General
- Target 2026-08-20_3c5bf058099762aefb518bf17c33ea96_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop
- Size 1.7MB
- Sample260820-gre1esttds
- SHA256 7d527b8c12e2c5bd9e40c510fa102d8a5eedf24a3914ec8c9d1bb1f544f22967
- MD5 3c5bf058099762aefb518bf17c33ea96
- SHA1 d38f7906244d43ec6587d49bdc0709923641ed86
- SHA512 b527634bea3e02f20efc3697e0c90b497b4390ade039f2b87036a5971b7a3a9c039d27762c142ac7677f247e331165da3d72619b924a96c1ffd5840d6e7ec9a1
- SSDEEP 12288:L7dL4AZ0U9gY2F/eyL1Jer5+ngA1YaL8i0DMUNLtG4+tbQIzKYZLwTmer5+nIUex:L7dLBeU9g16AVDKUTbQIzFLwrD
- TLSH T1D0850753EB814AE8E75D09365B544150D62EFE21AA4F2350786C720CCFA738B8F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-20_3c5bf058099762aefb518bf17c33ea96_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-20_3c5bf058099762aefb518bf17c33ea96_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop
- Size 1.7MB
- SHA256 7d527b8c12e2c5bd9e40c510fa102d8a5eedf24a3914ec8c9d1bb1f544f22967
- MD5 3c5bf058099762aefb518bf17c33ea96
- SHA1 d38f7906244d43ec6587d49bdc0709923641ed86
- SHA512 b527634bea3e02f20efc3697e0c90b497b4390ade039f2b87036a5971b7a3a9c039d27762c142ac7677f247e331165da3d72619b924a96c1ffd5840d6e7ec9a1
- SSDEEP 12288:L7dL4AZ0U9gY2F/eyL1Jer5+ngA1YaL8i0DMUNLtG4+tbQIzKYZLwTmer5+nIUex:L7dLBeU9g16AVDKUTbQIzFLwrD
- TLSH T1D0850753EB814AE8E75D09365B544150D62EFE21AA4F2350786C720CCFA738B8F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE