General
- Target 2026-11-05_1982b0b28e7a581c3ff4aec05c525be6_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- Sample261105-dfxjjsft5y
- SHA256 b0286be50ef35080ca3fdeb334d8329bbd97d63ee27aabbb3b81ee24117f9570
- MD5 1982b0b28e7a581c3ff4aec05c525be6
- SHA1 5fb7d3dd992c874b40e0a350d4cb41229bff13a5
- SHA512 104ca7aaadf69a6bbf4ab2d1257289151f1986a84dd302dca6ea04858ab8679ecacb8f085efbe2546d44b09c0610b8754106136701240d96f0ec6725dec3d568
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXe/:UIfjoga66AVDKUTbQIzFLwL/
- TLSH T10A850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-05_1982b0b28e7a581c3ff4aec05c525be6_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-11-05_1982b0b28e7a581c3ff4aec05c525be6_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- SHA256 b0286be50ef35080ca3fdeb334d8329bbd97d63ee27aabbb3b81ee24117f9570
- MD5 1982b0b28e7a581c3ff4aec05c525be6
- SHA1 5fb7d3dd992c874b40e0a350d4cb41229bff13a5
- SHA512 104ca7aaadf69a6bbf4ab2d1257289151f1986a84dd302dca6ea04858ab8679ecacb8f085efbe2546d44b09c0610b8754106136701240d96f0ec6725dec3d568
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXe/:UIfjoga66AVDKUTbQIzFLwL/
- TLSH T10A850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE