General
- Target 2026-08-04_8fb3db0b429f3e37383122ed63d79c13_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop
- Size 1.7MB
- Sample260804-sdnaesshrg
- SHA256 23b1f5ca6d880b48367c3a8526df952717fd72c082644eda18b88d432dab56d1
- MD5 8fb3db0b429f3e37383122ed63d79c13
- SHA1 4bb176ba8ef3cc20395e0c0048bf994119c110df
- SHA512 4771e605eebfcdbcbf5882767908eb1afb5c11a570ce3a1bb88d476ba4a880e8a0fc25d7874d112579592620fb6ab883432a0d8da821316373066941522cde95
- SSDEEP 12288:L7dL4AZ0U9gY2F/eyL1Jer5+ngA1YaL8i0DMUNLtG4+tbQIzKYZLwTmer5+nIUeq:L7dLBeU9g16AVDKUTbQIzFLwrQ
- TLSH T12D850653EB814AE8E75D09365B544150D62EFE21AA4F2350786C720CCFA738B8F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-04_8fb3db0b429f3e37383122ed63d79c13_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-04_8fb3db0b429f3e37383122ed63d79c13_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop
- Size 1.7MB
- SHA256 23b1f5ca6d880b48367c3a8526df952717fd72c082644eda18b88d432dab56d1
- MD5 8fb3db0b429f3e37383122ed63d79c13
- SHA1 4bb176ba8ef3cc20395e0c0048bf994119c110df
- SHA512 4771e605eebfcdbcbf5882767908eb1afb5c11a570ce3a1bb88d476ba4a880e8a0fc25d7874d112579592620fb6ab883432a0d8da821316373066941522cde95
- SSDEEP 12288:L7dL4AZ0U9gY2F/eyL1Jer5+ngA1YaL8i0DMUNLtG4+tbQIzKYZLwTmer5+nIUeq:L7dLBeU9g16AVDKUTbQIzFLwrQ
- TLSH T12D850653EB814AE8E75D09365B544150D62EFE21AA4F2350786C720CCFA738B8F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE