cbb454ee1e98002aaab5cb6f762c4e75a8ff4f0bec49028a6e275a54a0787d0f39848f70f72579c31fd1d53fc01481a99f868d9
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXe/:UIfjoga66AVDKUTbQIzFLwL/
- TLSH T16D850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-04_38e474ee208bc495a2abf22cef4b09ea_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-04_38e474ee208bc495a2abf22cef4b09ea_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- SHA256 e9656d765f5db41510273b3f9880f122492fb001ebc284d67df64efbad98446f
- MD5 38e474ee208bc495a2abf22cef4b09ea
- SHA1 4f3ab24b963382e81947416bd437b6889fec8fd5
- SHA512 bafc9291033a271a3b85688b1cbb454ee1e98002aaab5cb6f762c4e75a8ff4f0bec49028a6e275a54a0787d0f39848f70f72579c31fd1d53fc01481a99f868d9
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXe/:UIfjoga66AVDKUTbQIzFLwL/
- TLSH T16D850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE