General
- Target 2026-08-07_717a9ddab466aea1b509ab61c6a2f0be_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260807-p7wbcawbpg
- SHA256 ee2a303588bc5e8725b7a85ac4be1a2e8833bacbe87414df31a43d4391d2060f
- MD5 717a9ddab466aea1b509ab61c6a2f0be
- SHA1 e292bf25570bddc78d6cb1ee81c166171704a893
- SHA512 3c466790351f1506e27995f316d7e75b95d2c61e0a162efd3e674532f76822c927ac93b025f0078e208b4921c3fbd2377b02acf112caa4d821dd0a12429eac07
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMP:AIfjoga6u1AVDP
- TLSH T16C65D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-07_717a9ddab466aea1b509ab61c6a2f0be_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-07_717a9ddab466aea1b509ab61c6a2f0be_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 ee2a303588bc5e8725b7a85ac4be1a2e8833bacbe87414df31a43d4391d2060f
- MD5 717a9ddab466aea1b509ab61c6a2f0be
- SHA1 e292bf25570bddc78d6cb1ee81c166171704a893
- SHA512 3c466790351f1506e27995f316d7e75b95d2c61e0a162efd3e674532f76822c927ac93b025f0078e208b4921c3fbd2377b02acf112caa4d821dd0a12429eac07
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMP:AIfjoga6u1AVDP
- TLSH T16C65D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE