General
- Target 2026-11-09_24102e6aa37df4ddb2125bd3a1d2ac2a_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- Sample261111-bdgzzaes5w
- SHA256 a625141c0d12268ebbcd5bd34405f1ab31b331b668f0ccd30311a39ff79956e0
- MD5 24102e6aa37df4ddb2125bd3a1d2ac2a
- SHA1 4831dceea5ac9f44905200a2e759a895b1e17521
- SHA512 a69883ed058d084fe132d9124901eb6c3d4a9e58329668b2da7c7f5d5ea21cfd5e3ec4b7db3184810e6e156ec9e2a2cd79212f59bc709f5a6cfef446242c389d
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DM+:AIfjoga6u1AVD+
- TLSH T1C765D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-09_24102e6aa37df4ddb2125bd3a1d2ac2a_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-11-09_24102e6aa37df4ddb2125bd3a1d2ac2a_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 a625141c0d12268ebbcd5bd34405f1ab31b331b668f0ccd30311a39ff79956e0
- MD5 24102e6aa37df4ddb2125bd3a1d2ac2a
- SHA1 4831dceea5ac9f44905200a2e759a895b1e17521
- SHA512 a69883ed058d084fe132d9124901eb6c3d4a9e58329668b2da7c7f5d5ea21cfd5e3ec4b7db3184810e6e156ec9e2a2cd79212f59bc709f5a6cfef446242c389d
- SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DM+:AIfjoga6u1AVD+
- TLSH T1C765D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE