General
- Target 2026-08-20_3a2eaa5906e3b98909d59b99695cd130_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260820-1yllbsztgv
- SHA256 fc3bd7ba04539dd10b72f73ddc127552c34fc750c0dff58fe37fcabed8524ff1
- MD5 3a2eaa5906e3b98909d59b99695cd130
- SHA1 72bfa259dc822a826ba659e6b67d93c7936ecba8
- SHA512 ae5b71813104e1e2cb941fb05a1fff9dccfeb25dcc7ef04616c8cfe36e2e21a03c2a0cd08f931539985daa192805ed85f8322da631d083735e464795f6345f7f
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMJ:AIfjoga6u1AVDJ
- TLSH T13965D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-20_3a2eaa5906e3b98909d59b99695cd130_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-20_3a2eaa5906e3b98909d59b99695cd130_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 fc3bd7ba04539dd10b72f73ddc127552c34fc750c0dff58fe37fcabed8524ff1
- MD5 3a2eaa5906e3b98909d59b99695cd130
- SHA1 72bfa259dc822a826ba659e6b67d93c7936ecba8
- SHA512 ae5b71813104e1e2cb941fb05a1fff9dccfeb25dcc7ef04616c8cfe36e2e21a03c2a0cd08f931539985daa192805ed85f8322da631d083735e464795f6345f7f
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMJ:AIfjoga6u1AVDJ
- TLSH T13965D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE