2026-07-14_51c3713dd439c3ad9a12eaa38683072c_amadey_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_51c3713dd439c3ad9a12eaa38683072c_amadey_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop
Size 1.2MB
Sample260715-a76prabs8y
SHA256 dbd423cd7583193d03d4f68284b4fd0f609dca271d5f2c08a432c68e8d99d0a6
MD5 51c3713dd439c3ad9a12eaa38683072c
SHA1 04287765563b8520c8e18a41c39608d060b2e3a3
SHA512 f1c6f96e0a028342f1c836d047a460325093ef02c0b8ab75656ff16c8e5f4adbd09a8394a5c5b0eb17bca2d412ae7e51383d6134a4907f3a90b60b529cc57688
SSDEEP 24576:HA/+xE1gROjGMhoCEgcBnCT4nbnnQ/tbw/2Mkjy6Fr7g0on:HAqE1QOjOC1T4nbnQ/lFTjN4
TLSH
T19045E00BB68294B7E57301B560B393764E37EA21472AD6C3B79828658F313E05E3E3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-14_51c3713dd439c3ad9a12eaa38683072c_amadey_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-07-14_51c3713dd439c3ad9a12eaa38683072c_amadey_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

.exe 1.2MB

2026-07-14_51c3713dd439c3ad9a12eaa38683072c_amadey_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 55931c20fd1475969430a4a0d979c9f5
SHA256 dbd423cd7583193d03d4f68284b4fd0f609dca271d5f2c08a432c68e8d99d0a6
MD5 51c3713dd439c3ad9a12eaa38683072c
SHA1 04287765563b8520c8e18a41c39608d060b2e3a3
SHA512 f1c6f96e0a028342f1c836d047a460325093ef02c0b8ab75656ff16c8e5f4adbd09a8394a5c5b0eb17bca2d412ae7e51383d6134a4907f3a90b60b529cc57688
SSDEEP 24576:HA/+xE1gROjGMhoCEgcBnCT4nbnnQ/tbw/2Mkjy6Fr7g0on:HAqE1QOjOC1T4nbnQ/lFTjN4
TLSH
T19045E00BB68294B7E57301B560B393764E37EA21472AD6C3B79828658F313E05E3E3D5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

61655

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\xinyi\mgyadb\Release\romaster_daemon.pdb

adbwinapi

ord65 ord67 ord68 ord57 ord63 ord76 ord71 ord58 ord55 ord72 ord79 ord70 ord61

ws2_32

connect WSAStartup htonl send setsockopt accept WSAGetLastError WSAEnumNetworkEvents htons WSAEventSelect shutdown WSACleanup recv bind socket WSACreateEvent closesocket listen gethostbyname

kernel32

TlsAlloc SetConsoleMode ReadConsoleInputA SetUnhandledExceptionFilter GetCurrentProcess SetHandleInformation WriteFile LoadLibraryW Sleep CreateProcessA TerminateProcess ReadFile CreateFileW GetTempPathW GetStdHandle GetLastError GetProcAddress GetLocalTime SetConsoleCtrlHandler CreatePipe GetModuleFileNameA GetCurrentThreadId CloseHandle GetCurrentProcessId WriteProcessMemory GetTickCount InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection CreateFileA GetFileSize SetFilePointer WaitForSingleObject InterlockedCompareExchange SetEvent CreateEventA ResetEvent WaitForMultipleObjects SetLastError HeapFree HeapAlloc GetModuleHandleW ExitProcess FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA FindFirstFileA ExitThread ResumeThread CreateThread UnhandledExceptionFilter FindNextFileA SetEnvironmentVariableA GetCurrentDirectoryA SetCurrentDirectoryA HeapReAlloc GetCommandLineA CreateDirectoryA SetFileAttributesA GetFileAttributesA MultiByteToWideChar FlushConsoleInputBuffer GetFullPathNameA IsDebuggerPresent HeapCreate VirtualFree VirtualAlloc TlsGetValue DeleteFileA TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement SetHandleCount GetFileType GetStartupInfoA WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers HeapSize FreeLibrary LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage SetStdHandle GetTimeZoneInformation FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringA CompareStringW GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetEndOfFile GetProcessHeap GetVersionExA GlobalMemoryStatus GetVersion GetModuleHandleA

shell32

SHGetFolderPathA

user32

wsprintfW MessageBoxW GetDesktopWindow MessageBoxA GetProcessWindowStation GetUserObjectInformationW

dbghelp

MiniDumpWriteDump

advapi32

ReportEventA RegisterEventSourceA DeregisterEventSource

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_51c3713dd439c3ad9a12eaa38683072c_amadey_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

adbwinapi

ws2_32

kernel32

shell32

user32

dbghelp

advapi32

generic