2026-04-02_16d535f46957c4ab3afe27fb32ed38f9_amadey_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-02_16d535f46957c4ab3afe27fb32ed38f9_amadey_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop
Size 2.7MB
Sample260402-zaemfae121
SHA256 f6c79145e91d6050adba1ee95c2bebc96814cc0f46732565704943b32f9b3860
MD5 16d535f46957c4ab3afe27fb32ed38f9
SHA1 5b89fbd3b309377b51ec089a33c4148f43a5cc39
SHA512 7e0f728d775c561395e5bbc954f408c3d5caccb222b3f38167940fafdbda8efb0c38fa58835ad6e6e2655c4e19c2284464ddaf473e5f764785bd9456bc15422c
SSDEEP 24576:GW1YrBXOK6QQeh1551JwzQ1Ju5E0UiZTmz8rUPcMcW25SZroejHU1F1AUkd+qqAv:d1khJw8K/Z33Fh8fVp
TLSH
T101D55B13FBD5DAEEE98C143B5B668211825DE522A60F2640788CB20ECE5778B5F50F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-02_16d535f46957c4ab3afe27fb32ed38f9_amadey_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-04-02_16d535f46957c4ab3afe27fb32ed38f9_amadey_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

.exe 2.7MB

2026-04-02_16d535f46957c4ab3afe27fb32ed38f9_amadey_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

IMPHASH fe01f9f8334b2fe85e327d2dedbba869
SHA256 f6c79145e91d6050adba1ee95c2bebc96814cc0f46732565704943b32f9b3860
MD5 16d535f46957c4ab3afe27fb32ed38f9
SHA1 5b89fbd3b309377b51ec089a33c4148f43a5cc39
SHA512 7e0f728d775c561395e5bbc954f408c3d5caccb222b3f38167940fafdbda8efb0c38fa58835ad6e6e2655c4e19c2284464ddaf473e5f764785bd9456bc15422c
SSDEEP 24576:GW1YrBXOK6QQeh1551JwzQ1Ju5E0UiZTmz8rUPcMcW25SZroejHU1F1AUkd+qqAv:d1khJw8K/Z33Fh8fVp
TLSH
T101D55B13FBD5DAEEE98C143B5B668211825DE522A60F2640788CB20ECE5778B5F50F7C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

110563

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MapViewOfFile GetSystemDefaultUILanguage GetDefaultCommConfigW LoadLibraryExW GetEnvironmentStringsW GetTickCount GetUserDefaultLangID Sleep GetFileAttributesA lstrlenW GetLastError SetLastError GetProcAddress IsValidCodePage LoadLibraryA LocalAlloc DecodePointer SetEnvironmentVariableA GetModuleFileNameA DebugSetProcessKillOnExit lstrlenA WaitForDebugEvent LocalFree SetFileAttributesW GetThreadUILanguage LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA ReadFile GetProcessHeap SetEndOfFile GetLocaleInfoA FindFirstFileW ExitProcess FileTimeToDosDateTime GetModuleHandleA GetSystemDefaultLangID HeapSize HeapAlloc DeleteFileA HeapReAlloc GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapFree VirtualFree VirtualAlloc HeapCreate GetModuleHandleW WriteFile GetStdHandle RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode GetModuleFileNameW FreeEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount CloseHandle CreateFileA SetFilePointer WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetStdHandle FlushFileBuffers GetCPInfo GetACP GetOEMCP RaiseException

user32

GetMessageTime GetTopWindow IsZoomed GetLastActivePopup GetWindowTextLengthA wsprintfW GetDoubleClickTime GetDC GetForegroundWindow GetWindowLongA IsWindow IsWow64Message MessageBoxW GetDlgCtrlID GetDialogBaseUnits

gdi32

GetPixel GetCharWidthW

advapi32

GetUserNameW

ole32

CoInitialize

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

ZWVbqExj

Size

28KB

Virtual Size

27KB

Characteristics

Name

WhKcvPLN

Size

3KB

Virtual Size

3KB

Characteristics

Name

XrMrzQEj

Size

2KB

Virtual Size

1KB

Characteristics

Name

MuBzJJGw

Size

37KB

Virtual Size

37KB

Characteristics

Name

imkHCpfv

Size

668KB

Virtual Size

668KB

Characteristics

Name

JnJPSSak

Size

18KB

Virtual Size

17KB

Characteristics

Name

cZxvPxXG

Size

512B

Virtual Size

151B

Characteristics

Name

zzVsNqTB

Size

49KB

Virtual Size

48KB

Characteristics

Name

eGtyxfcA

Size

1KB

Virtual Size

1KB

Characteristics

Name

rFpBiQeM

Size

52KB

Virtual Size

51KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-02_16d535f46957c4ab3afe27fb32ed38f9_amadey_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

gdi32

advapi32

ole32

generic