Extracted

• • Target
    2026-04-01_c22268e176a28a687f0504748d9ed88c_amadey_elex_glassworm_smoke-loader_stop
  • Size 6.2MB
  • SHA256 63b215f13b97f747b5ebc47852f352cf1af9f824f7d1659e16446711e40b8a66
  • MD5 c22268e176a28a687f0504748d9ed88c
  • SHA1 629817fb60eb43fd63e07b45e9d9dc12088f21b7
  • SHA512 6d0c801cd1c5c2553ac109dbff1e1a639dcd64ea903c80fb91f9f611800b76f42fbdf21491d8c3a361312211be04c158826d5b98aa7853a054e1650bed0cb533
  • SSDEEP 98304:/Kze3ns8CnfnLrHp/qKm2/Sb/gqAZj+UzKb3HtFq:/UnjrRb/G8+Hq
  • TLSH
    T16D566A03EBC10DD5F7891136DE048610D729F96997FB03B13058215AEF9B386BF69A2B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderlgoogloaderrhadamanthysstealer

  • Detect rhadamanthys stealer shellcode

  • Detects LgoogLoader payload

  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

    downloaderlgoogloader

  • Lgoogloader family

    lgoogloader

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Detects Windows executables referencing non-Windows User-Agents

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2