General
- Target 2026-10-28_f1ba2ca4b1a19138d1de2e17418867f6_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample261029-c1nayawtev
- SHA256 a82adcaf5c6dbf1245fe39e8f6640c0f7c51f30434d011b1d917092a0193431e
- MD5 f1ba2ca4b1a19138d1de2e17418867f6
- SHA1 eaaebe5defb7dd9175fea8459e2d46a6f93ad319
- SHA512 73862dd5d09fc8eb0aee2b651275a04f63623d7e1b78cd33d0ae07f7f8fda9949fbeeff7b75c465cc547dda94da94dc9036cb6ad801635087d174c2d23f4befb
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMK:AIfjoga6u1AVDK
- TLSH T12265D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-28_f1ba2ca4b1a19138d1de2e17418867f6_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-10-28_f1ba2ca4b1a19138d1de2e17418867f6_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 a82adcaf5c6dbf1245fe39e8f6640c0f7c51f30434d011b1d917092a0193431e
- MD5 f1ba2ca4b1a19138d1de2e17418867f6
- SHA1 eaaebe5defb7dd9175fea8459e2d46a6f93ad319
- SHA512 73862dd5d09fc8eb0aee2b651275a04f63623d7e1b78cd33d0ae07f7f8fda9949fbeeff7b75c465cc547dda94da94dc9036cb6ad801635087d174c2d23f4befb
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMK:AIfjoga6u1AVDK
- TLSH T12265D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE