General
- Target 2026-04-11_0b8923acc14dda9d8d5994402eced4a7_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc
- Size 1.5MB
- Sample260411-ry6rtsbt2l
- SHA256 345f433fd2c0de909ebf274c72c0a3b6ac8bcf1549dcdb2b54c3503c7ad72d1d
- MD5 0b8923acc14dda9d8d5994402eced4a7
- SHA1 5cb2e23bd5c12d536fb1c4364a427e43c7b2ca0c
- SHA512 17f41dd3dd068a4604936f0bd8df36b59166b78d33aa15c86fefa6ca18b8b4f53169f7808524f468ad496ac8d8338b7e6a77839679626026a9b0a26c0b36baae
- SSDEEP 12288:UGE8u/0MB2Extq7z9Cer5+nzL1hA1YaL8i0DM2mer5+nIwaJ:msMB2EOKAVDW
- TLSH T1EF656E57EB814AD9E78D0936DF5481509B2AF22997FF2220345802CDEE53387BF61A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-11_0b8923acc14dda9d8d5994402eced4a7_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
Resource
win10v2004-20260130-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-11_0b8923acc14dda9d8d5994402eced4a7_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
Resource
win11-20260130-en
13 signatures
150 seconds
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
lab
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-file-host6.com/
-
http://host-host-file8.com/
rc4.i32
rc4.i32
Targets
-
- Target 2026-04-11_0b8923acc14dda9d8d5994402eced4a7_amadey_elex_glassworm_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc
- Size 1.5MB
- SHA256 345f433fd2c0de909ebf274c72c0a3b6ac8bcf1549dcdb2b54c3503c7ad72d1d
- MD5 0b8923acc14dda9d8d5994402eced4a7
- SHA1 5cb2e23bd5c12d536fb1c4364a427e43c7b2ca0c
- SHA512 17f41dd3dd068a4604936f0bd8df36b59166b78d33aa15c86fefa6ca18b8b4f53169f7808524f468ad496ac8d8338b7e6a77839679626026a9b0a26c0b36baae
- SSDEEP 12288:UGE8u/0MB2Extq7z9Cer5+nzL1hA1YaL8i0DM2mer5+nIwaJ:msMB2EOKAVDW
- TLSH T1EF656E57EB814AD9E78D0936DF5481509B2AF22997FF2220345802CDEE53387BF61A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Smokeloader family
-
Deletes itself
-
Suspicious use of SetThreadContext