General
- Target 2026-08-24_31d361c7a91f27fb81dd17ab0b8fda54_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- Sample260825-te21msvfrh
- SHA256 7e6fc1e5a261b827372f26bf7b16ffb11ad0672bdeb71179144e756d31e707f7
- MD5 31d361c7a91f27fb81dd17ab0b8fda54
- SHA1 2e411ea4f5798ce4ba85ef0eca3f0be51f7964e5
- SHA512 fc98bd9aeb06f1bac32764e8d9108d61eef551cd33cc2ae8b1461ba095a6fc4cfb4d339b3de69b33aac1b54a3c89cbd330429f5438bac60cb8023e46e27b389c
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXe/:UIfjoga66AVDKUTbQIzFLwL/
- TLSH T117850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-24_31d361c7a91f27fb81dd17ab0b8fda54_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-24_31d361c7a91f27fb81dd17ab0b8fda54_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- SHA256 7e6fc1e5a261b827372f26bf7b16ffb11ad0672bdeb71179144e756d31e707f7
- MD5 31d361c7a91f27fb81dd17ab0b8fda54
- SHA1 2e411ea4f5798ce4ba85ef0eca3f0be51f7964e5
- SHA512 fc98bd9aeb06f1bac32764e8d9108d61eef551cd33cc2ae8b1461ba095a6fc4cfb4d339b3de69b33aac1b54a3c89cbd330429f5438bac60cb8023e46e27b389c
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXe/:UIfjoga66AVDKUTbQIzFLwL/
- TLSH T117850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE