2026-04-08_73b60a8fb8f057899c2578f23e8fbb46_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-08_73b60a8fb8f057899c2578f23e8fbb46_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 4.0MB
Sample260408-stryjsgv91
SHA256 73668ba50f6a1c968e1481c4ea31e58c7cd3857a754edcfcb97caa82d5cf0b06
MD5 73b60a8fb8f057899c2578f23e8fbb46
SHA1 2699f44c92f42898436b00eb2044415af1112164
SHA512 4be37ee1eae198db7312c7b4535eb00c39fef952ce476e871fc555fb17823141f877c4118b279656c3179bf8c590d3d3a933f0ec9ac6aac825125d5c4a22299d
SSDEEP 49152:jWTxVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblF+DJyzKb3HtFl:icnLrHp/qKm2/Sb/gqAZj+UzKb3HtF
TLSH
T1AA166A53EBC21AD5F64D05369F580200D72AEA5196EB1361302C225DCFA7387BFA5A3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-08_73b60a8fb8f057899c2578f23e8fbb46_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-04-08_73b60a8fb8f057899c2578f23e8fbb46_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 4.0MB

2026-04-08_73b60a8fb8f057899c2578f23e8fbb46_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 546130510dc5b38675e6f72c400381d6
SHA256 73668ba50f6a1c968e1481c4ea31e58c7cd3857a754edcfcb97caa82d5cf0b06
MD5 73b60a8fb8f057899c2578f23e8fbb46
SHA1 2699f44c92f42898436b00eb2044415af1112164
SHA512 4be37ee1eae198db7312c7b4535eb00c39fef952ce476e871fc555fb17823141f877c4118b279656c3179bf8c590d3d3a933f0ec9ac6aac825125d5c4a22299d
SSDEEP 49152:jWTxVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblF+DJyzKb3HtFl:icnLrHp/qKm2/Sb/gqAZj+UzKb3HtF
TLSH
T1AA166A53EBC21AD5F64D05369F580200D72AEA5196EB1361302C225DCFA7387BFA5A3F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16547

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\seyuv_yumipabo67 leluyorahegado\juhoneg96\tumu\xatof.pdb

kernel32

GetConsoleAliasesLengthW TlsGetValue SystemTimeToTzSpecificLocalTime EndUpdateResourceW InterlockedIncrement GetCurrentProcess CreateJobObjectW OpenSemaphoreA GetTickCount GetWindowsDirectoryA EnumTimeFormatsA GlobalAlloc SetFileShortNameW GlobalFindAtomA Sleep AssignProcessToJobObject SizeofResource GetSystemWindowsDirectoryA FormatMessageW SetConsoleCursorPosition CreateFileW GetVolumePathNameA InterlockedExchange GetLastError FindFirstChangeNotificationW BackupRead GetProcAddress VirtualAlloc BeginUpdateResourceW EnumDateFormatsExA SetComputerNameA LoadLibraryA InterlockedExchangeAdd CreateFileMappingA FindFirstVolumeMountPointW HeapLock FoldStringW FindFirstVolumeMountPointA GetModuleHandleA VirtualProtect GetVersionExA DeleteTimerQueueTimer GlobalAddAtomW ReadConsoleOutputCharacterW LCMapStringW GetComputerNameA GetDateFormatW SetLastError GetFullPathNameW CreateFileA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter GetModuleHandleW ExitProcess GetCommandLineA GetStartupInfoA WriteFile GetStdHandle GetModuleFileNameA TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement HeapSize EnterCriticalSection LeaveCriticalSection TerminateProcess IsDebuggerPresent HeapFree DeleteCriticalSection InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc HeapReAlloc RtlUnwind GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer RaiseException

user32

GetWindowTextLengthW

gdi32

SetDeviceGammaRamp

advapi32

ReadEventLogA

shell32

ShellAboutW

ole32

CoRegisterPSClsid

winhttp

WinHttpCheckPlatform

msimg32

AlphaBlend

Name

.text

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

93KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

haNRKOOW

Size

56KB

Virtual Size

56KB

Characteristics

Name

sluVFUEb

Size

4KB

Virtual Size

4KB

Characteristics

Name

WgGkzXTV

Size

2KB

Virtual Size

2KB

Characteristics

Name

evQepfSZ

Size

7KB

Virtual Size

7KB

Characteristics

Name

cMFZxVxt

Size

3.5MB

Virtual Size

3.5MB

Characteristics

Name

rCjRJplv

Size

141KB

Virtual Size

140KB

Characteristics

Name

KABNxIjP

Size

512B

Virtual Size

118B

Characteristics

Name

SrgMPusU

Size

24KB

Virtual Size

24KB

Characteristics

Name

JfRpAoHv

Size

4KB

Virtual Size

4KB

Characteristics

Name

aGOswlru

Size

12KB

Virtual Size

12KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-08_73b60a8fb8f057899c2578f23e8fbb46_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

gdi32

advapi32

shell32

ole32

winhttp

msimg32

generic