2026-04-03_1851b5d05f2ca02ec96e4b13b3c1a664_amadey_elex_glassworm_redline-stealer_rhadamanthys_sakula_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-03_1851b5d05f2ca02ec96e4b13b3c1a664_amadey_elex_glassworm_redline-stealer_rhadamanthys_sakula_smoke-loader_stop
Size 1.9MB
Sample260403-jbkxvae13v
SHA256 e532087766ad9b0de69c1c2ba16d05c0ba09afdcfb141a20b11f173044fa36dc
MD5 1851b5d05f2ca02ec96e4b13b3c1a664
SHA1 0a61cf2933081f3c1e84eb887d4f85d499ca97f8
SHA512 5085281dcd6c145e5196b798265f68771e4fe860f022e3615d4c28e23ecad7142a6d37b9d88e18d77923c524edef1169ba2ddd7d56377f2ae5d56b151f160ee2
SSDEEP 24576:yz9NO7MmwBrjjtTB2AVDKUTbQIzFLwLIM0iwg99VpY:yJp1RVmgbQIzZMPXp
TLSH
T17A954953EB915AD9E68D09366F584190DB2EF261AB4F2350342C424CCF8738B8FA5E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-03_1851b5d05f2ca02ec96e4b13b3c1a664_amadey_elex_glassworm_redline-stealer_rhadamanthys_sakula_smoke-loader_stop

File Explorer

2026-04-03_1851b5d05f2ca02ec96e4b13b3c1a664_amadey_elex_glassworm_redline-stealer_rhadamanthys_sakula_smoke-loader_stop

.exe 1.9MB

2026-04-03_1851b5d05f2ca02ec96e4b13b3c1a664_amadey_elex_glassworm_redline-stealer_rhadamanthys_sakula_smoke-loader_stop

IMPHASH 3d514dbfa495ef23a57cf082b72217e7
SHA256 e532087766ad9b0de69c1c2ba16d05c0ba09afdcfb141a20b11f173044fa36dc
MD5 1851b5d05f2ca02ec96e4b13b3c1a664
SHA1 0a61cf2933081f3c1e84eb887d4f85d499ca97f8
SHA512 5085281dcd6c145e5196b798265f68771e4fe860f022e3615d4c28e23ecad7142a6d37b9d88e18d77923c524edef1169ba2ddd7d56377f2ae5d56b151f160ee2
SSDEEP 24576:yz9NO7MmwBrjjtTB2AVDKUTbQIzFLwLIM0iwg99VpY:yJp1RVmgbQIzZMPXp
TLSH
T17A954953EB915AD9E68D09366F584190DB2EF261AB4F2350342C424CCF8738B8FA5E7D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14564

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\devoyiyas sogibuyixorey\jatesineyaleb10\geyujina\peso\l.pdb

kernel32

SetHandleCount GetProcessPriorityBoost GetModuleHandleW CreateDirectoryExW GetLogicalDriveStringsW ReadConsoleInputW FindNextVolumeMountPointW AddAtomA CopyFileExA CallNamedPipeW GetCurrentDirectoryW GetSystemDirectoryA CreateMailslotW TlsGetValue GetProcAddress GetModuleHandleA LocalAlloc GetCommandLineA InterlockedIncrement ConvertDefaultLocale GetConsoleMode FindFirstVolumeA LocalFree AreFileApisANSI ReadConsoleOutputA ExitProcess BuildCommDCBAndTimeoutsW CreateActCtxA GlobalFindAtomW CopyFileW VerSetConditionMask CreateMutexW DeactivateActCtx GetDiskFreeSpaceA MoveFileA SetEvent MoveFileExW OpenMutexA FindResourceW SetFileTime SetFilePointer FindFirstFileA FreeEnvironmentStringsA EnumResourceLanguagesA InterlockedCompareExchange InterlockedExchangeAdd SetLastError EnumDateFormatsW GetConsoleAliasA GlobalFlags LoadLibraryA GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree CloseHandle EnterCriticalSection LeaveCriticalSection HeapAlloc Sleep WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetFileType GetStartupInfoA DeleteCriticalSection TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc SetStdHandle WideCharToMultiByte GetConsoleCP FlushFileBuffers RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize CreateFileA

gdi32

GetBrushOrgEx

advapi32

InitiateSystemShutdownA

Name

.text

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

405KB

Virtual Size

543KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

94KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

huKoqghg

Size

25KB

Virtual Size

25KB

Characteristics

Name

UKoJCRPR

Size

2KB

Virtual Size

1KB

Characteristics

Name

lFmdLktq

Size

1KB

Virtual Size

1KB

Characteristics

Name

ZfZhpCpF

Size

53KB

Virtual Size

52KB

Characteristics

Name

mRBgOqGH

Size

1.2MB

Virtual Size

1.2MB

Characteristics

Name

JABGUPlu

Size

74KB

Virtual Size

73KB

Characteristics

Name

nSqziuQN

Size

2KB

Virtual Size

2KB

Characteristics

Name

hmPSlaEM

Size

27KB

Virtual Size

26KB

Characteristics

Name

rIDyWcqU

Size

4KB

Virtual Size

3KB

Characteristics

Name

CKZCwHtK

Size

19KB

Virtual Size

18KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-03_1851b5d05f2ca02ec96e4b13b3c1a664_amadey_elex_glassworm_redline-stealer_rhadamanthys_sakula_smoke-loader_stop

kernel32

gdi32

advapi32

generic