General
- Target 2026-10-13_bd384abcfa300181327be1b1863dd607_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- Sample261014-hzk23shv21
- SHA256 c6950c5c4e2c10c9fd80a8f52a688964adf572fa46bc85a691e604bc8588d2f9
- MD5 bd384abcfa300181327be1b1863dd607
- SHA1 f3a81e48fae99d003fb4a9f3de560c5d03f4f4a7
- SHA512 be0fea4d3d7b848304255c95cf3bcb5bc22fe3c42e0a1622a874db4c2f576e62ff40d53243288e7d5710e8bbed53e0e75c59d930b17441dcf9b2cc6a8843988c
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXeV:UIfjoga66AVDKUTbQIzFLwLV
- TLSH T148850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-13_bd384abcfa300181327be1b1863dd607_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-10-13_bd384abcfa300181327be1b1863dd607_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- SHA256 c6950c5c4e2c10c9fd80a8f52a688964adf572fa46bc85a691e604bc8588d2f9
- MD5 bd384abcfa300181327be1b1863dd607
- SHA1 f3a81e48fae99d003fb4a9f3de560c5d03f4f4a7
- SHA512 be0fea4d3d7b848304255c95cf3bcb5bc22fe3c42e0a1622a874db4c2f576e62ff40d53243288e7d5710e8bbed53e0e75c59d930b17441dcf9b2cc6a8843988c
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXeV:UIfjoga66AVDKUTbQIzFLwLV
- TLSH T148850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE