2026-04-05_ee536e33b97feaf4666b0d9468ba73d2_amadey_elex_glassworm_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-05_ee536e33b97feaf4666b0d9468ba73d2_amadey_elex_glassworm_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 4.4MB
Sample260405-a3pwfacv7z
SHA256 63c82734ffe99622626f01caa09dfeb3da486aaf5c7895b735b56617c067d3ef
MD5 ee536e33b97feaf4666b0d9468ba73d2
SHA1 edf85c1701a93497a862494084f97db640500395
SHA512 6566a1e72ebf685431026def87e69756a2f441a68adb112892a3f8317d1716b5b8ac758e919f0f888b384f76463912d5a05799a8a8924d911ce9a2b6c91b7a1b
SSDEEP 49152:1TTHVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblF+DJyzKb3HtFlB:1OnLrHp/qKm2/Sb/gqAZj+UzKb3HtF
TLSH
T1E9269C13EBC25ED5F64D05365B540600E73AE991964F03A1302C626DDFA73878FAAA3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-05_ee536e33b97feaf4666b0d9468ba73d2_amadey_elex_glassworm_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-04-05_ee536e33b97feaf4666b0d9468ba73d2_amadey_elex_glassworm_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 4.4MB

2026-04-05_ee536e33b97feaf4666b0d9468ba73d2_amadey_elex_glassworm_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 2f460961725ca1bacd7af1f08dcd53a6
SHA256 63c82734ffe99622626f01caa09dfeb3da486aaf5c7895b735b56617c067d3ef
MD5 ee536e33b97feaf4666b0d9468ba73d2
SHA1 edf85c1701a93497a862494084f97db640500395
SHA512 6566a1e72ebf685431026def87e69756a2f441a68adb112892a3f8317d1716b5b8ac758e919f0f888b384f76463912d5a05799a8a8924d911ce9a2b6c91b7a1b
SSDEEP 49152:1TTHVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblF+DJyzKb3HtFlB:1OnLrHp/qKm2/Sb/gqAZj+UzKb3HtF
TLSH
T1E9269C13EBC25ED5F64D05365B540600E73AE991964F03A1302C626DDFA73878FAAA3F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

34515

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceExW GetConsoleAliasExesLengthA DeleteVolumeMountPointA MoveFileExW GetCommState WaitNamedPipeA GlobalSize SetDefaultCommConfigW CreateHardLinkA WaitForSingleObjectEx FreeEnvironmentStringsA EnumCalendarInfoExW GetConsoleTitleA ReadConsoleW GetCompressedFileSizeW CreateActCtxW SetHandleCount TlsSetValue VirtualFreeEx LoadLibraryW InterlockedPopEntrySList SetConsoleMode GetConsoleAliasW GetFileAttributesW IsBadStringPtrA WritePrivateProfileStringW VirtualQuery GetConsoleAliasesW GetStdHandle SetLastError GetProcAddress VirtualAlloc BeginUpdateResourceW EnumSystemCodePagesW SetThreadPriorityBoost LoadLibraryA LocalAlloc DnsHostnameToComputerNameA AddAtomW GetProfileStringA WriteProfileSectionW FoldStringW EnumResourceTypesW GetModuleFileNameA GetModuleHandleA OpenEventW QueryPerformanceFrequency SetCalendarInfoA DeleteFileW DebugBreak ReadConsoleOutputCharacterW FindNextVolumeA SearchPathW GetStringTypeExA InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError HeapFree MultiByteToWideChar TerminateProcess GetCurrentProcess IsDebuggerPresent GetStartupInfoW RtlUnwind RaiseException LCMapStringA WideCharToMultiByte LCMapStringW GetCPInfo GetModuleHandleW ExitProcess WriteFile HeapAlloc HeapCreate VirtualFree HeapReAlloc GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsFree GetCurrentThreadId GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount SetFilePointer GetConsoleCP GetConsoleMode GetLocaleInfoW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers CreateFileA CloseHandle

gdi32

GetCharABCWidthsW CreateDiscardableBitmap GetCharWidthI

Name

.text

Size

193KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

LgzzHhaJ

Size

11KB

Virtual Size

11KB

Characteristics

Name

qcYupWMh

Size

3KB

Virtual Size

3KB

Characteristics

Name

pEgBwRXr

Size

512B

Virtual Size

313B

Characteristics

Name

HdUKqvyj

Size

172KB

Virtual Size

172KB

Characteristics

Name

GMQtiVYR

Size

3.8MB

Virtual Size

3.8MB

Characteristics

Name

oeGioncn

Size

60KB

Virtual Size

59KB

Characteristics

Name

YhoklAzO

Size

2KB

Virtual Size

1KB

Characteristics

Name

CKiNLVHC

Size

12KB

Virtual Size

12KB

Characteristics

Name

ZetTPyoK

Size

512B

Virtual Size

328B

Characteristics

Name

ihkNWxLH

Size

101KB

Virtual Size

101KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-05_ee536e33b97feaf4666b0d9468ba73d2_amadey_elex_glassworm_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

kernel32

gdi32

generic