General
- Target 2026-04-09_8c2faa9549a4b6becff8a7a10fda37ce_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_tofsee
- Size 1.4MB
- Sample260409-vh1seshs2t
- SHA256 6e5c2665a17849472393ae5148fe8bf0d03013f4ee3ee6fadc0ec0fca58f7df5
- MD5 8c2faa9549a4b6becff8a7a10fda37ce
- SHA1 767f7cde9ddc61a99b940e4d4f77e5e47acffb28
- SHA512 0dcb690824eaa65ffef996b74bb3d45d23d5e355063afa45c66791579a5b72442850ccec49228bd511808df71902af18d87daac3528204bfdb45755abb74fd28
- SSDEEP 12288:GWaQ/948Z1+ier5+nBL1RA1YaL8i0DMUNLtG4+tbQIzKYZLw:LO8ZNAVDKUTbQIzFLw
- TLSH T1C765F657EB914AE8F65D08376B584250DB2EF221A65F2350786C420CCF9738B8FA5E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-09_8c2faa9549a4b6becff8a7a10fda37ce_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_tofsee.exe
Resource
win10v2004-20260130-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-09_8c2faa9549a4b6becff8a7a10fda37ce_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_tofsee.exe
Resource
win11-20260130-en
11 signatures
150 seconds
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
pub3
Extracted
Family
-
smokeloader
Version
-
2022
C2
-
http://sjyey.com/tmp/index.php
-
http://babonwo.ru/tmp/index.php
-
http://mth.com.ua/tmp/index.php
-
http://piratia.pw/tmp/index.php
-
http://go-piratia.ru/tmp/index.php
rc4.i32
rc4.i32
Targets
-
- Target 2026-04-09_8c2faa9549a4b6becff8a7a10fda37ce_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_tofsee
- Size 1.4MB
- SHA256 6e5c2665a17849472393ae5148fe8bf0d03013f4ee3ee6fadc0ec0fca58f7df5
- MD5 8c2faa9549a4b6becff8a7a10fda37ce
- SHA1 767f7cde9ddc61a99b940e4d4f77e5e47acffb28
- SHA512 0dcb690824eaa65ffef996b74bb3d45d23d5e355063afa45c66791579a5b72442850ccec49228bd511808df71902af18d87daac3528204bfdb45755abb74fd28
- SSDEEP 12288:GWaQ/948Z1+ier5+nBL1RA1YaL8i0DMUNLtG4+tbQIzKYZLw:LO8ZNAVDKUTbQIzFLw
- TLSH T1C765F657EB914AE8F65D08376B584250DB2EF221A65F2350786C420CCF9738B8FA5E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Smokeloader family
-
Deletes itself