2026-04-03_ef987c69ee6687d5965abd21af19a05d_amadey_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-03_ef987c69ee6687d5965abd21af19a05d_amadey_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop
Size 1.6MB
Sample260403-m2z18set3r
SHA256 a63767f3c711a1a5c5eccabd4057564e0b4212aeb0cf66cec58e276650b5c12d
MD5 ef987c69ee6687d5965abd21af19a05d
SHA1 135bdc42dc83f96a74b3b8995561f670f1d1f830
SHA512 d5202ed7c43e6efe3b1cdfe8d928a7a6c6143567be32638c66f03973eb627d278ec02175b83c9950e1efd96f69cf93b1545e66e778aa2d6da28659b389a944ec
SSDEEP 24576:+DV1WxOT1dJrEmsjJk8A0dsGiAhoAHsaLFZhghAV:+BYxO5bE5jJvhrHxFHg+V
TLSH
T1F1758B53E7919AE9E65D05766F184184A32EF221AB0F6360781C161DCF6338BCF66E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-03_ef987c69ee6687d5965abd21af19a05d_amadey_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-04-03_ef987c69ee6687d5965abd21af19a05d_amadey_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 1.6MB

2026-04-03_ef987c69ee6687d5965abd21af19a05d_amadey_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 44b1211815eb04dba3878a847875e976
SHA256 a63767f3c711a1a5c5eccabd4057564e0b4212aeb0cf66cec58e276650b5c12d
MD5 ef987c69ee6687d5965abd21af19a05d
SHA1 135bdc42dc83f96a74b3b8995561f670f1d1f830
SHA512 d5202ed7c43e6efe3b1cdfe8d928a7a6c6143567be32638c66f03973eb627d278ec02175b83c9950e1efd96f69cf93b1545e66e778aa2d6da28659b389a944ec
SSDEEP 24576:+DV1WxOT1dJrEmsjJk8A0dsGiAhoAHsaLFZhghAV:+BYxO5bE5jJvhrHxFHg+V
TLSH
T1F1758B53E7919AE9E65D05766F184184A32EF221AB0F6360781C161DCF6338BCF66E3C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16675

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bojay-kiligam.pdb

kernel32

GetConsoleAliasesLengthW TlsGetValue SystemTimeToTzSpecificLocalTime EndUpdateResourceW InterlockedIncrement GetCurrentProcess CreateJobObjectW OpenSemaphoreA GetModuleHandleW GetTickCount GetWindowsDirectoryA EnumTimeFormatsW GlobalAlloc SetFileShortNameW GlobalFindAtomA Sleep AssignProcessToJobObject SizeofResource GetSystemWindowsDirectoryA FormatMessageW SetConsoleCursorPosition CreateFileW GetVolumePathNameA LCMapStringA FindFirstChangeNotificationW GetLastError SetLastError BackupRead GetProcAddress VirtualAlloc BeginUpdateResourceW EnumDateFormatsExA SetComputerNameA LoadLibraryA InterlockedExchangeAdd CreateFileMappingA FindFirstVolumeMountPointW HeapLock FoldStringW FindFirstVolumeMountPointA VirtualProtect GetVersionExA DeleteTimerQueueTimer GlobalAddAtomW ReadConsoleOutputCharacterW GetComputerNameA GetDateFormatW InterlockedExchange GetFullPathNameW CreateFileA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter ExitProcess GetCommandLineA GetStartupInfoA WriteFile GetStdHandle GetModuleFileNameA TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement HeapSize EnterCriticalSection LeaveCriticalSection TerminateProcess IsDebuggerPresent HeapFree DeleteCriticalSection InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc HeapReAlloc RtlUnwind GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringW GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer RaiseException

user32

GetWindowTextLengthW

gdi32

SetDeviceGammaRamp

advapi32

ReadEventLogA

shell32

ShellAboutW

ole32

CoRegisterPSClsid

winhttp

WinHttpCheckPlatform

msimg32

AlphaBlend

Name

.text

Size

872KB

Virtual Size

871KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

NAMdmlGM

Size

19KB

Virtual Size

18KB

Characteristics

Name

cowJIHzx

Size

5KB

Virtual Size

4KB

Characteristics

Name

IyDLhkQO

Size

512B

Virtual Size

290B

Characteristics

Name

GYklExaX

Size

21KB

Virtual Size

20KB

Characteristics

Name

NJjYBIWK

Size

464KB

Virtual Size

463KB

Characteristics

Name

LPdsoEYR

Size

55KB

Virtual Size

55KB

Characteristics

Name

cbuonCsU

Size

4KB

Virtual Size

3KB

Characteristics

Name

cJgWHZCx

Size

54KB

Virtual Size

53KB

Characteristics

Name

aBEEtiCe

Size

1KB

Virtual Size

1KB

Characteristics

Name

sPnfLdGU

Size

42KB

Virtual Size

41KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-03_ef987c69ee6687d5965abd21af19a05d_amadey_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

winhttp

msimg32

generic