General
- Target 2026-08-07_7bbd4d930c3ea49b06bdb1501ef2494b_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260807-tbe2psyfpe
- SHA256 167d84601947ac776d3e07d6ae3341e4f90de84dfff519126d67004fd0244651
- MD5 7bbd4d930c3ea49b06bdb1501ef2494b
- SHA1 ed10443de7cd0b39a7bdbfccb6ad08997307e491
- SHA512 bc1f62f9893f27cc271c1dc4922c8141c3bfd9d8222eff1bdac2cc9136e5b89140a72640cb4008fe7857e4b954bdedb74e646043bbb75debe6e0fe69af97fcc8
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DME:AIfjoga6u1AVDE
- TLSH T1F265D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-07_7bbd4d930c3ea49b06bdb1501ef2494b_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-07_7bbd4d930c3ea49b06bdb1501ef2494b_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 167d84601947ac776d3e07d6ae3341e4f90de84dfff519126d67004fd0244651
- MD5 7bbd4d930c3ea49b06bdb1501ef2494b
- SHA1 ed10443de7cd0b39a7bdbfccb6ad08997307e491
- SHA512 bc1f62f9893f27cc271c1dc4922c8141c3bfd9d8222eff1bdac2cc9136e5b89140a72640cb4008fe7857e4b954bdedb74e646043bbb75debe6e0fe69af97fcc8
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DME:AIfjoga6u1AVDE
- TLSH T1F265D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE