2026-04-09_007a9c4bd5ba180bb891901644300d56_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-09_007a9c4bd5ba180bb891901644300d56_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop
Size 2.0MB
Sample260409-txps2ags2z
SHA256 9c77a7be7d4d3ad3b39d215615b53575c958e1af604159f8db28fa3e0761a15e
MD5 007a9c4bd5ba180bb891901644300d56
SHA1 90068f188b2d0ebe5be278769f7673372b2ba6da
SHA512 fb6e268e9002ab27b219fc37e894e022425647f5b8c043c4c1b47595e478a6c01ce5f2f76040474dc51c99eed2e9d8c31afd2a05fc1038032ee3ca5549771492
SSDEEP 24576:BDV1WxOT1dJrEmsjJk8A0dsGiAhoAHsaLFZhgjNAVDp:BBYxO5bE5jJvhrHxFHgmV
TLSH
T161A55957EB815AD8E69D09376F584150E72EF2219A8F2320342C461DCF9339B8F66E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-09_007a9c4bd5ba180bb891901644300d56_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-04-09_007a9c4bd5ba180bb891901644300d56_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 2.0MB

2026-04-09_007a9c4bd5ba180bb891901644300d56_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 44b1211815eb04dba3878a847875e976
SHA256 9c77a7be7d4d3ad3b39d215615b53575c958e1af604159f8db28fa3e0761a15e
MD5 007a9c4bd5ba180bb891901644300d56
SHA1 90068f188b2d0ebe5be278769f7673372b2ba6da
SHA512 fb6e268e9002ab27b219fc37e894e022425647f5b8c043c4c1b47595e478a6c01ce5f2f76040474dc51c99eed2e9d8c31afd2a05fc1038032ee3ca5549771492
SSDEEP 24576:BDV1WxOT1dJrEmsjJk8A0dsGiAhoAHsaLFZhgjNAVDp:BBYxO5bE5jJvhrHxFHgmV
TLSH
T161A55957EB815AD8E69D09376F584150E72EF2219A8F2320342C461DCF9339B8F66E3D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16675

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bojay-kiligam.pdb

kernel32

GetConsoleAliasesLengthW TlsGetValue SystemTimeToTzSpecificLocalTime EndUpdateResourceW InterlockedIncrement GetCurrentProcess CreateJobObjectW OpenSemaphoreA GetModuleHandleW GetTickCount GetWindowsDirectoryA EnumTimeFormatsW GlobalAlloc SetFileShortNameW GlobalFindAtomA Sleep AssignProcessToJobObject SizeofResource GetSystemWindowsDirectoryA FormatMessageW SetConsoleCursorPosition CreateFileW GetVolumePathNameA LCMapStringA FindFirstChangeNotificationW GetLastError SetLastError BackupRead GetProcAddress VirtualAlloc BeginUpdateResourceW EnumDateFormatsExA SetComputerNameA LoadLibraryA InterlockedExchangeAdd CreateFileMappingA FindFirstVolumeMountPointW HeapLock FoldStringW FindFirstVolumeMountPointA VirtualProtect GetVersionExA DeleteTimerQueueTimer GlobalAddAtomW ReadConsoleOutputCharacterW GetComputerNameA GetDateFormatW InterlockedExchange GetFullPathNameW CreateFileA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter ExitProcess GetCommandLineA GetStartupInfoA WriteFile GetStdHandle GetModuleFileNameA TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement HeapSize EnterCriticalSection LeaveCriticalSection TerminateProcess IsDebuggerPresent HeapFree DeleteCriticalSection InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc HeapReAlloc RtlUnwind GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringW GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer RaiseException

user32

GetWindowTextLengthW

gdi32

SetDeviceGammaRamp

advapi32

ReadEventLogA

shell32

ShellAboutW

ole32

CoRegisterPSClsid

winhttp

WinHttpCheckPlatform

msimg32

AlphaBlend

Name

.text

Size

872KB

Virtual Size

871KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

KdwZYPdM

Size

11KB

Virtual Size

11KB

Characteristics

Name

TaXjPvPq

Size

2KB

Virtual Size

1KB

Characteristics

Name

VaCRfpeU

Size

4KB

Virtual Size

4KB

Characteristics

Name

iifRRPbC

Size

139KB

Virtual Size

138KB

Characteristics

Name

UgNDGAiy

Size

833KB

Virtual Size

832KB

Characteristics

Name

KkDZsZRi

Size

119KB

Virtual Size

119KB

Characteristics

Name

mQOLLvbz

Size

512B

Virtual Size

110B

Characteristics

Name

stysNbiR

Size

7KB

Virtual Size

6KB

Characteristics

Name

NkmbUYem

Size

2KB

Virtual Size

1KB

Characteristics

Name

MuVXldZa

Size

3KB

Virtual Size

3KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-09_007a9c4bd5ba180bb891901644300d56_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

winhttp

msimg32

generic