General
- Target 2026-07-09_4c4c53d0130b4fe4d0abe7f4cdb8394b_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop
- Size 1.7MB
- Sample260709-x7jasagx2q
- SHA256 d287870a2f53316c2130b898068edc5a21e1a580d87b27ee0e8841e820378b67
- MD5 4c4c53d0130b4fe4d0abe7f4cdb8394b
- SHA1 d274744bb39efa3fdc1cb3c02895bce7d342d18a
- SHA512 b14115a49a678f8506e922c3b3e889877d01cc326ad8e2e31d0a47504ee56fe00b9188a6ea799cdf0618a96cfbd44803dcb7aa6cdddd16585f1e71228d79b766
- SSDEEP 12288:L7dL4AZ0U9gY2F/eyL1Jer5+ngA1YaL8i0DMUNLtG4+tbQIzKYZLwTmer5+nIUeI:L7dLBeU9g16AVDKUTbQIzFLwra
- TLSH T135850753EB814AE8E75D09365B544150D62EFE21AA4F2350786C720CCFA738B8F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-09_4c4c53d0130b4fe4d0abe7f4cdb8394b_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-07-09_4c4c53d0130b4fe4d0abe7f4cdb8394b_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop
- Size 1.7MB
- SHA256 d287870a2f53316c2130b898068edc5a21e1a580d87b27ee0e8841e820378b67
- MD5 4c4c53d0130b4fe4d0abe7f4cdb8394b
- SHA1 d274744bb39efa3fdc1cb3c02895bce7d342d18a
- SHA512 b14115a49a678f8506e922c3b3e889877d01cc326ad8e2e31d0a47504ee56fe00b9188a6ea799cdf0618a96cfbd44803dcb7aa6cdddd16585f1e71228d79b766
- SSDEEP 12288:L7dL4AZ0U9gY2F/eyL1Jer5+ngA1YaL8i0DMUNLtG4+tbQIzKYZLwTmer5+nIUeI:L7dLBeU9g16AVDKUTbQIzFLwra
- TLSH T135850753EB814AE8E75D09365B544150D62EFE21AA4F2350786C720CCFA738B8F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE