General
- Target 2026-08-12_5f1c54650df8414c00838cbd33c44403_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260812-2cbpnswcjh
- SHA256 1f12021edae8a8d0f675724a44c7b96e84e92b0dd2bbb96626dc7b7a83087593
- MD5 5f1c54650df8414c00838cbd33c44403
- SHA1 6bcecc3b7202cb40f2dfbbc37d1c18b9fdbfbe10
- SHA512 72baed5c74a3ae729a32c6b0f179d29f635745376f01fa0caf15fdd697024d923e126b6cb9639e75ef997bfeab21fa41ff03ea8c39eb3532043e8ba59cebac07
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DM8:AIfjoga6u1AVD8
- TLSH T1E065D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-12_5f1c54650df8414c00838cbd33c44403_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-12_5f1c54650df8414c00838cbd33c44403_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 1f12021edae8a8d0f675724a44c7b96e84e92b0dd2bbb96626dc7b7a83087593
- MD5 5f1c54650df8414c00838cbd33c44403
- SHA1 6bcecc3b7202cb40f2dfbbc37d1c18b9fdbfbe10
- SHA512 72baed5c74a3ae729a32c6b0f179d29f635745376f01fa0caf15fdd697024d923e126b6cb9639e75ef997bfeab21fa41ff03ea8c39eb3532043e8ba59cebac07
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DM8:AIfjoga6u1AVD8
- TLSH T1E065D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE