General
- Target 2026-10-13_f32eb26cb55aa19c1f99fe9e308490c6_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- Sample261014-brrfkatw7j
- SHA256 90ee635c3ff343790b44dffedb23f7f2ec1dc34be09747a49ea55f2dc147b19f
- MD5 f32eb26cb55aa19c1f99fe9e308490c6
- SHA1 a8dd900f2a852712ac39f89d5ef09160eabd181b
- SHA512 a99d6916d68e4d4a8222e2dc28c7f619866e7ce8eff6514f43858f12556373d40ba195c92055a7236ffbfdc3dda5e656e6dbc82007c8b4ac4f16425bf2296c7a
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXeX:UIfjoga66AVDKUTbQIzFLwLX
- TLSH T12E850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-13_f32eb26cb55aa19c1f99fe9e308490c6_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-10-13_f32eb26cb55aa19c1f99fe9e308490c6_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- SHA256 90ee635c3ff343790b44dffedb23f7f2ec1dc34be09747a49ea55f2dc147b19f
- MD5 f32eb26cb55aa19c1f99fe9e308490c6
- SHA1 a8dd900f2a852712ac39f89d5ef09160eabd181b
- SHA512 a99d6916d68e4d4a8222e2dc28c7f619866e7ce8eff6514f43858f12556373d40ba195c92055a7236ffbfdc3dda5e656e6dbc82007c8b4ac4f16425bf2296c7a
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXeX:UIfjoga66AVDKUTbQIzFLwLX
- TLSH T12E850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE