General
- Target 2026-08-07_c95c5e2f9428694b8a19cbb2a320a0d4_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260807-sr1snsybjb
- SHA256 79478da30b33ba274853e218c7e6911928d1a17f7ae41913f84d197cb9df3d42
- MD5 c95c5e2f9428694b8a19cbb2a320a0d4
- SHA1 30a0adbfa6d7daa923810b751430716f5d026e5a
- SHA512 e4a11708694bb85834cfffcec511504d222a007dde83d6c33ab98df7a443a4954255d1e00eeddb9aff70f7be8e15b3a4f60ec1440def0a6f45c85affccb2720c
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMT:AIfjoga6u1AVDT
- TLSH T18665D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-07_c95c5e2f9428694b8a19cbb2a320a0d4_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-07_c95c5e2f9428694b8a19cbb2a320a0d4_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 79478da30b33ba274853e218c7e6911928d1a17f7ae41913f84d197cb9df3d42
- MD5 c95c5e2f9428694b8a19cbb2a320a0d4
- SHA1 30a0adbfa6d7daa923810b751430716f5d026e5a
- SHA512 e4a11708694bb85834cfffcec511504d222a007dde83d6c33ab98df7a443a4954255d1e00eeddb9aff70f7be8e15b3a4f60ec1440def0a6f45c85affccb2720c
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMT:AIfjoga6u1AVDT
- TLSH T18665D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE