2026-04-05_95c4b8a073a5791a9974944dfc2a9d0d_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-05_95c4b8a073a5791a9974944dfc2a9d0d_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop
Size 2.6MB
Sample260405-cpvwmsds31
SHA256 41a5eb437d74fbd5a0a012e54c65d1697da1795d5ff746470ba3a71ed84ab3ec
MD5 95c4b8a073a5791a9974944dfc2a9d0d
SHA1 ba93837faede704fc3fefcca95a1de0ccc7496c0
SHA512 b2cacef35e17f9cd28928819ce057dc52277589885b03388e43ec30e87f2ea80925ff356d804063c7b58914e2fe7a8db3d8659115a43ef800693d6e1bd512120
SSDEEP 49152:2kPSj80hNcHiFmppV9KeXVmgbQIzZMPXp:jarsxDcee
TLSH
T11DC52653EB815AD9E39D0972DF188150972AF2299BFF1260341852CCDE93387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-05_95c4b8a073a5791a9974944dfc2a9d0d_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-04-05_95c4b8a073a5791a9974944dfc2a9d0d_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 2.6MB

2026-04-05_95c4b8a073a5791a9974944dfc2a9d0d_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 44b1211815eb04dba3878a847875e976
SHA256 41a5eb437d74fbd5a0a012e54c65d1697da1795d5ff746470ba3a71ed84ab3ec
MD5 95c4b8a073a5791a9974944dfc2a9d0d
SHA1 ba93837faede704fc3fefcca95a1de0ccc7496c0
SHA512 b2cacef35e17f9cd28928819ce057dc52277589885b03388e43ec30e87f2ea80925ff356d804063c7b58914e2fe7a8db3d8659115a43ef800693d6e1bd512120
SSDEEP 49152:2kPSj80hNcHiFmppV9KeXVmgbQIzZMPXp:jarsxDcee
TLSH
T11DC52653EB815AD9E39D0972DF188150972AF2299BFF1260341852CCDE93387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16675

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\xasaz29_leto\judor\yifiyeganeha\pibulagovuz\41 sacazoh_wob-29.pdb

kernel32

GetConsoleAliasesLengthW TlsGetValue SystemTimeToTzSpecificLocalTime EndUpdateResourceW InterlockedIncrement GetCurrentProcess CreateJobObjectW OpenSemaphoreA GetModuleHandleW GetTickCount GetWindowsDirectoryA EnumTimeFormatsW GlobalAlloc SetFileShortNameW GlobalFindAtomA Sleep AssignProcessToJobObject SizeofResource GetSystemWindowsDirectoryA FormatMessageW SetConsoleCursorPosition CreateFileW GetVolumePathNameA LCMapStringA FindFirstChangeNotificationW GetLastError SetLastError BackupRead GetProcAddress VirtualAlloc BeginUpdateResourceW EnumDateFormatsExA SetComputerNameA LoadLibraryA InterlockedExchangeAdd CreateFileMappingA FindFirstVolumeMountPointW HeapLock FoldStringW FindFirstVolumeMountPointA VirtualProtect GetVersionExA DeleteTimerQueueTimer GlobalAddAtomW ReadConsoleOutputCharacterW GetComputerNameA GetDateFormatW InterlockedExchange GetFullPathNameW CreateFileA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter ExitProcess GetCommandLineA GetStartupInfoA WriteFile GetStdHandle GetModuleFileNameA TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement HeapSize EnterCriticalSection LeaveCriticalSection TerminateProcess IsDebuggerPresent HeapFree DeleteCriticalSection InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc HeapReAlloc RtlUnwind GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringW GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer RaiseException

user32

GetWindowTextLengthW

gdi32

SetDeviceGammaRamp

advapi32

ReadEventLogA

shell32

ShellAboutW

ole32

CoRegisterPSClsid

winhttp

WinHttpCheckPlatform

msimg32

AlphaBlend

Name

.text

Size

872KB

Virtual Size

871KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

qLjndJmf

Size

82KB

Virtual Size

82KB

Characteristics

Name

sXvdQBEg

Size

2KB

Virtual Size

1KB

Characteristics

Name

IjGCQWRI

Size

2KB

Virtual Size

2KB

Characteristics

Name

HrLMaDiL

Size

14KB

Virtual Size

13KB

Characteristics

Name

pofyMfvC

Size

1.3MB

Virtual Size

1.3MB

Characteristics

Name

sekhWyaK

Size

17KB

Virtual Size

16KB

Characteristics

Name

nkjUbUCH

Size

512B

Virtual Size

207B

Characteristics

Name

FxScMUJE

Size

143KB

Virtual Size

143KB

Characteristics

Name

jfzVtGDe

Size

1KB

Virtual Size

1KB

Characteristics

Name

tXrmkMFY

Size

72KB

Virtual Size

71KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-05_95c4b8a073a5791a9974944dfc2a9d0d_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

winhttp

msimg32

generic