General
- Target 2026-08-07_456b11430ebdeaec9320cc9c9a9ef6ac_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260807-nyhhfsxtc1
- SHA256 6d5524eeb3451a7d0b721dfd156204234bc19a07b3541918d9fcfa6314655480
- MD5 456b11430ebdeaec9320cc9c9a9ef6ac
- SHA1 cc22d88043b408f46d8b0eba8d2d60425f27a127
- SHA512 2162ba8e6df827801435ab0ce98d79629e7cd5b04b5e779c195a69e3e3e94294ec5a5383b985927f6ebcedf8ca09526f0bdb9cc3f57e35d46846a19d71f58951
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMh:AIfjoga6u1AVDh
- TLSH T17A65D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-07_456b11430ebdeaec9320cc9c9a9ef6ac_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-07_456b11430ebdeaec9320cc9c9a9ef6ac_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 6d5524eeb3451a7d0b721dfd156204234bc19a07b3541918d9fcfa6314655480
- MD5 456b11430ebdeaec9320cc9c9a9ef6ac
- SHA1 cc22d88043b408f46d8b0eba8d2d60425f27a127
- SHA512 2162ba8e6df827801435ab0ce98d79629e7cd5b04b5e779c195a69e3e3e94294ec5a5383b985927f6ebcedf8ca09526f0bdb9cc3f57e35d46846a19d71f58951
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMh:AIfjoga6u1AVDh
- TLSH T17A65D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE