General
- Target 2026-08-06_20753e7445ab748f3d26e2777df43212_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260806-q4nyjasepg
- SHA256 bbafe5c1403c79c41d3acbe9d5d5d2b5dc932cd14171b3b32b4763a3886b83c7
- MD5 20753e7445ab748f3d26e2777df43212
- SHA1 7eb2a6686925613b3ba40d089442013b368c571a
- SHA512 d567d78fc568df6c8941b4e51eb13455b882730f2b4f5486879db463b7a54dedb9c7ad3fb5544fc1152e8acaf6f4f23810ec701d5b809e116fdf3cfa4a7cd6a2
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMh:AIfjoga6u1AVDh
- TLSH T1CB65D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-06_20753e7445ab748f3d26e2777df43212_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-06_20753e7445ab748f3d26e2777df43212_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 bbafe5c1403c79c41d3acbe9d5d5d2b5dc932cd14171b3b32b4763a3886b83c7
- MD5 20753e7445ab748f3d26e2777df43212
- SHA1 7eb2a6686925613b3ba40d089442013b368c571a
- SHA512 d567d78fc568df6c8941b4e51eb13455b882730f2b4f5486879db463b7a54dedb9c7ad3fb5544fc1152e8acaf6f4f23810ec701d5b809e116fdf3cfa4a7cd6a2
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMh:AIfjoga6u1AVDh
- TLSH T1CB65D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE