2026-04-04_6125b98d1bdbf604cd8999fbf361607c_amadey_elex_glassworm_icedid_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-04_6125b98d1bdbf604cd8999fbf361607c_amadey_elex_glassworm_icedid_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop
Size 2.7MB
Sample260404-s29hkady2y
SHA256 e73d863122d7da95646dfae4687ca1e28014836ab4d80705b4e5003a6cfc5c54
MD5 6125b98d1bdbf604cd8999fbf361607c
SHA1 ff2d70027e9291f6835d0224e17d1ac23c17761e
SHA512 89445b64e342c813e8af2df88f7700f6ea87dc21db2a3dce9c88ba2400e73c0cd8bc2d2a6c146307b0e864aac65ee1f9b3174cdcb3d6a865379f516ac047dca0
SSDEEP 49152:9ve24kPgAjmOkNIYVJ/DXMDZvpeBH+tm/kJ9TPBV:NVaVJ/DrBHTQ
TLSH
T132D5CF57E7918AE8E66D08366F244144A22EF521AACF6321789C130DCF57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-04_6125b98d1bdbf604cd8999fbf361607c_amadey_elex_glassworm_icedid_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

File Explorer

2026-04-04_6125b98d1bdbf604cd8999fbf361607c_amadey_elex_glassworm_icedid_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

.exe 2.7MB

2026-04-04_6125b98d1bdbf604cd8999fbf361607c_amadey_elex_glassworm_icedid_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

IMPHASH 83d1b8095e33f74e23ddae505b88bb37
SHA256 e73d863122d7da95646dfae4687ca1e28014836ab4d80705b4e5003a6cfc5c54
MD5 6125b98d1bdbf604cd8999fbf361607c
SHA1 ff2d70027e9291f6835d0224e17d1ac23c17761e
SHA512 89445b64e342c813e8af2df88f7700f6ea87dc21db2a3dce9c88ba2400e73c0cd8bc2d2a6c146307b0e864aac65ee1f9b3174cdcb3d6a865379f516ac047dca0
SSDEEP 49152:9ve24kPgAjmOkNIYVJ/DXMDZvpeBH+tm/kJ9TPBV:NVaVJ/DrBHTQ
TLSH
T132D5CF57E7918AE8E66D08366F244144A22EF521AACF6321789C130DCF57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29375

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileA FindActCtxSectionStringW WriteConsoleInputW ClearCommError WriteFile FindFirstVolumeMountPointW CreateDirectoryExW LocalSize WaitForMultipleObjects ReadConsoleInputA FindNextVolumeMountPointA OpenWaitableTimerW VerifyVersionInfoW GetVersionExA GetProcessId OpenEventA WriteConsoleOutputAttribute GetLocaleInfoW GetProcAddress LocalAlloc GetCommandLineW GetBinaryTypeA InterlockedDecrement OpenMutexA GetConsoleTitleA SearchPathA FreeConsole UpdateResourceA GetLastError GetProfileSectionA SetConsoleCursorInfo RequestWakeupLatency WritePrivateProfileSectionA GlobalFlags GetConsoleAliasesLengthW DeleteVolumeMountPointW FindResourceW SetVolumeMountPointW GetModuleHandleW HeapAlloc GetComputerNameA GetCurrentProcessId CreateNamedPipeA EnumResourceLanguagesA SetHandleInformation _hwrite CreateActCtxA DeleteVolumeMountPointA AddRefActCtx WritePrivateProfileStringA GetUserDefaultLangID CreateMemoryResourceNotification WaitForSingleObject GetLongPathNameW VerifyVersionInfoA EnumCalendarInfoA FindNextFileW EnumTimeFormatsW SetLastError SetCriticalSectionSpinCount GetConsoleAliasW LoadLibraryA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException RtlUnwind HeapFree DeleteFileA GetStartupInfoW GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc Sleep ExitProcess GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize InitializeCriticalSectionAndSpinCount WideCharToMultiByte LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle

user32

GetComboBoxInfo

advapi32

SetThreadToken

Name

.text

Size

97KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1.7MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

10KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

GTzUsHZi

Size

82KB

Virtual Size

81KB

Characteristics

Name

bzcaaHFC

Size

1024B

Virtual Size

707B

Characteristics

Name

ivKUxFrr

Size

3KB

Virtual Size

2KB

Characteristics

Name

IEjjHpXP

Size

175KB

Virtual Size

175KB

Characteristics

Name

BqPxiPqI

Size

486KB

Virtual Size

485KB

Characteristics

Name

fbxMMrOU

Size

50KB

Virtual Size

50KB

Characteristics

Name

qOXlNXmJ

Size

512B

Virtual Size

245B

Characteristics

Name

SNmhpdPs

Size

73KB

Virtual Size

73KB

Characteristics

Name

OUxPNsqS

Size

3KB

Virtual Size

3KB

Characteristics

Name

IsvEUSEh

Size

47KB

Virtual Size

47KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-04_6125b98d1bdbf604cd8999fbf361607c_amadey_elex_glassworm_icedid_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

kernel32

user32

advapi32

generic