General
- Target 2026-08-19_d25a5a6c32d0136cd7538f70f05bb01e_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260819-ewav6ach76
- SHA256 c7baea9cb0d311bc6d5e0ed70e9e777d181ed580f8d35d7afc59b41dcc8e42ca
- MD5 d25a5a6c32d0136cd7538f70f05bb01e
- SHA1 f5e139ec7f06c62150122048d27364e200a47bb4
- SHA512 5a6bd928143486d5173dd04ff2a0b2d23c47436aa7de3914a8eff84dce6f18b0e6ae8039484022ee30f983cb2299adb55143035fbea0008db1562616cc309c09
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMj:AIfjoga6u1AVDj
- TLSH T1B265D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-19_d25a5a6c32d0136cd7538f70f05bb01e_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-19_d25a5a6c32d0136cd7538f70f05bb01e_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 c7baea9cb0d311bc6d5e0ed70e9e777d181ed580f8d35d7afc59b41dcc8e42ca
- MD5 d25a5a6c32d0136cd7538f70f05bb01e
- SHA1 f5e139ec7f06c62150122048d27364e200a47bb4
- SHA512 5a6bd928143486d5173dd04ff2a0b2d23c47436aa7de3914a8eff84dce6f18b0e6ae8039484022ee30f983cb2299adb55143035fbea0008db1562616cc309c09
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMj:AIfjoga6u1AVDj
- TLSH T1B265D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE