2026-04-09_69d3feb235184e6071471814ae061b18_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-09_69d3feb235184e6071471814ae061b18_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_tofsee
Size 3.7MB
Sample260409-sdw8bsdt9w
SHA256 1158c27a5b380c3a9af29f6ef1596d1fbbbfd031853edb39973fb59d242c1eed
MD5 69d3feb235184e6071471814ae061b18
SHA1 5f564d0a3b94ece4f81eb72d7c9a02abddccc4a7
SHA512 db18bc4b527a822a0acc584b52f30d03d85103409afccb40f15ca2f918cf27d92fb2dacfab427a51fb08266c50eb8d4d21776062f5e8f4826b85de96d0b56e71
SSDEEP 98304:YzhTg3+nLX+lPYnLrHp/qKm2/Sb/gqAZ:+Fr+lWrRb/G
TLSH
T16306AE53EBD24AE8F79D05365B584140D72EE922AA4F1361346C220DDFA73878F61E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-09_69d3feb235184e6071471814ae061b18_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-04-09_69d3feb235184e6071471814ae061b18_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_tofsee

.exe 3.7MB

2026-04-09_69d3feb235184e6071471814ae061b18_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH 8ed70045ac6ef5b241edfff82b56695b
SHA256 1158c27a5b380c3a9af29f6ef1596d1fbbbfd031853edb39973fb59d242c1eed
MD5 69d3feb235184e6071471814ae061b18
SHA1 5f564d0a3b94ece4f81eb72d7c9a02abddccc4a7
SHA512 db18bc4b527a822a0acc584b52f30d03d85103409afccb40f15ca2f918cf27d92fb2dacfab427a51fb08266c50eb8d4d21776062f5e8f4826b85de96d0b56e71
SSDEEP 98304:YzhTg3+nLX+lPYnLrHp/qKm2/Sb/gqAZ:+Fr+lWrRb/G
TLSH
T16306AE53EBD24AE8F79D05365B584140D72EE922AA4F1361346C220DDFA73878F61E3E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22214

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DebugActiveProcess GlobalFix SetDefaultCommConfigA RemoveVectoredExceptionHandler FindFirstFileW FindFirstChangeNotificationW WriteConsoleInputW WriteConsoleOutputCharacterW lstrlenA GetModuleHandleExA GetConsoleAliasExesA AllocConsole IsBadHugeReadPtr GetProcessIoCounters MapUserPhysicalPages WaitNamedPipeA ZombifyActCtx SetHandleInformation SetConsoleScreenBufferSize WriteConsoleInputA AddConsoleAliasW GetNumaAvailableMemoryNode OpenSemaphoreA GetSystemDefaultLCID MoveFileWithProgressA GenerateConsoleCtrlEvent FindNextVolumeMountPointA GetConsoleAliasesA ReadConsoleW GetWindowsDirectoryA SetCommState GetDriveTypeA GetEnvironmentStrings GlobalAlloc AddRefActCtx GetVolumeInformationA LoadLibraryW CopyFileW _hread CreateEventA GetExitCodeProcess TransactNamedPipe GetConsoleAliasW GetFileAttributesW ReplaceFileW GetCompressedFileSizeA lstrcatA lstrlenW FindNextVolumeMountPointW GetStartupInfoW GetTempPathW GetShortPathNameA GetNamedPipeHandleStateW GetStartupInfoA GetLastError SetLastError ReadConsoleOutputCharacterA CreateConsoleScreenBuffer CreateNamedPipeA EnumSystemCodePagesW SetStdHandle VerLanguageNameW OpenWaitableTimerA UnhandledExceptionFilter AddAtomW RemoveDirectoryW FoldStringW FindNextFileA GetModuleHandleA FatalExit FindNextFileW VirtualProtect GetCurrentDirectoryA CompareStringA GetFileTime QueryPerformanceFrequency SetProcessShutdownParameters FindAtomW GetVolumeNameForVolumeMountPointW DeleteFileW ResetWriteWatch GetSystemTime EnumSystemLocalesW lstrcpyW AreFileApisANSI WriteConsoleW SetFilePointer WideCharToMultiByte HeapAlloc DeleteFileA HeapReAlloc GetCommandLineW HeapSetInformation GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue DecodePointer TlsFree GetModuleHandleW GetCurrentThreadId GetProcAddress SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent ExitProcess WriteFile GetStdHandle GetModuleFileNameW HeapCreate EnterCriticalSection LeaveCriticalSection HeapFree CloseHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW MultiByteToWideChar GetStringTypeW Sleep RaiseException RtlUnwind GetConsoleCP GetConsoleMode FlushFileBuffers HeapSize CreateFileW

user32

CharUpperW

winhttp

WinHttpReadData

Name

.text

Size

656KB

Virtual Size

656KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

OpXSTURv

Size

41KB

Virtual Size

41KB

Characteristics

Name

DlUkkyWI

Size

2KB

Virtual Size

2KB

Characteristics

Name

rhBZQlcR

Size

512B

Virtual Size

487B

Characteristics

Name

ulNsfUex

Size

73KB

Virtual Size

73KB

Characteristics

Name

qjpxQQOS

Size

2.7MB

Virtual Size

2.7MB

Characteristics

Name

gRzmOYYS

Size

30KB

Virtual Size

29KB

Characteristics

Name

DlqMkhrq

Size

3KB

Virtual Size

2KB

Characteristics

Name

pEgKsrNt

Size

33KB

Virtual Size

33KB

Characteristics

Name

kccFhYAr

Size

2KB

Virtual Size

1KB

Characteristics

Name

dOsbDwpe

Size

122KB

Virtual Size

122KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-09_69d3feb235184e6071471814ae061b18_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_tofsee

kernel32

user32

winhttp

generic