General
- Target 2026-11-05_ba3177e8a6ba92aae3d15b3465422f00_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- Sample261105-b4rl4afc93
- SHA256 367f97bb53c05f979e88c36d98899e3fd828a41437083364535ea950cfc85130
- MD5 ba3177e8a6ba92aae3d15b3465422f00
- SHA1 bce5baa4974ec6fb091c8f39b80da2e05a64a48e
- SHA512 1c4bc3920e8d5ce1b9525db80612826ef2c3f1b64fd50ce9d40e9ae1c6b6a4ff1d4daab447f7b430552c74925644bef0a4be8bcb46b2b79be99e0f00997402d6
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXeI:UIfjoga66AVDKUTbQIzFLwLI
- TLSH T11E850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-05_ba3177e8a6ba92aae3d15b3465422f00_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-11-05_ba3177e8a6ba92aae3d15b3465422f00_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- SHA256 367f97bb53c05f979e88c36d98899e3fd828a41437083364535ea950cfc85130
- MD5 ba3177e8a6ba92aae3d15b3465422f00
- SHA1 bce5baa4974ec6fb091c8f39b80da2e05a64a48e
- SHA512 1c4bc3920e8d5ce1b9525db80612826ef2c3f1b64fd50ce9d40e9ae1c6b6a4ff1d4daab447f7b430552c74925644bef0a4be8bcb46b2b79be99e0f00997402d6
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXeI:UIfjoga66AVDKUTbQIzFLwLI
- TLSH T11E850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE