2026-04-09_99da86ddad332704d689d896668b5b6b_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-09_99da86ddad332704d689d896668b5b6b_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop
Size 5.0MB
Sample260409-wehm4sh12s
SHA256 8ff20e5224371db80ad020cf48d6d9e357741300dfbf63467d4d9268b3754a55
MD5 99da86ddad332704d689d896668b5b6b
SHA1 88cafd8ade001263e15a13e6442ad41b01f364e0
SHA512 fff0b721f75c66a678f9eb426e183f89fb259286f52f6587e239860eb60e5b3c794bdc3d92c139b8a446c492ee5a385ecb794cf53015e38cb3d6a0217518a17c
SSDEEP 98304:SarsxDceknLrHp/qKm2/Sb/gqAZj+UzKb3HtF:Sa4xsrRb/G8+H
TLSH
T180367A13EBC25AD5F3890536DF444200E72AF95996EB0361302C1159EFA7387BFA5A2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-09_99da86ddad332704d689d896668b5b6b_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-04-09_99da86ddad332704d689d896668b5b6b_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 5.0MB

2026-04-09_99da86ddad332704d689d896668b5b6b_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 44b1211815eb04dba3878a847875e976
SHA256 8ff20e5224371db80ad020cf48d6d9e357741300dfbf63467d4d9268b3754a55
MD5 99da86ddad332704d689d896668b5b6b
SHA1 88cafd8ade001263e15a13e6442ad41b01f364e0
SHA512 fff0b721f75c66a678f9eb426e183f89fb259286f52f6587e239860eb60e5b3c794bdc3d92c139b8a446c492ee5a385ecb794cf53015e38cb3d6a0217518a17c
SSDEEP 98304:SarsxDceknLrHp/qKm2/Sb/gqAZj+UzKb3HtF:Sa4xsrRb/G8+H
TLSH
T180367A13EBC25AD5F3890536DF444200E72AF95996EB0361302C1159EFA7387BFA5A2F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16675

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\xasaz29_leto\judor\yifiyeganeha\pibulagovuz\41 sacazoh_wob-29.pdb

kernel32

GetConsoleAliasesLengthW TlsGetValue SystemTimeToTzSpecificLocalTime EndUpdateResourceW InterlockedIncrement GetCurrentProcess CreateJobObjectW OpenSemaphoreA GetModuleHandleW GetTickCount GetWindowsDirectoryA EnumTimeFormatsW GlobalAlloc SetFileShortNameW GlobalFindAtomA Sleep AssignProcessToJobObject SizeofResource GetSystemWindowsDirectoryA FormatMessageW SetConsoleCursorPosition CreateFileW GetVolumePathNameA LCMapStringA FindFirstChangeNotificationW GetLastError SetLastError BackupRead GetProcAddress VirtualAlloc BeginUpdateResourceW EnumDateFormatsExA SetComputerNameA LoadLibraryA InterlockedExchangeAdd CreateFileMappingA FindFirstVolumeMountPointW HeapLock FoldStringW FindFirstVolumeMountPointA VirtualProtect GetVersionExA DeleteTimerQueueTimer GlobalAddAtomW ReadConsoleOutputCharacterW GetComputerNameA GetDateFormatW InterlockedExchange GetFullPathNameW CreateFileA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter ExitProcess GetCommandLineA GetStartupInfoA WriteFile GetStdHandle GetModuleFileNameA TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement HeapSize EnterCriticalSection LeaveCriticalSection TerminateProcess IsDebuggerPresent HeapFree DeleteCriticalSection InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc HeapReAlloc RtlUnwind GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringW GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer RaiseException

user32

GetWindowTextLengthW

gdi32

SetDeviceGammaRamp

advapi32

ReadEventLogA

shell32

ShellAboutW

ole32

CoRegisterPSClsid

winhttp

WinHttpCheckPlatform

msimg32

AlphaBlend

Name

.text

Size

872KB

Virtual Size

871KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

mVeMsran

Size

68KB

Virtual Size

68KB

Characteristics

Name

BxXWZrlf

Size

2KB

Virtual Size

2KB

Characteristics

Name

vEHXVDzQ

Size

1024B

Virtual Size

675B

Characteristics

Name

QwfcasMu

Size

54KB

Virtual Size

54KB

Characteristics

Name

zWXILiIu

Size

3.7MB

Virtual Size

3.7MB

Characteristics

Name

raAPlypd

Size

181KB

Virtual Size

181KB

Characteristics

Name

JsEXJACv

Size

4KB

Virtual Size

4KB

Characteristics

Name

JSWDiCgf

Size

10KB

Virtual Size

10KB

Characteristics

Name

opoDuzNW

Size

2KB

Virtual Size

2KB

Characteristics

Name

oXtykQde

Size

3KB

Virtual Size

3KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-09_99da86ddad332704d689d896668b5b6b_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

winhttp

msimg32

generic