2026-04-09_45eb03148a5eb4699d8652d05b65af26_amadey_elex_glassworm_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-09_45eb03148a5eb4699d8652d05b65af26_amadey_elex_glassworm_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 1.5MB
Sample260409-bb7slsgv9k
SHA256 54b222025632f43a4094f74ae9fd73decadf49e0a99443fcd7880c85140407d6
MD5 45eb03148a5eb4699d8652d05b65af26
SHA1 37760c32d599daf5f89b1696d1ea7dcf63322138
SHA512 4f04afb3cb8313031c70a0e42bccba598acbdbf6699ecf01b2971ef0d7f13d8a7bf1e028de9c6bab4c9c9aced7a28653ed6cf16c0b0d5834a5d165bf8552c231
SSDEEP 12288:f62Nb/Vl0jaoer5+nZokL1Jer5+nvA1YaL8i0DMUNLtGjmer5+nIwaJ3er5+n:f60GakLAVDKUb
TLSH
T1DB65F557EB926ED8E65D09365F684150D72EF2229A4F2320346C520DCF9339B8F62E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-09_45eb03148a5eb4699d8652d05b65af26_amadey_elex_glassworm_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-04-09_45eb03148a5eb4699d8652d05b65af26_amadey_elex_glassworm_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 1.5MB

2026-04-09_45eb03148a5eb4699d8652d05b65af26_amadey_elex_glassworm_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH c5c445b50fcdfbfd65e18ac43adc31c9
SHA256 54b222025632f43a4094f74ae9fd73decadf49e0a99443fcd7880c85140407d6
MD5 45eb03148a5eb4699d8652d05b65af26
SHA1 37760c32d599daf5f89b1696d1ea7dcf63322138
SHA512 4f04afb3cb8313031c70a0e42bccba598acbdbf6699ecf01b2971ef0d7f13d8a7bf1e028de9c6bab4c9c9aced7a28653ed6cf16c0b0d5834a5d165bf8552c231
SSDEEP 12288:f62Nb/Vl0jaoer5+nZokL1Jer5+nvA1YaL8i0DMUNLtGjmer5+nIwaJ3er5+n:f60GakLAVDKUb
TLSH
T1DB65F557EB926ED8E65D09365F684150D72EF2229A4F2320346C520DCF9339B8F62E3D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16403

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\pemabilelux78\fijuri\gihopihasonu-homiv68\luv\vexaxes\buk.pdb

kernel32

GetNativeSystemInfo FindFirstChangeNotificationW TlsGetValue SystemTimeToTzSpecificLocalTime GlobalAddAtomA EndUpdateResourceW InterlockedIncrement GetCurrentProcess CreateJobObjectW SetComputerNameW GetComputerNameW OpenSemaphoreA GetModuleHandleW GetTickCount GetConsoleAliasesLengthA GetWindowsDirectoryA EnumTimeFormatsW GlobalAlloc SetFileShortNameW GlobalFindAtomA Sleep SizeofResource GetConsoleAliasExesLengthW FormatMessageW GetDateFormatW CreateFileW LCMapStringA InterlockedExchange GetLastError SetLastError BackupRead GetProcAddress VirtualAlloc BeginUpdateResourceW EnumDateFormatsExA LoadLibraryA InterlockedExchangeAdd CreateFileMappingW FindFirstVolumeMountPointW HeapLock FoldStringA FindFirstVolumeMountPointA VirtualProtect GetVersionExA TerminateJobObject DeleteTimerQueueTimer ReadConsoleOutputCharacterW SetConsoleCursorPosition GetFullPathNameW UnhandledExceptionFilter SetUnhandledExceptionFilter ExitProcess GetCommandLineA GetStartupInfoA WriteFile GetStdHandle GetModuleFileNameA TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement HeapSize EnterCriticalSection LeaveCriticalSection TerminateProcess IsDebuggerPresent HeapFree DeleteCriticalSection InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc HeapReAlloc RtlUnwind GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringW GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA RaiseException

gdi32

SetDeviceGammaRamp

Name

.text

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PoKNZEYj

Size

111KB

Virtual Size

110KB

Characteristics

Name

mrniWfGS

Size

3KB

Virtual Size

2KB

Characteristics

Name

SQojOGXw

Size

4KB

Virtual Size

4KB

Characteristics

Name

UcSmzRax

Size

94KB

Virtual Size

93KB

Characteristics

Name

DpJOTklR

Size

888KB

Virtual Size

888KB

Characteristics

Name

zGoixFvz

Size

101KB

Virtual Size

101KB

Characteristics

Name

ZpWpCGBm

Size

4KB

Virtual Size

3KB

Characteristics

Name

UWBkShtM

Size

60KB

Virtual Size

59KB

Characteristics

Name

rxxnQfIX

Size

4KB

Virtual Size

3KB

Characteristics

Name

XZiUKAEh

Size

3KB

Virtual Size

2KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-09_45eb03148a5eb4699d8652d05b65af26_amadey_elex_glassworm_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

gdi32

generic