General
- Target 2026-08-09_cf0a3c9bd0c499883d7cc11bfeec1f0c_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260809-ls824syvdz
- SHA256 f1df0d752f360cbeffa30e9294e6d0a90ccaa552a3f0035d563924fe881ff88a
- MD5 cf0a3c9bd0c499883d7cc11bfeec1f0c
- SHA1 92b9ff5c2c71776bf68c58121cde91daa6d8bc9d
- SHA512 781530910f1ae25d4ec067ffcda5074feccda9aa1419afa22ff94097c2a1adda14f548b31a447528db6b8f7f1f8eb6ed948179ecfb212d868e2041dce2082049
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DM6:AIfjoga6u1AVD6
- TLSH T1B965D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-09_cf0a3c9bd0c499883d7cc11bfeec1f0c_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-09_cf0a3c9bd0c499883d7cc11bfeec1f0c_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 f1df0d752f360cbeffa30e9294e6d0a90ccaa552a3f0035d563924fe881ff88a
- MD5 cf0a3c9bd0c499883d7cc11bfeec1f0c
- SHA1 92b9ff5c2c71776bf68c58121cde91daa6d8bc9d
- SHA512 781530910f1ae25d4ec067ffcda5074feccda9aa1419afa22ff94097c2a1adda14f548b31a447528db6b8f7f1f8eb6ed948179ecfb212d868e2041dce2082049
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DM6:AIfjoga6u1AVD6
- TLSH T1B965D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE