2026-04-09_8d2da4b793a84d8478d5e3ea3ccded70_amadey_elex_glassworm_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-09_8d2da4b793a84d8478d5e3ea3ccded70_amadey_elex_glassworm_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop
Size 4.1MB
Sample260409-tcp83aew3j
SHA256 de9aa15039e11c60fec2922eb6ea2027abd5b2259fdf89d0bae6c48f0c090c2f
MD5 8d2da4b793a84d8478d5e3ea3ccded70
SHA1 add06bc81e792d9bf44db335e3661a76b6c0ec34
SHA512 9dc1266bc3a171679b24236c1e3dfd7cdcdad945f2378755cea71e1ad2e0d9c67fb86acf47fda80a1ab168e7f12c5ab4de1239056b04b42525f4811aa3856b65
SSDEEP 49152:vj7EVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblF+DJyzKb3HtFl7:PfnLrHp/qKm2/Sb/gqAZj+UzKb3HtF
TLSH
T1ED168C13EBC25AE5F68D05365B540200E73AEA51A64F1361306C226DDFE73878FA5A3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-09_8d2da4b793a84d8478d5e3ea3ccded70_amadey_elex_glassworm_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

File Explorer

2026-04-09_8d2da4b793a84d8478d5e3ea3ccded70_amadey_elex_glassworm_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

.exe 4.1MB

2026-04-09_8d2da4b793a84d8478d5e3ea3ccded70_amadey_elex_glassworm_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

IMPHASH 3ced25aef08debb1b64327bf79b9678c
SHA256 de9aa15039e11c60fec2922eb6ea2027abd5b2259fdf89d0bae6c48f0c090c2f
MD5 8d2da4b793a84d8478d5e3ea3ccded70
SHA1 add06bc81e792d9bf44db335e3661a76b6c0ec34
SHA512 9dc1266bc3a171679b24236c1e3dfd7cdcdad945f2378755cea71e1ad2e0d9c67fb86acf47fda80a1ab168e7f12c5ab4de1239056b04b42525f4811aa3856b65
SSDEEP 49152:vj7EVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblF+DJyzKb3HtFl7:PfnLrHp/qKm2/Sb/gqAZj+UzKb3HtF
TLSH
T1ED168C13EBC25AE5F68D05365B540200E73AEA51A64F1361306C226DDFE73878FA5A3F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31386

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA CreateSemaphoreW RequestWakeupLatency CreateFileA FindActCtxSectionStringW WriteConsoleInputW LoadModule WriteFile FindFirstVolumeMountPointA CreateDirectoryExW GlobalSize WaitForMultipleObjectsEx ReadConsoleInputW GetCurrentProcess FreeUserPhysicalPages WriteConsoleOutputAttribute DebugActiveProcessStop LCMapStringW GetProcAddress GlobalAlloc GetCommandLineW GetBinaryTypeA InterlockedExchange CreateMutexA GetConsoleTitleW SearchPathA FindResourceW FreeConsole EndUpdateResourceW GetLastError SetCommMask SetConsoleCursorInfo GetComputerNameExA GetConsoleAliasW WritePrivateProfileSectionW GlobalFlags GetConsoleAliasesLengthW FindResourceA SetVolumeMountPointA GetModuleHandleA HeapAlloc GetLocaleInfoA GetComputerNameA GetCurrentProcessId CreateNamedPipeW EnumResourceLanguagesA _hwrite CreateActCtxA DeleteVolumeMountPointA MoveFileWithProgressA AddRefActCtx WritePrivateProfileStringW GetUserDefaultLangID QueryMemoryResourceNotification WaitForMultipleObjects GetLongPathNameA InterlockedCompareExchange VerifyVersionInfoW EnumCalendarInfoW FindNextFileW EnumTimeFormatsW SetLastError GetConsoleAliasesLengthA SetCriticalSectionSpinCount TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException RtlUnwind HeapFree DeleteFileA GetStartupInfoW GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc SetFilePointer SetHandleCount GetStdHandle GetFileType GetStartupInfoA Sleep ExitProcess GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize InitializeCriticalSectionAndSpinCount SetStdHandle WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA MultiByteToWideChar GetStringTypeA GetStringTypeW WriteConsoleA GetConsoleOutputCP WriteConsoleW CloseHandle

user32

GetMenuBarInfo

Name

.text

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

167KB

Virtual Size

675KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

OdgyRzta

Size

3KB

Virtual Size

3KB

Characteristics

Name

aMsTvkmm

Size

2KB

Virtual Size

2KB

Characteristics

Name

IDrIFitW

Size

1024B

Virtual Size

668B

Characteristics

Name

IPOvCiQV

Size

28KB

Virtual Size

27KB

Characteristics

Name

JKvzvXKe

Size

3.6MB

Virtual Size

3.6MB

Characteristics

Name

YRtBCQoh

Size

89KB

Virtual Size

89KB

Characteristics

Name

dXwCsybo

Size

3KB

Virtual Size

3KB

Characteristics

Name

rzMFdafX

Size

10KB

Virtual Size

9KB

Characteristics

Name

ghPbUlah

Size

4KB

Virtual Size

4KB

Characteristics

Name

YFmLPAfp

Size

103KB

Virtual Size

103KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-09_8d2da4b793a84d8478d5e3ea3ccded70_amadey_elex_glassworm_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

kernel32

user32

generic