2026-04-03_efb9266fb1a71bc885c7b68d60aa423a_amadey_elex_glassworm_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-03_efb9266fb1a71bc885c7b68d60aa423a_amadey_elex_glassworm_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop
Size 3.8MB
Sample260403-fbv62adv8v
SHA256 52acd0eaf004180f03ceed5d8145bf25f20a9d7d32da66ff28b8db6550fb282d
MD5 efb9266fb1a71bc885c7b68d60aa423a
SHA1 86275088f4a551c0c267e7d199d06755f42d81e3
SHA512 ead756209395061ee9e33a88df4d5b64a89e7de46f19087544edb887d1d265a8e75cb8a208c0689127595414c39b1032e50febb76bd57513e647bc5fcab99476
SSDEEP 98304:fJcMXnLrHp/qKm2/Sb/gqAZj+UzKb3HtF:fJcarRb/G8+H
TLSH
T1A7069C53EBC24AE9F74D05365B584140D72EEA21AA4F1321346C225DCFA73878F66E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-03_efb9266fb1a71bc885c7b68d60aa423a_amadey_elex_glassworm_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-04-03_efb9266fb1a71bc885c7b68d60aa423a_amadey_elex_glassworm_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop

.exe 3.8MB

2026-04-03_efb9266fb1a71bc885c7b68d60aa423a_amadey_elex_glassworm_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 83d1b8095e33f74e23ddae505b88bb37
SHA256 52acd0eaf004180f03ceed5d8145bf25f20a9d7d32da66ff28b8db6550fb282d
MD5 efb9266fb1a71bc885c7b68d60aa423a
SHA1 86275088f4a551c0c267e7d199d06755f42d81e3
SHA512 ead756209395061ee9e33a88df4d5b64a89e7de46f19087544edb887d1d265a8e75cb8a208c0689127595414c39b1032e50febb76bd57513e647bc5fcab99476
SSDEEP 98304:fJcMXnLrHp/qKm2/Sb/gqAZj+UzKb3HtF:fJcarRb/G8+H
TLSH
T1A7069C53EBC24AE9F74D05365B584140D72EEA21AA4F1321346C225DCFA73878F66E3E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29375

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileA FindActCtxSectionStringW WriteConsoleInputW ClearCommError WriteFile FindFirstVolumeMountPointW CreateDirectoryExW LocalSize WaitForMultipleObjects ReadConsoleInputA FindNextVolumeMountPointA OpenWaitableTimerW VerifyVersionInfoW GetVersionExA GetProcessId OpenEventA WriteConsoleOutputAttribute GetLocaleInfoW GetProcAddress LocalAlloc GetCommandLineW GetBinaryTypeA InterlockedDecrement OpenMutexA GetConsoleTitleA SearchPathA FreeConsole UpdateResourceA GetLastError GetProfileSectionA SetConsoleCursorInfo RequestWakeupLatency WritePrivateProfileSectionA GlobalFlags GetConsoleAliasesLengthW DeleteVolumeMountPointW FindResourceW SetVolumeMountPointW GetModuleHandleW HeapAlloc GetComputerNameA GetCurrentProcessId CreateNamedPipeA EnumResourceLanguagesA SetHandleInformation _hwrite CreateActCtxA DeleteVolumeMountPointA AddRefActCtx WritePrivateProfileStringA GetUserDefaultLangID CreateMemoryResourceNotification WaitForSingleObject GetLongPathNameW VerifyVersionInfoA EnumCalendarInfoA FindNextFileW EnumTimeFormatsW SetLastError SetCriticalSectionSpinCount GetConsoleAliasW LoadLibraryA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException RtlUnwind HeapFree DeleteFileA GetStartupInfoW GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc Sleep ExitProcess GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize InitializeCriticalSectionAndSpinCount WideCharToMultiByte LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle

user32

GetComboBoxInfo

advapi32

SetThreadToken

Name

.text

Size

97KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

129KB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

QIIzjdZN

Size

44KB

Virtual Size

44KB

Characteristics

Name

PktyESXH

Size

3KB

Virtual Size

3KB

Characteristics

Name

fookXchb

Size

3KB

Virtual Size

3KB

Characteristics

Name

dPsGenMV

Size

108KB

Virtual Size

108KB

Characteristics

Name

wbpSrspZ

Size

3.3MB

Virtual Size

3.3MB

Characteristics

Name

glixtsGz

Size

28KB

Virtual Size

28KB

Characteristics

Name

sLdQTLVl

Size

1KB

Virtual Size

1KB

Characteristics

Name

fthkubDV

Size

34KB

Virtual Size

34KB

Characteristics

Name

IWiXjaju

Size

2KB

Virtual Size

2KB

Characteristics

Name

OOfaCNNy

Size

20KB

Virtual Size

19KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-03_efb9266fb1a71bc885c7b68d60aa423a_amadey_elex_glassworm_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

advapi32

generic