General
- Target 2026-08-21_729e19e8ed4b871b8426e7ecf19f7956_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- Sample260821-vg366acd76
- SHA256 6da7c4f30ec38f65f220b6e9bb0ce835e0f91621493701fb2bc2bb5428c1412c
- MD5 729e19e8ed4b871b8426e7ecf19f7956
- SHA1 e672bb71f4345e34b580257b8b7730dcfc6805e7
- SHA512 20cdcb1cf00674b4e01b462cc3f56c4afdf13249b58c51461140e54ca8620db2a743f2b6dc4a1764b981ccca4b86221bf040a02cd6adbc36cde506e9b5d7f13a
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXe5:UIfjoga66AVDKUTbQIzFLwL5
- TLSH T142850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-21_729e19e8ed4b871b8426e7ecf19f7956_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-21_729e19e8ed4b871b8426e7ecf19f7956_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- SHA256 6da7c4f30ec38f65f220b6e9bb0ce835e0f91621493701fb2bc2bb5428c1412c
- MD5 729e19e8ed4b871b8426e7ecf19f7956
- SHA1 e672bb71f4345e34b580257b8b7730dcfc6805e7
- SHA512 20cdcb1cf00674b4e01b462cc3f56c4afdf13249b58c51461140e54ca8620db2a743f2b6dc4a1764b981ccca4b86221bf040a02cd6adbc36cde506e9b5d7f13a
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXe5:UIfjoga66AVDKUTbQIzFLwL5
- TLSH T142850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE