General
- Target 2026-08-19_f3ce0ced2bc71e0aa5eab146372c224c_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260819-vc8abaycmd
- SHA256 4234a61db85147610baae56549001ed6bd789d2da3f880b1ae76c2c0bab79e09
- MD5 f3ce0ced2bc71e0aa5eab146372c224c
- SHA1 4c45e8b932244a4815a3ec24a7f6ba8ca03fb82a
- SHA512 50224243e044a32953e547945624d4f1fc6024f9b2bc23dedfeaaddb585a2d02b42f93836a8df4d8d83dfdd902ac72eb0af41db9dfdcb4e123d3550ac13287af
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMM:AIfjoga6u1AVDM
- TLSH T16865D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-19_f3ce0ced2bc71e0aa5eab146372c224c_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-19_f3ce0ced2bc71e0aa5eab146372c224c_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 4234a61db85147610baae56549001ed6bd789d2da3f880b1ae76c2c0bab79e09
- MD5 f3ce0ced2bc71e0aa5eab146372c224c
- SHA1 4c45e8b932244a4815a3ec24a7f6ba8ca03fb82a
- SHA512 50224243e044a32953e547945624d4f1fc6024f9b2bc23dedfeaaddb585a2d02b42f93836a8df4d8d83dfdd902ac72eb0af41db9dfdcb4e123d3550ac13287af
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMM:AIfjoga6u1AVDM
- TLSH T16865D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE