General
- Target 2026-10-27_d7e08fd7be50f3678e98c0cdce121b31_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- Sample261028-x9arestxfx
- SHA256 64967c984f6865c2bb54352fffd753346290ce89ab8b7575da23fa3c59059c6d
- MD5 d7e08fd7be50f3678e98c0cdce121b31
- SHA1 6b28373bc4d7f05b92de8d5eb2bde2b10badcff7
- SHA512 6d9610d246922efc84e36db0bc95d2cc571a576fdbf734408c4c15312e5bb9a725c09c189b6936624d094bf8474fe8d41b46944cf12ea23238ebda9e0b4ce2bf
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXee:UIfjoga66AVDKUTbQIzFLwLe
- TLSH T149850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-27_d7e08fd7be50f3678e98c0cdce121b31_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-10-27_d7e08fd7be50f3678e98c0cdce121b31_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- SHA256 64967c984f6865c2bb54352fffd753346290ce89ab8b7575da23fa3c59059c6d
- MD5 d7e08fd7be50f3678e98c0cdce121b31
- SHA1 6b28373bc4d7f05b92de8d5eb2bde2b10badcff7
- SHA512 6d9610d246922efc84e36db0bc95d2cc571a576fdbf734408c4c15312e5bb9a725c09c189b6936624d094bf8474fe8d41b46944cf12ea23238ebda9e0b4ce2bf
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXee:UIfjoga66AVDKUTbQIzFLwLe
- TLSH T149850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE