2026-04-05_cd75d3680abe6910a243b947a173ffa2_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-05_cd75d3680abe6910a243b947a173ffa2_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop
Size 1.6MB
Sample260405-eds9saev2x
SHA256 076eab1019aa139f876ec8570ceac0b36cad17c851ebc92a9ea94767a055a5e2
MD5 cd75d3680abe6910a243b947a173ffa2
SHA1 7ea6196625a6b553cf765d026f45a063c2929cc3
SHA512 8c3b6bc0ca08789fa5f2e520f19d0ab86df137f15b8ce13a4d5e08191d5cabed7382b04d61670f07440d23e6fa5d827168d8ca99d03f1001c2501054e2edfabf
SSDEEP 24576:7DV1WxOT1dJrEmsjJk8A0dsGiAhoAHsaLFZhgHHAVPw:7BYxO5bE5jJvhrHxFHgAVI
TLSH
T168759D57E7915AE9E65D09366F184184A72EF222AB0F2320745C061DCF9339BCF66E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-05_cd75d3680abe6910a243b947a173ffa2_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-04-05_cd75d3680abe6910a243b947a173ffa2_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 1.6MB

2026-04-05_cd75d3680abe6910a243b947a173ffa2_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 44b1211815eb04dba3878a847875e976
SHA256 076eab1019aa139f876ec8570ceac0b36cad17c851ebc92a9ea94767a055a5e2
MD5 cd75d3680abe6910a243b947a173ffa2
SHA1 7ea6196625a6b553cf765d026f45a063c2929cc3
SHA512 8c3b6bc0ca08789fa5f2e520f19d0ab86df137f15b8ce13a4d5e08191d5cabed7382b04d61670f07440d23e6fa5d827168d8ca99d03f1001c2501054e2edfabf
SSDEEP 24576:7DV1WxOT1dJrEmsjJk8A0dsGiAhoAHsaLFZhgHHAVPw:7BYxO5bE5jJvhrHxFHgAVI
TLSH
T168759D57E7915AE9E65D09366F184184A72EF222AB0F2320745C061DCF9339BCF66E3C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16675

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bojay-kiligam.pdb

kernel32

GetConsoleAliasesLengthW TlsGetValue SystemTimeToTzSpecificLocalTime EndUpdateResourceW InterlockedIncrement GetCurrentProcess CreateJobObjectW OpenSemaphoreA GetModuleHandleW GetTickCount GetWindowsDirectoryA EnumTimeFormatsW GlobalAlloc SetFileShortNameW GlobalFindAtomA Sleep AssignProcessToJobObject SizeofResource GetSystemWindowsDirectoryA FormatMessageW SetConsoleCursorPosition CreateFileW GetVolumePathNameA LCMapStringA FindFirstChangeNotificationW GetLastError SetLastError BackupRead GetProcAddress VirtualAlloc BeginUpdateResourceW EnumDateFormatsExA SetComputerNameA LoadLibraryA InterlockedExchangeAdd CreateFileMappingA FindFirstVolumeMountPointW HeapLock FoldStringW FindFirstVolumeMountPointA VirtualProtect GetVersionExA DeleteTimerQueueTimer GlobalAddAtomW ReadConsoleOutputCharacterW GetComputerNameA GetDateFormatW InterlockedExchange GetFullPathNameW CreateFileA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter ExitProcess GetCommandLineA GetStartupInfoA WriteFile GetStdHandle GetModuleFileNameA TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement HeapSize EnterCriticalSection LeaveCriticalSection TerminateProcess IsDebuggerPresent HeapFree DeleteCriticalSection InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc HeapReAlloc RtlUnwind GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringW GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer RaiseException

user32

GetWindowTextLengthW

gdi32

SetDeviceGammaRamp

advapi32

ReadEventLogA

shell32

ShellAboutW

ole32

CoRegisterPSClsid

winhttp

WinHttpCheckPlatform

msimg32

AlphaBlend

Name

.text

Size

872KB

Virtual Size

871KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

tOUBgeDt

Size

82KB

Virtual Size

82KB

Characteristics

Name

TVYlnrcF

Size

512B

Virtual Size

68B

Characteristics

Name

iUjJggqo

Size

4KB

Virtual Size

3KB

Characteristics

Name

VniFvece

Size

8KB

Virtual Size

8KB

Characteristics

Name

CTIJPkou

Size

448KB

Virtual Size

448KB

Characteristics

Name

lWoMjzbH

Size

103KB

Virtual Size

102KB

Characteristics

Name

hpcDJDjf

Size

2KB

Virtual Size

1KB

Characteristics

Name

hJjqfkpB

Size

7KB

Virtual Size

7KB

Characteristics

Name

utBHUbfg

Size

3KB

Virtual Size

2KB

Characteristics

Name

pUoRNvWN

Size

24KB

Virtual Size

23KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-05_cd75d3680abe6910a243b947a173ffa2_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

winhttp

msimg32

generic