General
- Target 2026-10-10_b6aab0792e54b65a4d29ebe2653e41d3_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample261011-e9b1dax16j
- SHA256 a01d2f33442e7c1099a92c396a990bf801f417106df38b82a19fa578f2a3f9ab
- MD5 b6aab0792e54b65a4d29ebe2653e41d3
- SHA1 ef580e3a13627b77e0323c9b1af27627731a7196
- SHA512 16fa8082cb023e048b723cc4dd0459e287b42c00d879b8f31408da6c808279b26a49d326abcd9952e461c20fda6df20ac144cf98d2d28dce1a2b051a22ee9444
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMP:AIfjoga6u1AVDP
- TLSH T17765D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-10_b6aab0792e54b65a4d29ebe2653e41d3_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-10-10_b6aab0792e54b65a4d29ebe2653e41d3_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 a01d2f33442e7c1099a92c396a990bf801f417106df38b82a19fa578f2a3f9ab
- MD5 b6aab0792e54b65a4d29ebe2653e41d3
- SHA1 ef580e3a13627b77e0323c9b1af27627731a7196
- SHA512 16fa8082cb023e048b723cc4dd0459e287b42c00d879b8f31408da6c808279b26a49d326abcd9952e461c20fda6df20ac144cf98d2d28dce1a2b051a22ee9444
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMP:AIfjoga6u1AVDP
- TLSH T17765D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE