General
- Target 2026-08-24_ce64b8ba354d71b6d0cc1a33d65bc701_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- Sample260825-a37fgs1vhs
- SHA256 350b6bb1b62d3b3bd92c8bb29f93c332ba1da8555e00ba18ed6ee065819ab624
- MD5 ce64b8ba354d71b6d0cc1a33d65bc701
- SHA1 17eb9518470b94fe5e4f0cec0d911578ca448746
- SHA512 05a5a2250fc7fa53ded9c0eeec6fcf3832e73799b45183e6a3bd1358f99bbb020a5daf9af0b7f90a52fde7ab796c63b74ef2e33742bb17c8b527da299d0009d9
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXe7:UIfjoga66AVDKUTbQIzFLwL7
- TLSH T15A850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-24_ce64b8ba354d71b6d0cc1a33d65bc701_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-24_ce64b8ba354d71b6d0cc1a33d65bc701_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- SHA256 350b6bb1b62d3b3bd92c8bb29f93c332ba1da8555e00ba18ed6ee065819ab624
- MD5 ce64b8ba354d71b6d0cc1a33d65bc701
- SHA1 17eb9518470b94fe5e4f0cec0d911578ca448746
- SHA512 05a5a2250fc7fa53ded9c0eeec6fcf3832e73799b45183e6a3bd1358f99bbb020a5daf9af0b7f90a52fde7ab796c63b74ef2e33742bb17c8b527da299d0009d9
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXe7:UIfjoga66AVDKUTbQIzFLwL7
- TLSH T15A850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE