2026-04-13_94d94e0a925c5ad082475a53a0aa8e50_amadey_elex_glassworm_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-13_94d94e0a925c5ad082475a53a0aa8e50_amadey_elex_glassworm_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop
Size 47.7MB
Sample260413-ddj6fadt7v
SHA256 d4d9e3185b6f0a96c91d0b3d42c5b7d84854a4bbf9b32d0d62284ccef44aa74c
MD5 94d94e0a925c5ad082475a53a0aa8e50
SHA1 dba656aae0b981486d2cb6553b2284686986e817
SHA512 e491d4177a67804de5dede7f2bfcec864ec521412c60497e81ba235c92ca76069c36b78aa04abfc7c7a907d7bcaae00143ca3e44fea3de5758996f2a0fed2873
SSDEEP 786432:QjYYFzvnHErkHvq7JB+rH92YSGRrnPgD77POdAzVPNTxqjiOgjPf:QXFbPPMJBwTfRrPg37VzVPNQmv3
TLSH
T142B73363EB515AE9E79D0536DF488150972AF22A97FF0231781812C8DE1378BBF6493C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-13_94d94e0a925c5ad082475a53a0aa8e50_amadey_elex_glassworm_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

File Explorer

2026-04-13_94d94e0a925c5ad082475a53a0aa8e50_amadey_elex_glassworm_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

.exe 47.7MB

2026-04-13_94d94e0a925c5ad082475a53a0aa8e50_amadey_elex_glassworm_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

IMPHASH ecf2cf91793bc455a24f8d379859c34a
SHA256 d4d9e3185b6f0a96c91d0b3d42c5b7d84854a4bbf9b32d0d62284ccef44aa74c
MD5 94d94e0a925c5ad082475a53a0aa8e50
SHA1 dba656aae0b981486d2cb6553b2284686986e817
SHA512 e491d4177a67804de5dede7f2bfcec864ec521412c60497e81ba235c92ca76069c36b78aa04abfc7c7a907d7bcaae00143ca3e44fea3de5758996f2a0fed2873
SSDEEP 786432:QjYYFzvnHErkHvq7JB+rH92YSGRrnPgD77POdAzVPNTxqjiOgjPf:QXFbPPMJBwTfRrPg37VzVPNQmv3
TLSH
T142B73363EB515AE9E79D0536DF488150972AF22A97FF0231781812C8DE1378BBF6493C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA GetConsoleAliasesW ReadFile AddAtomA CreateFileW FindActCtxSectionStringA GetCommProperties GetSystemWindowsDirectoryW GlobalHandle FindFirstVolumeMountPointW CreateDirectoryExW LocalSize GetLogicalDriveStringsA ReadConsoleInputW GetComputerNameExA GetTempPathA GetCurrentDirectoryA ContinueDebugEvent LCMapStringA GetProcAddress GlobalAlloc GetCommandLineW GetBinaryTypeW InterlockedExchangeAdd ReadConsoleOutputCharacterW CreateMutexW GetConsoleTitleA SearchPathA ExpandEnvironmentStringsW FindResourceW FormatMessageA GetModuleHandleA EndUpdateResourceA GetLastError SetCommMask LocalReAlloc GetConsoleAliasA TerminateThread LocalFlags GetConsoleAliasesLengthW GetVolumePathNameA SetVolumeMountPointW ChangeTimerQueueTimer GetLocaleInfoW GetComputerNameA lstrcpynW SetConsoleWindowInfo CopyFileA DosDateTimeToFileTime GetSystemWindowsDirectoryA EnumResourceLanguagesW LoadModule GetOverlappedResult QueryDosDeviceW CreateActCtxA DeleteVolumeMountPointW MoveFileWithProgressW FoldStringA WritePrivateProfileStringA GetUserDefaultLangID GetConsoleDisplayMode WaitForSingleObject GetLongPathNameW EnumDateFormatsW InterlockedCompareExchange EnumTimeFormatsW VerifyVersionInfoA FindNextFileW GetConsoleAliasW SetLastError FreeLibrary TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException RtlUnwind HeapFree MoveFileA GetStartupInfoW HeapAlloc GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement GetCPInfo GetACP GetOEMCP IsValidCodePage HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize WideCharToMultiByte MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode FlushFileBuffers CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetFilePointer SetStdHandle CreateFileA DeleteFileA

user32

GetComboBoxInfo

Name

.text

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1.8MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

ocPfWNnO

Size

79KB

Virtual Size

78KB

Characteristics

Name

SOQEXUHa

Size

1024B

Virtual Size

887B

Characteristics

Name

RXwJdaFq

Size

2KB

Virtual Size

1KB

Characteristics

Name

siOhxhhl

Size

28KB

Virtual Size

28KB

Characteristics

Name

tFNnumuX

Size

515KB

Virtual Size

515KB

Characteristics

Name

xozyesbh

Size

56KB

Virtual Size

55KB

Characteristics

Name

MklFjswz

Size

4KB

Virtual Size

3KB

Characteristics

Name

cgffuhrf

Size

136KB

Virtual Size

136KB

Characteristics

Name

njmlGdLE

Size

512B

Virtual Size

378B

Characteristics

Name

hWfWGFQA

Size

13KB

Virtual Size

12KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-13_94d94e0a925c5ad082475a53a0aa8e50_amadey_elex_glassworm_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

kernel32

user32

generic