2026-04-04_694cd76d79f5b0d90410ea3774e248d0_amadey_elex_glassworm_manuscrypt_njrat_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-04_694cd76d79f5b0d90410ea3774e248d0_amadey_elex_glassworm_manuscrypt_njrat_rhadamanthys_smoke-loader_stealc_stop
Size 2.1MB
Sample260404-sa76esgy5m
SHA256 83f990032c205dd0ef1df2568059342d693527b215b7d76cb63f1017c9545c9f
MD5 694cd76d79f5b0d90410ea3774e248d0
SHA1 d73e1e1b14ae28162cc2e088bb086e7e8cf08b68
SHA512 65c418060b5d7e8a71f79c5405a18b288eba861484bddc7ed79be80fd17ee6019d603266d082c301e16db1ad79e47bc288c3750bcbbee22edf305bc3d046e023
SSDEEP 24576:1r1Ma1/8d0Smd3wc57Ug95QshM5X7Z7OAVDKUTbQIzFLwL:1rBs3mNwc5Z9+sCVZhVmgbQIz
TLSH
T1C5A55953EB925AD8E65E09765F184150DB2EF6619B8F2360342C520DCFA33878F62E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-04_694cd76d79f5b0d90410ea3774e248d0_amadey_elex_glassworm_manuscrypt_njrat_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-04-04_694cd76d79f5b0d90410ea3774e248d0_amadey_elex_glassworm_manuscrypt_njrat_rhadamanthys_smoke-loader_stealc_stop

.exe 2.1MB

2026-04-04_694cd76d79f5b0d90410ea3774e248d0_amadey_elex_glassworm_manuscrypt_njrat_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 08b56125ba7e99bd17ba88b830247aad
SHA256 83f990032c205dd0ef1df2568059342d693527b215b7d76cb63f1017c9545c9f
MD5 694cd76d79f5b0d90410ea3774e248d0
SHA1 d73e1e1b14ae28162cc2e088bb086e7e8cf08b68
SHA512 65c418060b5d7e8a71f79c5405a18b288eba861484bddc7ed79be80fd17ee6019d603266d082c301e16db1ad79e47bc288c3750bcbbee22edf305bc3d046e023
SSDEEP 24576:1r1Ma1/8d0Smd3wc57Ug95QshM5X7Z7OAVDKUTbQIzFLwL:1rBs3mNwc5Z9+sCVZhVmgbQIz
TLSH
T1C5A55953EB925AD8E65E09765F184150DB2EF6619B8F2360342C520DCFA33878F62E3D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36350

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SearchPathW BuildCommDCBAndTimeoutsA InterlockedIncrement InterlockedDecrement SetMailslotInfo ZombifyActCtx GetProcessPriorityBoost GetModuleHandleW EnumCalendarInfoExW WaitNamedPipeW EnumTimeFormatsW GetDriveTypeA GetProcessTimes GetVolumePathNameW GetCalendarInfoA GetConsoleAliasExesLengthW GetFileAttributesA SetSystemPowerState GetModuleFileNameW CompareStringW GetShortPathNameA EnumSystemLocalesA GetPrivateProfileIntW GetProfileIntA HeapCompact GetLastError GetProcAddress AttachConsole SetComputerNameA EnterCriticalSection GlobalFree OpenWaitableTimerA LoadLibraryA WriteConsoleA GetProcessId InterlockedExchangeAdd LocalAlloc AddAtomA OpenJobObjectW GetPrivateProfileStructA FindFirstVolumeMountPointA EnumDateFormatsA CreateIoCompletionPort GetModuleHandleA CancelTimerQueueTimer FreeEnvironmentStringsW FindNextFileW CreateMailslotA SetCalendarInfoA AreFileApisANSI GlobalDeleteAtom DeleteFiber GetVolumeNameForVolumeMountPointA CloseHandle WriteConsoleW EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection WideCharToMultiByte HeapFree HeapAlloc DeleteFileA HeapReAlloc GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind LCMapStringW MultiByteToWideChar GetCPInfo GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent HeapCreate ExitProcess WriteFile GetStdHandle SetFilePointer SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetModuleFileNameA GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoW HeapSize GetUserDefaultLCID GetLocaleInfoA IsValidLocale GetStringTypeW LoadLibraryW SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers CreateFileW

gdi32

GetCharABCWidthsA SelectObject

winhttp

WinHttpGetProxyForUrl

Name

.text

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

585KB

Virtual Size

41.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

ixSuyWvt

Size

72KB

Virtual Size

71KB

Characteristics

Name

DyLXisxH

Size

1024B

Virtual Size

928B

Characteristics

Name

wVBNPiTX

Size

4KB

Virtual Size

3KB

Characteristics

Name

LxFdnQCp

Size

71KB

Virtual Size

71KB

Characteristics

Name

SzCaGyLA

Size

1.1MB

Virtual Size

1.1MB

Characteristics

Name

HVHiVsHY

Size

4KB

Virtual Size

4KB

Characteristics

Name

FervcFKK

Size

2KB

Virtual Size

1KB

Characteristics

Name

DgrTBktM

Size

62KB

Virtual Size

61KB

Characteristics

Name

TDkxNCws

Size

2KB

Virtual Size

2KB

Characteristics

Name

cMqBkMOE

Size

81KB

Virtual Size

81KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-04_694cd76d79f5b0d90410ea3774e248d0_amadey_elex_glassworm_manuscrypt_njrat_rhadamanthys_smoke-loader_stealc_stop

kernel32

gdi32

winhttp

generic