General
- Target 2026-11-05_27ec21f80cec0f17a5dd2f2d738f859f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- Sample261105-dbjf5asw9m
- SHA256 6d16a87a40f862cb46be707d69c160904c3099cdc5eb680c29631aaf6f94370c
- MD5 27ec21f80cec0f17a5dd2f2d738f859f
- SHA1 14341d1a719059efcf327c5ead3aaa63355c09d2
- SHA512 46ff028478e96fb421c87aeaa38c44137040082d78bdf948b8f0c41870f965951a3f02a1f09da45a7831159bb1987aaff246fd2f853ea38da9eab90d3c59d33b
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXe7:UIfjoga66AVDKUTbQIzFLwL7
- TLSH T1D7850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-05_27ec21f80cec0f17a5dd2f2d738f859f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-11-05_27ec21f80cec0f17a5dd2f2d738f859f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- SHA256 6d16a87a40f862cb46be707d69c160904c3099cdc5eb680c29631aaf6f94370c
- MD5 27ec21f80cec0f17a5dd2f2d738f859f
- SHA1 14341d1a719059efcf327c5ead3aaa63355c09d2
- SHA512 46ff028478e96fb421c87aeaa38c44137040082d78bdf948b8f0c41870f965951a3f02a1f09da45a7831159bb1987aaff246fd2f853ea38da9eab90d3c59d33b
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXe7:UIfjoga66AVDKUTbQIzFLwL7
- TLSH T1D7850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE