General
- Target 2026-10-31_869a2be7d2f7d625c696f6ddcd21ae67_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- Sample261101-3bbhysdy2v
- SHA256 c1a253f72881a295827f0adcdbbb065f2d606fcd95c264f36c96dba6ab7f00a0
- MD5 869a2be7d2f7d625c696f6ddcd21ae67
- SHA1 c06dbe1e19d4d7030a99d4268afe9c5f9bc14885
- SHA512 813452cc4b2d49bcf117c079990033beac44f654589eec663d7162adb14b94af8d2ef296b24240bd84329d54db4e7698cd1922a21f0ac492a10e2d33ddecad93
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXek:UIfjoga66AVDKUTbQIzFLwLk
- TLSH T187850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-31_869a2be7d2f7d625c696f6ddcd21ae67_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-10-31_869a2be7d2f7d625c696f6ddcd21ae67_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- SHA256 c1a253f72881a295827f0adcdbbb065f2d606fcd95c264f36c96dba6ab7f00a0
- MD5 869a2be7d2f7d625c696f6ddcd21ae67
- SHA1 c06dbe1e19d4d7030a99d4268afe9c5f9bc14885
- SHA512 813452cc4b2d49bcf117c079990033beac44f654589eec663d7162adb14b94af8d2ef296b24240bd84329d54db4e7698cd1922a21f0ac492a10e2d33ddecad93
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXek:UIfjoga66AVDKUTbQIzFLwLk
- TLSH T187850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE