2026-04-16_eccfd4adaa6de564e34de750b8737893_amadey_elex_glassworm_njrat_remcos_rhadamanthys_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-16_eccfd4adaa6de564e34de750b8737893_amadey_elex_glassworm_njrat_remcos_rhadamanthys_smoke-loader_stealc
Size 12.3MB
Sample260416-esnylsft2q
SHA256 ec5365e13ba213676273f431f71707d2a16e0f61d1bb445d23ee37d2b269623a
MD5 eccfd4adaa6de564e34de750b8737893
SHA1 dfee1226f0f3ff12d0d5a18f28c1167fda6c9f55
SHA512 f2f9eacd63d4175a0cf033468f0c8964ede27cd5b2692687b58d7c6015734064f311fdfe07ec3d1fa6c607502336906e06e696e4353ee10e53e700cd1abf4ab1
SSDEEP 12288:rEidhAglQhyupVe0L1ZA1YaL8i0DCmer5+nIwaJCer5+nTer5+nTer5+nTer5+n1:4NgShFLAVd
TLSH
T1B7D60A02B76499D1DA624BF8583045D5A333F8917E5297A6EC48B30E8C67F889F23F35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-16_eccfd4adaa6de564e34de750b8737893_amadey_elex_glassworm_njrat_remcos_rhadamanthys_smoke-loader_stealc

File Explorer

2026-04-16_eccfd4adaa6de564e34de750b8737893_amadey_elex_glassworm_njrat_remcos_rhadamanthys_smoke-loader_stealc

.exe 12.3MB

2026-04-16_eccfd4adaa6de564e34de750b8737893_amadey_elex_glassworm_njrat_remcos_rhadamanthys_smoke-loader_stealc

IMPHASH ad179eb8d009622c95c11c2ffa3cbf38
SHA256 ec5365e13ba213676273f431f71707d2a16e0f61d1bb445d23ee37d2b269623a
MD5 eccfd4adaa6de564e34de750b8737893
SHA1 dfee1226f0f3ff12d0d5a18f28c1167fda6c9f55
SHA512 f2f9eacd63d4175a0cf033468f0c8964ede27cd5b2692687b58d7c6015734064f311fdfe07ec3d1fa6c607502336906e06e696e4353ee10e53e700cd1abf4ab1
SSDEEP 12288:rEidhAglQhyupVe0L1ZA1YaL8i0DCmer5+nIwaJCer5+nTer5+nTer5+nTer5+n1:4NgShFLAVd
TLSH
T1B7D60A02B76499D1DA624BF8583045D5A333F8917E5297A6EC48B30E8C67F889F23F35
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23129

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ReadConsoleA SetDefaultCommConfigW GetEnvironmentStringsW GetModuleHandleExW WriteConsoleInputA AddConsoleAliasW GetComputerNameW CreateHardLinkA GetConsoleAliasesA GetConsoleAliasesLengthA ReadConsoleW GetCompressedFileSizeW GetConsoleAliasExesW EnumTimeFormatsA GetEnvironmentStrings GetConsoleCP GlobalAlloc LoadLibraryW SwitchToFiber InterlockedPopEntrySList TransactNamedPipe GetFileAttributesW HeapQueryInformation CompareStringW MultiByteToWideChar GetStartupInfoW DisconnectNamedPipe GetShortPathNameA GetNamedPipeHandleStateW DeleteVolumeMountPointA GetCurrentDirectoryW SetLastError PeekConsoleInputW WriteProfileSectionA RemoveDirectoryA EnumSystemCodePagesW SetComputerNameA GetTempFileNameA MoveFileA CreateHardLinkW FindAtomA GetModuleHandleA SetLocaleInfoW OpenFileMappingW FreeEnvironmentStringsW FindNextFileW RequestDeviceWakeup GetStringTypeW VirtualProtect PurgeComm GetCurrentDirectoryA QueryPerformanceFrequency GetShortPathNameW SetCalendarInfoA FindFirstVolumeA GetWindowsDirectoryW GetVolumeNameForVolumeMountPointW GetCurrentProcessId GetCommandLineW FindResourceW GetDriveTypeW GetLocaleInfoA OpenFile GetLastError GetProcAddress GetModuleHandleW ExitProcess DecodePointer DeleteFileA HeapReAlloc HeapSetInformation RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCurrentProcess HeapAlloc HeapFree IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameW HeapCreate SetFilePointer SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime Sleep RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage WideCharToMultiByte HeapSize SetStdHandle GetConsoleMode FlushFileBuffers LCMapStringW ReadFile WriteConsoleW CloseHandle CreateFileW

user32

CharUpperA

gdi32

SetBkColor GetKerningPairsA GetCharWidthA

advapi32

ReadEventLogW

Name

.text

Size

235KB

Virtual Size

234KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

33.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

hktPphJC

Size

41KB

Virtual Size

41KB

Characteristics

Name

yowmLhvz

Size

1024B

Virtual Size

949B

Characteristics

Name

nkWdyygg

Size

3KB

Virtual Size

2KB

Characteristics

Name

kZNsZyja

Size

59KB

Virtual Size

59KB

Characteristics

Name

JNKBjURW

Size

751KB

Virtual Size

750KB

Characteristics

Name

bedYWLbm

Size

101KB

Virtual Size

100KB

Characteristics

Name

jagtvclq

Size

3KB

Virtual Size

2KB

Characteristics

Name

ptOfjPoM

Size

43KB

Virtual Size

42KB

Characteristics

Name

KALppQfq

Size

4KB

Virtual Size

4KB

Characteristics

Name

eXbxwvZQ

Size

11.0MB

Virtual Size

82KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-16_eccfd4adaa6de564e34de750b8737893_amadey_elex_glassworm_njrat_remcos_rhadamanthys_smoke-loader_stealc

kernel32

user32

gdi32

advapi32

generic