General
- Target 2026-11-03_b7498809c0b73342b1fee426994150d9_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample261104-lyp67ag16t
- SHA256 e106cdcdcef8ac0e8814c485068ce93215b34077a681dbce32386c69674b683d
- MD5 b7498809c0b73342b1fee426994150d9
- SHA1 6ae66bc195588da8d0134fb05a2d6978f086c1b3
- SHA512 7a79df9879e0e3ce10372e51d37c8fd8d034e62e3cfef3168683edc3c418761d69a46ede86bb7a87a8ce6ddd308458ca4ddffe8e8d5a2a83f2ba175cc191c258
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMX:AIfjoga6u1AVDX
- TLSH T16E65D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-03_b7498809c0b73342b1fee426994150d9_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-11-03_b7498809c0b73342b1fee426994150d9_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 e106cdcdcef8ac0e8814c485068ce93215b34077a681dbce32386c69674b683d
- MD5 b7498809c0b73342b1fee426994150d9
- SHA1 6ae66bc195588da8d0134fb05a2d6978f086c1b3
- SHA512 7a79df9879e0e3ce10372e51d37c8fd8d034e62e3cfef3168683edc3c418761d69a46ede86bb7a87a8ce6ddd308458ca4ddffe8e8d5a2a83f2ba175cc191c258
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMX:AIfjoga6u1AVDX
- TLSH T16E65D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE