General
- Target 2026-07-17_fb584d5e5574e4a7ba06daf02affbc54_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop
- Size 1.7MB
- Sample260717-y6kynac13p
- SHA256 7fdc015e655e00ae29f4ba23069f2d85ac5b46d02b447f58896c27e26d9d0cd5
- MD5 fb584d5e5574e4a7ba06daf02affbc54
- SHA1 ec2a3fa4f3f8aed045cb37597886eac47fc533e1
- SHA512 f37238ba79b707174e356ff5b0d6c1ea9c107b162298c4e191a44708d8a9975257cbe7a881dae7af8f568df71dac989e7024bac56c08bad091dc60b9d4686d02
- SSDEEP 12288:L7dL4AZ0U9gY2F/eyL1Jer5+ngA1YaL8i0DMUNLtG4+tbQIzKYZLwTmer5+nIUel:L7dLBeU9g16AVDKUTbQIzFLwrT
- TLSH T118850653EB814AE8E75D09365B544150D62EFE21AA4F2350786C720CCFA738B8F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-17_fb584d5e5574e4a7ba06daf02affbc54_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-07-17_fb584d5e5574e4a7ba06daf02affbc54_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop
- Size 1.7MB
- SHA256 7fdc015e655e00ae29f4ba23069f2d85ac5b46d02b447f58896c27e26d9d0cd5
- MD5 fb584d5e5574e4a7ba06daf02affbc54
- SHA1 ec2a3fa4f3f8aed045cb37597886eac47fc533e1
- SHA512 f37238ba79b707174e356ff5b0d6c1ea9c107b162298c4e191a44708d8a9975257cbe7a881dae7af8f568df71dac989e7024bac56c08bad091dc60b9d4686d02
- SSDEEP 12288:L7dL4AZ0U9gY2F/eyL1Jer5+ngA1YaL8i0DMUNLtG4+tbQIzKYZLwTmer5+nIUel:L7dLBeU9g16AVDKUTbQIzFLwrT
- TLSH T118850653EB814AE8E75D09365B544150D62EFE21AA4F2350786C720CCFA738B8F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE