2026-04-09_9829ff83bf31f03291c9e8fa380b59eb_amadey_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-09_9829ff83bf31f03291c9e8fa380b59eb_amadey_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee
Size 1008KB
Sample260409-c2c7csht3j
SHA256 396900453f4fdce70634c625be2e743696f0d4993fc15935d0058f9f8342ee48
MD5 9829ff83bf31f03291c9e8fa380b59eb
SHA1 0ccd7b078736875b4ebf7b5db3b749e8f2d04937
SHA512 957f8479f7cfa4405aaf2feab66528b1bf7dd24d905f9546507199d53f6878acad74edaaaa5ce1e5855f72e2906759ae231ed6256556eaa70c4f32eac4b1028d
SSDEEP 6144:ItnLdPN4ff33DtGKTc3OL4IFcv89/drLHgDe7eVvaDtZV7+TgK0z/MPFPvWi0qeF:qnBPN4ff33pGKJL1cA1YaL8cmer5+n
TLSH
T17025B4A7EB925AE8E68D44776F584140D72EF221A64F6310796C021DCF8738B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-09_9829ff83bf31f03291c9e8fa380b59eb_amadey_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

File Explorer

2026-04-09_9829ff83bf31f03291c9e8fa380b59eb_amadey_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

.exe 1008KB

2026-04-09_9829ff83bf31f03291c9e8fa380b59eb_amadey_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

IMPHASH 0cf7da7ba6041e7b7038cd2e90d72093
SHA256 396900453f4fdce70634c625be2e743696f0d4993fc15935d0058f9f8342ee48
MD5 9829ff83bf31f03291c9e8fa380b59eb
SHA1 0ccd7b078736875b4ebf7b5db3b749e8f2d04937
SHA512 957f8479f7cfa4405aaf2feab66528b1bf7dd24d905f9546507199d53f6878acad74edaaaa5ce1e5855f72e2906759ae231ed6256556eaa70c4f32eac4b1028d
SSDEEP 6144:ItnLdPN4ff33DtGKTc3OL4IFcv89/drLHgDe7eVvaDtZV7+TgK0z/MPFPvWi0qeF:qnBPN4ff33pGKJL1cA1YaL8cmer5+n
TLSH
T17025B4A7EB925AE8E68D44776F584140D72EF221A64F6310796C021DCF8738B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23510

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA CreateFileA FileTimeToLocalFileTime FindActCtxSectionStringW GetCommModemStatus GetSystemWindowsDirectoryA GlobalHandle FindFirstVolumeMountPointW CreateDirectoryExW GlobalSize GetLogicalDriveStringsW ReadConsoleInputA GetComputerNameExA GetTempPathW GetCurrentDirectoryA WaitForDebugEvent LCMapStringW GetProcAddress GlobalAlloc GetCommandLineW GetBinaryTypeA InterlockedExchange ReadConsoleOutputCharacterA CreateMutexA GetConsoleTitleW SearchPathW ExpandEnvironmentStringsW FindResourceA GetLastError LoadLibraryW GetCommMask LocalReAlloc GetComputerNameExW GetConsoleAliasW TerminateThread GlobalFlags GetConsoleAliasesLengthA DeleteVolumeMountPointA GetVolumePathNameW SetVolumeMountPointA lstrcmpA DeleteTimerQueueTimer GetLocaleInfoA GetComputerNameA lstrcpynW SetConsoleTextAttribute CopyFileW FileTimeToDosDateTime QueryDosDeviceA CreateActCtxA DeleteVolumeMountPointW MoveFileWithProgressW AddRefActCtx FoldStringW WritePrivateProfileStringW GetUserDefaultLangID SetConsoleDisplayMode WaitForSingleObject WritePrivateProfileStructA InterlockedExchangeAdd EnumTimeFormatsA VerifyVersionInfoW FindNextFileA GetConsoleAliasA SetLastError FreeLibraryAndExitThread CloseHandle MoveFileA GetStartupInfoW GetModuleHandleA EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW Sleep ExitProcess WriteFile GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount RtlUnwind MultiByteToWideChar HeapAlloc VirtualAlloc HeapReAlloc LCMapStringA GetStringTypeA GetStringTypeW RaiseException FlushFileBuffers SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW ReadFile HeapSize DeleteFileA

user32

GetMessageTime

msimg32

TransparentBlt

Name

.text

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

78KB

Virtual Size

39.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

hDEiBYrI

Size

4KB

Virtual Size

3KB

Characteristics

Name

QdniSQHu

Size

2KB

Virtual Size

1KB

Characteristics

Name

LNkyVJEs

Size

4KB

Virtual Size

4KB

Characteristics

Name

tWnaeCEk

Size

52KB

Virtual Size

52KB

Characteristics

Name

VaTSUsJy

Size

629KB

Virtual Size

628KB

Characteristics

Name

YodrbIVl

Size

70KB

Virtual Size

70KB

Characteristics

Name

cVqXipQU

Size

4KB

Virtual Size

3KB

Characteristics

Name

ZiavosLy

Size

3KB

Virtual Size

2KB

Characteristics

Name

YTVyZKLh

Size

2KB

Virtual Size

1KB

Characteristics

Name

xteAjLsC

Size

34KB

Virtual Size

34KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-09_9829ff83bf31f03291c9e8fa380b59eb_amadey_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

kernel32

user32

msimg32

generic