General
- Target 2026-04-05_98bbbd5b35297bc80217deb63cadd072_amadey_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 2.2MB
- Sample260405-cp1f5ads4t
- SHA256 d3444d71fad1430a19d1e6ef0691260f64de078b48bdd98104848ea376cd19b4
- MD5 98bbbd5b35297bc80217deb63cadd072
- SHA1 9e1fe4d128c3eeff8ab9397074d11f3783a4c76b
- SHA512 30b123b4fcab4519dcb276104d860172ffd5f2317394dc6c26e69282dc2de19f5fc9b640950f6bbcbe8388234d715fed87447976d089f5af80715d4a4f5a9256
- SSDEEP 24576:UmX9KAVDKUTbQIzFLwLIM0iwg99Vpibu9QcrHp5HZxFm:Ui9BVmgbQIzZMPXpB91rHpn
- TLSH T1F8A56A63EB914AD8F69D09366F584150D72EF221AA4F2350782C520DCF9738B8FA5E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-05_98bbbd5b35297bc80217deb63cadd072_amadey_elex_glassworm_redline-stealer_rhadamanthys_smoke.exe
Resource
win10v2004-20260130-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-05_98bbbd5b35297bc80217deb63cadd072_amadey_elex_glassworm_redline-stealer_rhadamanthys_smoke.exe
Resource
win11-20260130-en
12 signatures
150 seconds
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
lab
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-file-host6.com/
-
http://host-host-file8.com/
rc4.i32
rc4.i32
Targets
-
- Target 2026-04-05_98bbbd5b35297bc80217deb63cadd072_amadey_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 2.2MB
- SHA256 d3444d71fad1430a19d1e6ef0691260f64de078b48bdd98104848ea376cd19b4
- MD5 98bbbd5b35297bc80217deb63cadd072
- SHA1 9e1fe4d128c3eeff8ab9397074d11f3783a4c76b
- SHA512 30b123b4fcab4519dcb276104d860172ffd5f2317394dc6c26e69282dc2de19f5fc9b640950f6bbcbe8388234d715fed87447976d089f5af80715d4a4f5a9256
- SSDEEP 24576:UmX9KAVDKUTbQIzFLwLIM0iwg99Vpibu9QcrHp5HZxFm:Ui9BVmgbQIzZMPXpB91rHpn
- TLSH T1F8A56A63EB914AD8F69D09366F584150D72EF221AA4F2350782C520DCF9738B8FA5E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Smokeloader family
-
Deletes itself
-
Suspicious use of SetThreadContext