General
- Target 2026-04-08_a8b0d74fb3613b456e8cd5eefb93457d_amadey_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.5MB
- Sample260408-s94maag121
- SHA256 4dddb497c7085f5da7ee9f3ab2f5cf2fdc4700f8175268bfc4ca65a054724f8d
- MD5 a8b0d74fb3613b456e8cd5eefb93457d
- SHA1 f0120c6d93341928273f607036c7b36740ebc6f7
- SHA512 4ee7bab2a9b3a4c614a6bc27b2f8d6ce134861ca0382bc932e67f15b30c2857cee8f3a2fdfd5780b4969428ac9e7580aeb66613ad9e8f002241d8ae30d1a88ba
- SSDEEP 12288:NNGeidPxGDiMEleCfA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJAmer5+nIUer5+n:EPQDkzAVDKUTbQIzFLwLy
- TLSH T16A75F553EB915AD8E68D49366F584150D62EF221AACF2360342C520DDF93387BF62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-08_a8b0d74fb3613b456e8cd5eefb93457d_amadey_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260130-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-08_a8b0d74fb3613b456e8cd5eefb93457d_amadey_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win11-20260130-en
11 signatures
150 seconds
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
pub4
Extracted
Family
-
smokeloader
Version
-
2022
C2
-
http://humydrole.com/tmp/index.php
-
http://trunk-co.ru/tmp/index.php
-
http://weareelight.com/tmp/index.php
-
http://pirateking.online/tmp/index.php
-
http://piratia.pw/tmp/index.php
-
http://go-piratia.ru/tmp/index.php
rc4.i32
rc4.i32
Targets
-
- Target 2026-04-08_a8b0d74fb3613b456e8cd5eefb93457d_amadey_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.5MB
- SHA256 4dddb497c7085f5da7ee9f3ab2f5cf2fdc4700f8175268bfc4ca65a054724f8d
- MD5 a8b0d74fb3613b456e8cd5eefb93457d
- SHA1 f0120c6d93341928273f607036c7b36740ebc6f7
- SHA512 4ee7bab2a9b3a4c614a6bc27b2f8d6ce134861ca0382bc932e67f15b30c2857cee8f3a2fdfd5780b4969428ac9e7580aeb66613ad9e8f002241d8ae30d1a88ba
- SSDEEP 12288:NNGeidPxGDiMEleCfA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJAmer5+nIUer5+n:EPQDkzAVDKUTbQIzFLwLy
- TLSH T16A75F553EB915AD8E68D49366F584150D62EF221AACF2360342C520DDF93387BF62E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Smokeloader family
-
Deletes itself