General
- Target 2026-10-06_937a7e7a528feb03f1b8d84ef13756d6_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample261007-298exaxtay
- SHA256 e8cc8cfcc292a2c8cce163b3cb3f917d6fa9f570defeafe1a894951c0055870c
- MD5 937a7e7a528feb03f1b8d84ef13756d6
- SHA1 7c85bdabef78f4b6512050e3648e1e37c1e32146
- SHA512 c18ad9b7a59c0d4f3a33254e93443b3aec543d48bdbc105fd5d443c1d953a2496736b7c23d02902142e014e0b779d3be0fdac43ec2802f7b7da43715af74740d
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMT:AIfjoga6u1AVDT
- TLSH T17465D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-06_937a7e7a528feb03f1b8d84ef13756d6_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-10-06_937a7e7a528feb03f1b8d84ef13756d6_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 e8cc8cfcc292a2c8cce163b3cb3f917d6fa9f570defeafe1a894951c0055870c
- MD5 937a7e7a528feb03f1b8d84ef13756d6
- SHA1 7c85bdabef78f4b6512050e3648e1e37c1e32146
- SHA512 c18ad9b7a59c0d4f3a33254e93443b3aec543d48bdbc105fd5d443c1d953a2496736b7c23d02902142e014e0b779d3be0fdac43ec2802f7b7da43715af74740d
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMT:AIfjoga6u1AVDT
- TLSH T17465D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE