General
- Target 2026-08-09_1da33f4b8dfbf195aba5e66cf66e0b7c_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop
- Size 1.7MB
- Sample260809-md8cpswcjf
- SHA256 52df5147a0c91043893581f34ae2cc9ac80f352f975c6fb363e14bb2046e61fc
- MD5 1da33f4b8dfbf195aba5e66cf66e0b7c
- SHA1 87143107ad0d6686ca9ebdad69ae26deab7be318
- SHA512 9a6496cc89ae9cb10793bb013473a23a048990524e538a54ba916586046c7edc5880d890b8f3c883bcfc2a728cb8db4dcc6f10505491d0c0eff52df764fbce2b
- SSDEEP 12288:L7dL4AZ0U9gY2F/eyL1Jer5+ngA1YaL8i0DMUNLtG4+tbQIzKYZLwTmer5+nIUe8:L7dLBeU9g16AVDKUTbQIzFLwre
- TLSH T1B3850753EB814AE8E75D09365B544150D62EFE21AA4F2350786C720CCFA738B8F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-09_1da33f4b8dfbf195aba5e66cf66e0b7c_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-09_1da33f4b8dfbf195aba5e66cf66e0b7c_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop
- Size 1.7MB
- SHA256 52df5147a0c91043893581f34ae2cc9ac80f352f975c6fb363e14bb2046e61fc
- MD5 1da33f4b8dfbf195aba5e66cf66e0b7c
- SHA1 87143107ad0d6686ca9ebdad69ae26deab7be318
- SHA512 9a6496cc89ae9cb10793bb013473a23a048990524e538a54ba916586046c7edc5880d890b8f3c883bcfc2a728cb8db4dcc6f10505491d0c0eff52df764fbce2b
- SSDEEP 12288:L7dL4AZ0U9gY2F/eyL1Jer5+ngA1YaL8i0DMUNLtG4+tbQIzKYZLwTmer5+nIUe8:L7dLBeU9g16AVDKUTbQIzFLwre
- TLSH T1B3850753EB814AE8E75D09365B544150D62EFE21AA4F2350786C720CCFA738B8F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE