General
- Target 2026-08-30_ed9069c098fb9310245b29e3420fc590_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop
- Size 1.7MB
- Sample260831-bv61esec52
- SHA256 6ce101a17fd851cf122eb591c2ccf6d0e7bf006ca19a9f2a59fe17c59a7498af
- MD5 ed9069c098fb9310245b29e3420fc590
- SHA1 c5912fc84337a64b81d62470eadd0a858046eca3
- SHA512 eec604110e9c2f9368e6d17c73246f199db0175ff22e2df56f0aa86c07cd0df401a2cf619d2be806b0ffcc070f72679b6b4b4dfa36af7d0eac01220ac7cc8843
- SSDEEP 12288:L7dL4AZ0U9gY2F/eyL1Jer5+ngA1YaL8i0DMUNLtG4+tbQIzKYZLwTmer5+nIUeU:L7dLBeU9g16AVDKUTbQIzFLwrG
- TLSH T152850753EB814AE8E75D09365B544150D62EFE21AA4F2350786C720CCFA738B8F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-30_ed9069c098fb9310245b29e3420fc590_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-30_ed9069c098fb9310245b29e3420fc590_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop
- Size 1.7MB
- SHA256 6ce101a17fd851cf122eb591c2ccf6d0e7bf006ca19a9f2a59fe17c59a7498af
- MD5 ed9069c098fb9310245b29e3420fc590
- SHA1 c5912fc84337a64b81d62470eadd0a858046eca3
- SHA512 eec604110e9c2f9368e6d17c73246f199db0175ff22e2df56f0aa86c07cd0df401a2cf619d2be806b0ffcc070f72679b6b4b4dfa36af7d0eac01220ac7cc8843
- SSDEEP 12288:L7dL4AZ0U9gY2F/eyL1Jer5+ngA1YaL8i0DMUNLtG4+tbQIzKYZLwTmer5+nIUeU:L7dLBeU9g16AVDKUTbQIzFLwrG
- TLSH T152850753EB814AE8E75D09365B544150D62EFE21AA4F2350786C720CCFA738B8F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE