Extracted

• • Target
    2026-04-04_c45808dcf284c7d4d854bc47abb5662c_amadey_elex_glassworm_icedid_njrat_smoke-loader_stop
  • Size 3.5MB
  • SHA256 13405b26f11915b00576de5136613f698f00b5fa84c04b2620f27bc49aea87f6
  • MD5 c45808dcf284c7d4d854bc47abb5662c
  • SHA1 d1fc19a5a1b5d0325c77e42247d489a7f21d13dc
  • SHA512 7bb6bc3ba6123a60d641d100f4bfa8610a196cc923442fd4984b3d535c0bcb66f005d833b44565f7a1859a5dfa5db0cf33e8a4c224f26ff398e97ee30f396b0a
  • SSDEEP 49152:CGHa6wzqXhwUAMAx58tcUeqFFVmgbQIzZMPXpPq:CGHa6MUr258tcHg
  • TLSH
    T17FF56A13EB418ED9E39A0476DF188150872AF1285BFF1262385856CCDE97387BF61A3D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderlgoogloaderrhadamanthysstealer

  • Detect rhadamanthys stealer shellcode

  • Detects LgoogLoader payload

  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

    downloaderlgoogloader

  • Lgoogloader family

    lgoogloader

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Detects Windows executables referencing non-Windows User-Agents

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2