General
- Target 2026-08-31_1e9c3fb99b6eb9178b50a46d0fb9b791_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop
- Size 1.7MB
- Sample260831-2dspksfl31
- SHA256 25638836337c1e17f4b0c099d0fd983d4899b0a49d0ee00dd6df53c6747081ee
- MD5 1e9c3fb99b6eb9178b50a46d0fb9b791
- SHA1 d6ea4e4bf9d468e0955d4a2e408ec5bbfc637d98
- SHA512 fd4583b9e7bddf6d6abe5a9282ac46e1d17e54a5740b0e0c93362d1921c959904ffecf5fc12e0cce389318683594ebabbbb6e1546067bfece35c0f4e030d6a86
- SSDEEP 12288:L7dL4AZ0U9gY2F/eyL1Jer5+ngA1YaL8i0DMUNLtG4+tbQIzKYZLwTmer5+nIUew:L7dLBeU9g16AVDKUTbQIzFLwr+
- TLSH T1BA850753EB814AE8E75D09365B544150D62EFE21AA4F2350786C720CCFA738B8F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-31_1e9c3fb99b6eb9178b50a46d0fb9b791_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-31_1e9c3fb99b6eb9178b50a46d0fb9b791_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop
- Size 1.7MB
- SHA256 25638836337c1e17f4b0c099d0fd983d4899b0a49d0ee00dd6df53c6747081ee
- MD5 1e9c3fb99b6eb9178b50a46d0fb9b791
- SHA1 d6ea4e4bf9d468e0955d4a2e408ec5bbfc637d98
- SHA512 fd4583b9e7bddf6d6abe5a9282ac46e1d17e54a5740b0e0c93362d1921c959904ffecf5fc12e0cce389318683594ebabbbb6e1546067bfece35c0f4e030d6a86
- SSDEEP 12288:L7dL4AZ0U9gY2F/eyL1Jer5+ngA1YaL8i0DMUNLtG4+tbQIzKYZLwTmer5+nIUew:L7dLBeU9g16AVDKUTbQIzFLwr+
- TLSH T1BA850753EB814AE8E75D09365B544150D62EFE21AA4F2350786C720CCFA738B8F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE