General
- Target 2026-11-05_dda857453aecbe8bc8894c4aaeace4ca_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample261105-byardsst4p
- SHA256 9af1cbb837a9d8b315053303c83690f20774e13f4fcc78830664beeb79e1b465
- MD5 dda857453aecbe8bc8894c4aaeace4ca
- SHA1 d630c6992088b47aa22dd2118d5a428549cedb99
- SHA512 7384a42a57ad4dd43bcd567ca33346dcb8f7a0596533d2d0bdeeabde382ec7b499865b9c2056601c8a6dd3bdcdcd18828e54cd4b3e64adc5a99365146aee74a5
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMf:AIfjoga6u1AVDf
- TLSH T12265D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-05_dda857453aecbe8bc8894c4aaeace4ca_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-11-05_dda857453aecbe8bc8894c4aaeace4ca_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 9af1cbb837a9d8b315053303c83690f20774e13f4fcc78830664beeb79e1b465
- MD5 dda857453aecbe8bc8894c4aaeace4ca
- SHA1 d630c6992088b47aa22dd2118d5a428549cedb99
- SHA512 7384a42a57ad4dd43bcd567ca33346dcb8f7a0596533d2d0bdeeabde382ec7b499865b9c2056601c8a6dd3bdcdcd18828e54cd4b3e64adc5a99365146aee74a5
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMf:AIfjoga6u1AVDf
- TLSH T12265D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE