General
- Target 2026-11-05_3c913d7eaf122c62211f10c64b40534f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample261107-ecc66svygz
- SHA256 53fe26401e8a4e9177b54c5ffe145abaf1276af720ad5ddfcb4f2fbcb7a6599b
- MD5 3c913d7eaf122c62211f10c64b40534f
- SHA1 540ae5b1e473b7aceb890cad3872e6708b9f6969
- SHA512 664eac593952d6a579163e166103ea010600d9d955ccca7baac84d33dd291d3e2b4db24362e6198bacec01000bfb2b3af822c9910709c3c14eb3161c3691a82c
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMN:AIfjoga6u1AVDN
- TLSH T1A465D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-05_3c913d7eaf122c62211f10c64b40534f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-11-05_3c913d7eaf122c62211f10c64b40534f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 53fe26401e8a4e9177b54c5ffe145abaf1276af720ad5ddfcb4f2fbcb7a6599b
- MD5 3c913d7eaf122c62211f10c64b40534f
- SHA1 540ae5b1e473b7aceb890cad3872e6708b9f6969
- SHA512 664eac593952d6a579163e166103ea010600d9d955ccca7baac84d33dd291d3e2b4db24362e6198bacec01000bfb2b3af822c9910709c3c14eb3161c3691a82c
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMN:AIfjoga6u1AVDN
- TLSH T1A465D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE