General
- Target 2026-08-12_64a7e7706b4165c39e77c094f3ab3069_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260812-2bdsmstyg1
- SHA256 a787ae361da5bdf212f265cd4b35e4535a09883af02c5950453ee0746b5bb67a
- MD5 64a7e7706b4165c39e77c094f3ab3069
- SHA1 639705e22e4ae1261d0f91f2ced8ab67699cb363
- SHA512 827bae8366169cc068c55c343499980954a9393012f4b693a14055dcaef2a617a00ca06bf97d34bf740d22604e52d29e8d7d80798d72c751e4e61b52d6d7b97b
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMU:AIfjoga6u1AVDU
- TLSH T1E265D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-12_64a7e7706b4165c39e77c094f3ab3069_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-12_64a7e7706b4165c39e77c094f3ab3069_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 a787ae361da5bdf212f265cd4b35e4535a09883af02c5950453ee0746b5bb67a
- MD5 64a7e7706b4165c39e77c094f3ab3069
- SHA1 639705e22e4ae1261d0f91f2ced8ab67699cb363
- SHA512 827bae8366169cc068c55c343499980954a9393012f4b693a14055dcaef2a617a00ca06bf97d34bf740d22604e52d29e8d7d80798d72c751e4e61b52d6d7b97b
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMU:AIfjoga6u1AVDU
- TLSH T1E265D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE