General
- Target 2026-08-25_d99d834ee866c7808b367d01cfa99505_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- Sample260826-hfsb2sca73
- SHA256 4214b503286373b3892ca8a9579391c78d21a7cba2ed254a2e96d07156896f3e
- MD5 d99d834ee866c7808b367d01cfa99505
- SHA1 88b4791ade54198efbc8ee98c1c8a7a41b2d249b
- SHA512 29b6834129d586a8722322a00b6a5f185b7d3546719a31e70a2b65650473835f7120ab891aa1db0216c5e895c31cc3cc2b94139d05adf335f8cf0b4e33f05044
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXeh:UIfjoga66AVDKUTbQIzFLwLh
- TLSH T121850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-25_d99d834ee866c7808b367d01cfa99505_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-25_d99d834ee866c7808b367d01cfa99505_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- SHA256 4214b503286373b3892ca8a9579391c78d21a7cba2ed254a2e96d07156896f3e
- MD5 d99d834ee866c7808b367d01cfa99505
- SHA1 88b4791ade54198efbc8ee98c1c8a7a41b2d249b
- SHA512 29b6834129d586a8722322a00b6a5f185b7d3546719a31e70a2b65650473835f7120ab891aa1db0216c5e895c31cc3cc2b94139d05adf335f8cf0b4e33f05044
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXeh:UIfjoga66AVDKUTbQIzFLwLh
- TLSH T121850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE