2026-03-08_5d1a7931aa7ab61404dc2184c1be2407_amadey_cobalt-strike_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-03-08_5d1a7931aa7ab61404dc2184c1be2407_amadey_cobalt-strike_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop
Size 921KB
Sample260308-mxxejsfx2x
SHA256 be6ed6e9748d7640ddecefc1dad34c75dde4c33680bd7de650aa312bdc3546a1
MD5 5d1a7931aa7ab61404dc2184c1be2407
SHA1 82e783af6ed8b7e92b267f0f7cfe29c73f3a0eb8
SHA512 a58b19c11b54ec92485c4e50bc54863895308eca7858d8e0917bc8303bfcc19572dc19b39798c0329534f6df32b78ee353e79effe132d6482fc2ce43ce19990c
SSDEEP 6144:UCZvfy1NBNXctxp8LruE2izzAicKXL4IFcp89/drLHgDe7eVvaDtYpq6qer5+n7:5fMNnXcX2fxpztL1yA1Ya9er5+n7
TLSH
T1E8150663E7918AE8E65E047A5F548654E22EF2316B0F63617A5C120CCF4378B8F61E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-03-08_5d1a7931aa7ab61404dc2184c1be2407_amadey_cobalt-strike_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-03-08_5d1a7931aa7ab61404dc2184c1be2407_amadey_cobalt-strike_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

.exe 921KB

2026-03-08_5d1a7931aa7ab61404dc2184c1be2407_amadey_cobalt-strike_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 33e2b12a816de1c22216b99486f98fd0
SHA256 be6ed6e9748d7640ddecefc1dad34c75dde4c33680bd7de650aa312bdc3546a1
MD5 5d1a7931aa7ab61404dc2184c1be2407
SHA1 82e783af6ed8b7e92b267f0f7cfe29c73f3a0eb8
SHA512 a58b19c11b54ec92485c4e50bc54863895308eca7858d8e0917bc8303bfcc19572dc19b39798c0329534f6df32b78ee353e79effe132d6482fc2ce43ce19990c
SSDEEP 6144:UCZvfy1NBNXctxp8LruE2izzAicKXL4IFcp89/drLHgDe7eVvaDtYpq6qer5+n7:5fMNnXcX2fxpztL1yA1Ya9er5+n7
TLSH
T1E8150663E7918AE8E65E047A5F548654E22EF2316B0F63617A5C120CCF4378B8F61E3D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21938

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetStdHandle WriteConsoleW WriteConsoleA InitializeCriticalSectionAndSpinCount GetLocaleInfoW CreateFileA GetVersion FreeLibrary LoadLibraryA GetEnvironmentStringsW GetModuleHandleA MultiByteToWideChar GetConsoleOutputCP GetProcAddress InterlockedIncrement InterlockedDecrement WideCharToMultiByte Sleep InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection RtlUnwind RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetLastError HeapFree GetCPInfo LCMapStringA LCMapStringW GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapAlloc ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile SetFilePointer CloseHandle HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW

user32

GetClassInfoA CallWindowProcA SetWindowLongA CheckDlgButton GetActiveWindow LoadCursorA MessageBoxA wsprintfA GetDlgItemTextA

gdi32

GetStockObject DeleteObject SetBkMode SetTextColor CreateFontIndirectA SelectObject GetObjectA

comdlg32

GetSaveFileNameA GetOpenFileNameA

advapi32

RegDeleteKeyA

Name

.text

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.dvPYs

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

102KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

sguLabwX

Size

3KB

Virtual Size

3KB

Characteristics

Name

SFYvHJPl

Size

1KB

Virtual Size

1KB

Characteristics

Name

wsmQeDla

Size

5KB

Virtual Size

4KB

Characteristics

Name

CNBqAUfr

Size

56KB

Virtual Size

56KB

Characteristics

Name

nRjBaPrb

Size

480KB

Virtual Size

480KB

Characteristics

Name

DtLyAmLd

Size

16KB

Virtual Size

16KB

Characteristics

Name

emRxYJCJ

Size

1KB

Virtual Size

1KB

Characteristics

Name

iAEGezEy

Size

53KB

Virtual Size

52KB

Characteristics

Name

THxDPacm

Size

2KB

Virtual Size

1KB

Characteristics

Name

oKFhklOE

Size

50KB

Virtual Size

50KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-03-08_5d1a7931aa7ab61404dc2184c1be2407_amadey_cobalt-strike_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

gdi32

comdlg32

advapi32

generic