2026-04-09_c8920ea146ec2bb901e8c9c84a1e6a63_amadey_elex_glassworm_remcos_rhadamanthys_smoke-loader_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-09_c8920ea146ec2bb901e8c9c84a1e6a63_amadey_elex_glassworm_remcos_rhadamanthys_smoke-loader_stop_tofsee
Size 1.1MB
Sample260409-thygmafv7s
SHA256 93a010946bbe45c61930bb688555aaaff51d0770e2d7514015d8b6bd04ffa51e
MD5 c8920ea146ec2bb901e8c9c84a1e6a63
SHA1 5c763004492c776a546c4ad3bd8349b433eb395b
SHA512 2a84ac6c6d1887ef728ee9165ef05d4db0a57cb77f61319a8062bfa4c03bf0b36581ffea6d4a699dc8273da1344f3328025f1555386ce5d7854cbde7ebe06fb1
SSDEEP 12288:Kz9p6NFAqXTFeNbML1kA1YaL8i09er5+n:KRpgBjFe5LAV
TLSH
T11D35C357EB818AE8E75D09766F584150972EF221AB4F6350386C520DDF8338B8FA1E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-09_c8920ea146ec2bb901e8c9c84a1e6a63_amadey_elex_glassworm_remcos_rhadamanthys_smoke-loader_stop_tofsee

File Explorer

2026-04-09_c8920ea146ec2bb901e8c9c84a1e6a63_amadey_elex_glassworm_remcos_rhadamanthys_smoke-loader_stop_tofsee

.exe 1.1MB

2026-04-09_c8920ea146ec2bb901e8c9c84a1e6a63_amadey_elex_glassworm_remcos_rhadamanthys_smoke-loader_stop_tofsee

IMPHASH a47515f9ebd7f251f383b85609098a78
SHA256 93a010946bbe45c61930bb688555aaaff51d0770e2d7514015d8b6bd04ffa51e
MD5 c8920ea146ec2bb901e8c9c84a1e6a63
SHA1 5c763004492c776a546c4ad3bd8349b433eb395b
SHA512 2a84ac6c6d1887ef728ee9165ef05d4db0a57cb77f61319a8062bfa4c03bf0b36581ffea6d4a699dc8273da1344f3328025f1555386ce5d7854cbde7ebe06fb1
SSDEEP 12288:Kz9p6NFAqXTFeNbML1kA1YaL8i09er5+n:KRpgBjFe5LAV
TLSH
T11D35C357EB818AE8E75D09766F584150972EF221AB4F6350386C520DDF8338B8FA1E3D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35548

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA RequestWakeupLatency CreateFileW FindActCtxSectionStringW WriteConsoleInputW GetCPInfoExA GetWindowsDirectoryW FindFirstVolumeMountPointA CreateDirectoryExA LocalFlags WaitForMultipleObjects ReadConsoleInputA FindNextVolumeMountPointW VerifyVersionInfoW GetVersionExA GetProcessId OpenEventA CreateFileMappingW GetLocaleInfoW GetProcAddress LocalAlloc GetCommandLineW GetUserDefaultLCID OpenMutexW GetConsoleTitleA SearchPathW FindResourceA LoadLibraryW GetPriorityClass GetLastError GetProfileSectionA WriteProfileStringA GetConsoleAliasW WritePrivateProfileSectionW GlobalFlags GetConsoleAliasesLengthA DeleteVolumeMountPointW FindResourceW SetVolumeMountPointA HeapAlloc GetComputerNameA GetCurrentProcessId CreateNamedPipeA EnumResourceLanguagesW TransactNamedPipe _hwrite EnumTimeFormatsW ZombifyActCtx DeleteVolumeMountPointA GetModuleHandleA ReleaseActCtx WritePrivateProfileStringA GetSystemDirectoryA GetSystemPowerStatus SetThreadAffinityMask GetLongPathNameA EnumTimeFormatsA VerifyVersionInfoA EnumCalendarInfoA FindNextFileA SetLastError SetCriticalSectionSpinCount WriteConsoleW CloseHandle RaiseException RtlUnwind HeapFree DeleteFileA HeapSetInformation GetStartupInfoW EncodePointer DecodePointer IsProcessorFeaturePresent TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetModuleHandleW GetCurrentThreadId InterlockedDecrement GetCPInfo GetACP GetOEMCP IsValidCodePage UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapCreate EnterCriticalSection LeaveCriticalSection ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime Sleep HeapSize WideCharToMultiByte LCMapStringW MultiByteToWideChar GetStringTypeW HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile SetFilePointer SetStdHandle

user32

GetComboBoxInfo

Name

.text

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

78KB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

WFtzmQvI

Size

27KB

Virtual Size

26KB

Characteristics

Name

IsuxXQaM

Size

4KB

Virtual Size

3KB

Characteristics

Name

uXzpQCeX

Size

4KB

Virtual Size

4KB

Characteristics

Name

cDnuVUJW

Size

65KB

Virtual Size

65KB

Characteristics

Name

VjRHuQDv

Size

708KB

Virtual Size

708KB

Characteristics

Name

FjWCqhKA

Size

28KB

Virtual Size

28KB

Characteristics

Name

CKeclNcK

Size

1KB

Virtual Size

1KB

Characteristics

Name

EYJeiFqu

Size

24KB

Virtual Size

23KB

Characteristics

Name

WkQpGEWh

Size

3KB

Virtual Size

3KB

Characteristics

Name

vaauwYlF

Size

70KB

Virtual Size

69KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-09_c8920ea146ec2bb901e8c9c84a1e6a63_amadey_elex_glassworm_remcos_rhadamanthys_smoke-loader_stop_tofsee

kernel32

user32

generic