General
- Target 2026-08-20_fde9b45e6b86df57f63081d64e060f36_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample260820-ztp8aavere
- SHA256 9e8a20f732d78cfc52f8da73b9ff864202abae226a9b24cdfc356862715b6acb
- MD5 fde9b45e6b86df57f63081d64e060f36
- SHA1 c5c787d759f567bfe2fd5a04e48a210d9c242ee8
- SHA512 039a9be3a87b9f7d7725ed61be09a63e0635bca040acbad658f14d47d293c6a9715b7f01f53c9ee86011e0660f8b1fc128c68a845cf6a7084a07a9000ea3ef5a
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMb:AIfjoga6u1AVDb
- TLSH T10365D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-20_fde9b45e6b86df57f63081d64e060f36_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-20_fde9b45e6b86df57f63081d64e060f36_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 9e8a20f732d78cfc52f8da73b9ff864202abae226a9b24cdfc356862715b6acb
- MD5 fde9b45e6b86df57f63081d64e060f36
- SHA1 c5c787d759f567bfe2fd5a04e48a210d9c242ee8
- SHA512 039a9be3a87b9f7d7725ed61be09a63e0635bca040acbad658f14d47d293c6a9715b7f01f53c9ee86011e0660f8b1fc128c68a845cf6a7084a07a9000ea3ef5a
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMb:AIfjoga6u1AVDb
- TLSH T10365D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE