2026-04-16_c694be6c7750b6ec4d340320b2cbfce1_amadey_elex_glassworm_njrat_remcos_rhadamanthys_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-16_c694be6c7750b6ec4d340320b2cbfce1_amadey_elex_glassworm_njrat_remcos_rhadamanthys_smoke-loader_stealc
Size 14.2MB
Sample260416-ejnlgsav7x
SHA256 4f56fe8998601126576926a44594f8144d58b3d71d196846da692e6a45c92b89
MD5 c694be6c7750b6ec4d340320b2cbfce1
SHA1 37800bfc13b4c50e02a6f72f1a0a5fc16f6e9fae
SHA512 416828e16cd1a7e72e92cf49ea9674e30c997ed63572652c725612e8c80cc518567371e441e5b375acc2ed28a683cc3b7763d2752894980d32cacdcd517bfcbb
SSDEEP 12288:PEidhAglQhyupVe0L1ZA1YaL8i0DCmer5+nIwaJCer5+nTer5+nTer5+nTer5+n3:sNgShFLAVd
TLSH
T125E60A02B76499E1DA624BF8583045D5A333F8917E5197A6EC48B30F8C67F889F23B35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-16_c694be6c7750b6ec4d340320b2cbfce1_amadey_elex_glassworm_njrat_remcos_rhadamanthys_smoke-loader_stealc

File Explorer

2026-04-16_c694be6c7750b6ec4d340320b2cbfce1_amadey_elex_glassworm_njrat_remcos_rhadamanthys_smoke-loader_stealc

.exe 14.2MB

2026-04-16_c694be6c7750b6ec4d340320b2cbfce1_amadey_elex_glassworm_njrat_remcos_rhadamanthys_smoke-loader_stealc

IMPHASH ad179eb8d009622c95c11c2ffa3cbf38
SHA256 4f56fe8998601126576926a44594f8144d58b3d71d196846da692e6a45c92b89
MD5 c694be6c7750b6ec4d340320b2cbfce1
SHA1 37800bfc13b4c50e02a6f72f1a0a5fc16f6e9fae
SHA512 416828e16cd1a7e72e92cf49ea9674e30c997ed63572652c725612e8c80cc518567371e441e5b375acc2ed28a683cc3b7763d2752894980d32cacdcd517bfcbb
SSDEEP 12288:PEidhAglQhyupVe0L1ZA1YaL8i0DCmer5+nIwaJCer5+nTer5+nTer5+nTer5+n3:sNgShFLAVd
TLSH
T125E60A02B76499E1DA624BF8583045D5A333F8917E5197A6EC48B30F8C67F889F23B35
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23129

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ReadConsoleA SetDefaultCommConfigW GetEnvironmentStringsW GetModuleHandleExW WriteConsoleInputA AddConsoleAliasW GetComputerNameW CreateHardLinkA GetConsoleAliasesA GetConsoleAliasesLengthA ReadConsoleW GetCompressedFileSizeW GetConsoleAliasExesW EnumTimeFormatsA GetEnvironmentStrings GetConsoleCP GlobalAlloc LoadLibraryW SwitchToFiber InterlockedPopEntrySList TransactNamedPipe GetFileAttributesW HeapQueryInformation CompareStringW MultiByteToWideChar GetStartupInfoW DisconnectNamedPipe GetShortPathNameA GetNamedPipeHandleStateW DeleteVolumeMountPointA GetCurrentDirectoryW SetLastError PeekConsoleInputW WriteProfileSectionA RemoveDirectoryA EnumSystemCodePagesW SetComputerNameA GetTempFileNameA MoveFileA CreateHardLinkW FindAtomA GetModuleHandleA SetLocaleInfoW OpenFileMappingW FreeEnvironmentStringsW FindNextFileW RequestDeviceWakeup GetStringTypeW VirtualProtect PurgeComm GetCurrentDirectoryA QueryPerformanceFrequency GetShortPathNameW SetCalendarInfoA FindFirstVolumeA GetWindowsDirectoryW GetVolumeNameForVolumeMountPointW GetCurrentProcessId GetCommandLineW FindResourceW GetDriveTypeW GetLocaleInfoA OpenFile GetLastError GetProcAddress GetModuleHandleW ExitProcess DecodePointer DeleteFileA HeapReAlloc HeapSetInformation RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCurrentProcess HeapAlloc HeapFree IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameW HeapCreate SetFilePointer SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime Sleep RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage WideCharToMultiByte HeapSize SetStdHandle GetConsoleMode FlushFileBuffers LCMapStringW ReadFile WriteConsoleW CloseHandle CreateFileW

user32

CharUpperA

gdi32

SetBkColor GetKerningPairsA GetCharWidthA

advapi32

ReadEventLogW

Name

.text

Size

235KB

Virtual Size

234KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

33.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

hktPphJC

Size

41KB

Virtual Size

41KB

Characteristics

Name

yowmLhvz

Size

1024B

Virtual Size

949B

Characteristics

Name

nkWdyygg

Size

3KB

Virtual Size

2KB

Characteristics

Name

kZNsZyja

Size

59KB

Virtual Size

59KB

Characteristics

Name

JNKBjURW

Size

751KB

Virtual Size

750KB

Characteristics

Name

bedYWLbm

Size

101KB

Virtual Size

100KB

Characteristics

Name

jagtvclq

Size

3KB

Virtual Size

2KB

Characteristics

Name

ptOfjPoM

Size

43KB

Virtual Size

42KB

Characteristics

Name

KALppQfq

Size

4KB

Virtual Size

4KB

Characteristics

Name

eXbxwvZQ

Size

12.9MB

Virtual Size

82KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-16_c694be6c7750b6ec4d340320b2cbfce1_amadey_elex_glassworm_njrat_remcos_rhadamanthys_smoke-loader_stealc

kernel32

user32

gdi32

advapi32

generic