2026-04-11_30e1414a96aba07c94eee7784ae8b102_amadey_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-11_30e1414a96aba07c94eee7784ae8b102_amadey_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 1.3MB
Sample260411-sebysaew6v
SHA256 3a49e18c3d236a6a6bcc6d665953ce3b94284a6128cfdaa442ce101260cd031d
MD5 30e1414a96aba07c94eee7784ae8b102
SHA1 344848af4198afce873288823e388c5316584f99
SHA512 34628d770b22f56611fc8648bb5ccad5f8a2490780a4f477b11c3f16aa01b296f9c69974c1dc4c5eca46d342f4ba975cd9b703da25913cf75110682e90224de3
SSDEEP 12288:M4kuG3ukpgsOxpGL1+A1YaL8i0DMUNLtte:Qn3ukpsLHAVDK
TLSH
T1CC55C353EB929AD9E64D08776F584150E62EF621AB4F2350382C525CCF9338B8F61E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-11_30e1414a96aba07c94eee7784ae8b102_amadey_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-04-11_30e1414a96aba07c94eee7784ae8b102_amadey_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 1.3MB

2026-04-11_30e1414a96aba07c94eee7784ae8b102_amadey_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 7ec7f49ed6c361cf3d1f933afdd59bc5
SHA256 3a49e18c3d236a6a6bcc6d665953ce3b94284a6128cfdaa442ce101260cd031d
MD5 30e1414a96aba07c94eee7784ae8b102
SHA1 344848af4198afce873288823e388c5316584f99
SHA512 34628d770b22f56611fc8648bb5ccad5f8a2490780a4f477b11c3f16aa01b296f9c69974c1dc4c5eca46d342f4ba975cd9b703da25913cf75110682e90224de3
SSDEEP 12288:M4kuG3ukpgsOxpGL1+A1YaL8i0DMUNLtte:Qn3ukpsLHAVDK
TLSH
T1CC55C353EB929AD9E64D08776F584150E62EF621AB4F2350382C525CCF9338B8F61E3D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\yola\gojevujepipe\cetorew.pdb

kernel32

LoadLibraryW CallNamedPipeW EnumSystemCodePagesW EnumDateFormatsA OpenMutexA GetConsoleAliasesLengthA CompareStringA AreFileApisANSI CreateFileW EnumCalendarInfoExA RequestWakeupLatency GetConsoleAliasA CreateFileA SetComputerNameA GetSystemWindowsDirectoryA GetModuleHandleA GlobalUnlock FindFirstVolumeMountPointW CreateDirectoryExW GetLogicalDriveStringsA ReadConsoleInputA FindNextVolumeMountPointW SearchPathW MoveFileW CallNamedPipeA GetCurrentDirectoryW GetDriveTypeW CreateMailslotA CommConfigDialogW GetProcAddress LocalAlloc CancelTimerQueueTimer SetHandleInformation CreateJobObjectW WriteConsoleOutputAttribute FindFirstVolumeA LocalFlags InterlockedIncrement DuplicateHandle GetTickCount BackupSeek GetSystemDirectoryA VerSetConditionMask GetComputerNameW EnumSystemLocalesW InterlockedFlushSList WritePrivateProfileSectionW WritePrivateProfileStructA GetStringTypeExW GetPrivateProfileSectionNamesW GetFileAttributesW TransactNamedPipe ActivateActCtx SearchPathA CopyFileA GetComputerNameExW GetVolumePathNameA GetShortPathNameW ReadFile ResetEvent LocalShrink LocalLock GlobalUnfix SetCommState WriteConsoleInputW DeleteAtom FindResourceW GetConsoleSelectionInfo GetOverlappedResult GetPrivateProfileStructA ConvertThreadToFiber InterlockedCompareExchange InterlockedExchangeAdd EnumCalendarInfoW GetConsoleMode EnumCalendarInfoA GetConsoleAliasExesLengthA InterlockedDecrement GetModuleHandleW ZombifyActCtx SetConsoleCtrlHandler AddAtomA GetThreadPriority FreeEnvironmentStringsW InterlockedExchange GetConsoleTitleW SetVolumeMountPointA ClearCommError lstrlenA CreateDirectoryExA GlobalFindAtomA TerminateJobObject lstrcpynA HeapAlloc GetLastError DeleteFileA GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapFree VirtualFree VirtualAlloc HeapReAlloc HeapCreate Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapSize GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage RaiseException InitializeCriticalSectionAndSpinCount RtlUnwind LoadLibraryA WideCharToMultiByte LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleCP FlushFileBuffers SetFilePointer CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle

Name

.text

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

67KB

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

xjYCWQfn

Size

5KB

Virtual Size

5KB

Characteristics

Name

NWdKBOhr

Size

1024B

Virtual Size

840B

Characteristics

Name

rzDSbWrx

Size

1024B

Virtual Size

1017B

Characteristics

Name

nZsZdypo

Size

55KB

Virtual Size

55KB

Characteristics

Name

ZvVKipkb

Size

884KB

Virtual Size

883KB

Characteristics

Name

pwtqyOSR

Size

37KB

Virtual Size

37KB

Characteristics

Name

JHXHkygC

Size

4KB

Virtual Size

3KB

Characteristics

Name

cGGFICTr

Size

50KB

Virtual Size

50KB

Characteristics

Name

pyilDJLW

Size

2KB

Virtual Size

1KB

Characteristics

Name

DaIUbwgQ

Size

26KB

Virtual Size

25KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-11_30e1414a96aba07c94eee7784ae8b102_amadey_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

generic