General
- Target 2026-11-10_e15da176c2867c7c626138822077a3d6_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop
- Size 1.7MB
- Sample261111-v1798aas6k
- SHA256 a117015ecf411eee183c12336318c55b99336f3d1a36bcfe3bfb035508604e25
- MD5 e15da176c2867c7c626138822077a3d6
- SHA1 6db5e7ae661d7c6c56ea7db06b449762f403926a
- SHA512 01ceb6053dd9e95c1648583644cd9d8712d95802dde024f102ff66b81fcdee8e6c55b2397cc92b8d060afab18c48e91b1b51073d1b819f93feb8e9de5a07c092
- SSDEEP 12288:L7dL4AZ0U9gY2F/eyL1Jer5+ngA1YaL8i0DMUNLtG4+tbQIzKYZLwTmer5+nIUep:L7dLBeU9g16AVDKUTbQIzFLwrT
- TLSH T1D4850753EB814AE8E75D09365B544150D62EFE21AA4F2350786C720CCFA738B8F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-10_e15da176c2867c7c626138822077a3d6_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-11-10_e15da176c2867c7c626138822077a3d6_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop
- Size 1.7MB
- SHA256 a117015ecf411eee183c12336318c55b99336f3d1a36bcfe3bfb035508604e25
- MD5 e15da176c2867c7c626138822077a3d6
- SHA1 6db5e7ae661d7c6c56ea7db06b449762f403926a
- SHA512 01ceb6053dd9e95c1648583644cd9d8712d95802dde024f102ff66b81fcdee8e6c55b2397cc92b8d060afab18c48e91b1b51073d1b819f93feb8e9de5a07c092
- SSDEEP 12288:L7dL4AZ0U9gY2F/eyL1Jer5+ngA1YaL8i0DMUNLtG4+tbQIzKYZLwTmer5+nIUep:L7dLBeU9g16AVDKUTbQIzFLwrT
- TLSH T1D4850753EB814AE8E75D09365B544150D62EFE21AA4F2350786C720CCFA738B8F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE