General
- Target 2026-08-07_bc993f6cb01e1df2a5d076c86282cc69_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260807-p17e2aysds
- SHA256 c00ef625378ba765173a24ee25abfb7fc07f7769c17d92d6a6188bb8fa6f7e96
- MD5 bc993f6cb01e1df2a5d076c86282cc69
- SHA1 f4f83bc32cda86cccc832061d21eec561f58660e
- SHA512 fa29b0d8de3f10f1d9f40e41370fcb6a1b0883414ae30007e052d3e6117ec21ac851682bacce3068410a097c40ff60445350b4960e99805209cbfef6740643de
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMv:AIfjoga6u1AVDv
- TLSH T19465D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-07_bc993f6cb01e1df2a5d076c86282cc69_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-07_bc993f6cb01e1df2a5d076c86282cc69_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 c00ef625378ba765173a24ee25abfb7fc07f7769c17d92d6a6188bb8fa6f7e96
- MD5 bc993f6cb01e1df2a5d076c86282cc69
- SHA1 f4f83bc32cda86cccc832061d21eec561f58660e
- SHA512 fa29b0d8de3f10f1d9f40e41370fcb6a1b0883414ae30007e052d3e6117ec21ac851682bacce3068410a097c40ff60445350b4960e99805209cbfef6740643de
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMv:AIfjoga6u1AVDv
- TLSH T19465D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE