General
- Target 2026-10-15_3d2f62408ec7f6c46bb6134db54501d3_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- Sample261016-w59vaabb72
- SHA256 16ad14082bac3d4743d8ae22773e30118cb05fdc6d080615c79ffd1e387ee52c
- MD5 3d2f62408ec7f6c46bb6134db54501d3
- SHA1 6baf5647d8790ab70b337386c05cce9743ff3ae5
- SHA512 90ed7d414dfaed192deefe210a03835381989efd42a996907b211e1f568513277d05b3dc58221d1511148c453ab902369dd8c7917ab37bad1ca14e6abd2fbdb7
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXen:UIfjoga66AVDKUTbQIzFLwLn
- TLSH T18B850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-15_3d2f62408ec7f6c46bb6134db54501d3_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-10-15_3d2f62408ec7f6c46bb6134db54501d3_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- SHA256 16ad14082bac3d4743d8ae22773e30118cb05fdc6d080615c79ffd1e387ee52c
- MD5 3d2f62408ec7f6c46bb6134db54501d3
- SHA1 6baf5647d8790ab70b337386c05cce9743ff3ae5
- SHA512 90ed7d414dfaed192deefe210a03835381989efd42a996907b211e1f568513277d05b3dc58221d1511148c453ab902369dd8c7917ab37bad1ca14e6abd2fbdb7
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXen:UIfjoga66AVDKUTbQIzFLwLn
- TLSH T18B850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE