2026-07-15_9e1d27460d4296b55073a0ec7376f72d_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-15_9e1d27460d4296b55073a0ec7376f72d_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 10.3MB
Sample260715-e5w5rabx2k
SHA256 b672c9d0444b80c0fbb1bbfd7477ed235ff5438b4eb933c3d27d42ea13f92f0e
MD5 9e1d27460d4296b55073a0ec7376f72d
SHA1 9d11c8b79b529a1239b98958d371e6cc50e4c2e3
SHA512 b2a0a10ed75546c270e8adcb4f429ca886e323f32136d40af002b9a13df95b68a2e60c7d84b9c6ae1c2e17b75dcf1456de67c62644d1b88c2a1e5b555a304b9d
SSDEEP 12288:g6taj3k61Ccer5+nZonLvA1YaL8i0DMUNLtG4+tbQIzKYZL5er5+n:g660scAVDKUTbQIzFL
TLSH
T1E8B64F87292634E3E3965BB0B81A6861A272C8E5BFB706E0455403C34CE67DDDF4BB35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-15_9e1d27460d4296b55073a0ec7376f72d_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-07-15_9e1d27460d4296b55073a0ec7376f72d_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 10.3MB

2026-07-15_9e1d27460d4296b55073a0ec7376f72d_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 9ae33731e854d7500b6b6eac229715f1
SHA256 b672c9d0444b80c0fbb1bbfd7477ed235ff5438b4eb933c3d27d42ea13f92f0e
MD5 9e1d27460d4296b55073a0ec7376f72d
SHA1 9d11c8b79b529a1239b98958d371e6cc50e4c2e3
SHA512 b2a0a10ed75546c270e8adcb4f429ca886e323f32136d40af002b9a13df95b68a2e60c7d84b9c6ae1c2e17b75dcf1456de67c62644d1b88c2a1e5b555a304b9d
SSDEEP 12288:g6taj3k61Ccer5+nZonLvA1YaL8i0DMUNLtG4+tbQIzKYZL5er5+n:g660scAVDKUTbQIzFL
TLSH
T1E8B64F87292634E3E3965BB0B81A6861A272C8E5BFB706E0455403C34CE67DDDF4BB35
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28220

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetDriveTypeW EnumCalendarInfoW MoveFileExW InterlockedDecrement CreateJobObjectW SetHandleInformation GetProfileStringW SetVolumeMountPointW GetComputerNameW FreeEnvironmentStringsA GetModuleHandleW GenerateConsoleCtrlEvent GetConsoleAliasesLengthA GetConsoleAliasExesW EnumTimeFormatsA EnumTimeFormatsW TzSpecificLocalTimeToSystemTime GetEnvironmentStrings GetConsoleCP GlobalAlloc LoadLibraryW TerminateThread FatalAppExitW GetCalendarInfoW GetStartupInfoW RaiseException GetPrivateProfileIntW InterlockedExchange GetStartupInfoA SetThreadLocale GetLastError GetCurrentDirectoryW GetNumaProcessorNode PeekConsoleInputW MoveFileW EnumSystemCodePagesW OpenMutexA GetProcessId LocalAlloc BuildCommDCBAndTimeoutsW GetNumberFormatW RemoveDirectoryW GlobalGetAtomNameW FindNextFileA EnumDateFormatsA GlobalUnWire GetModuleHandleA SetLocaleInfoW EnumResourceNamesA CreateMailslotA VirtualProtect EnumDateFormatsW GetShortPathNameW OpenSemaphoreW FindFirstVolumeA FindAtomW FindFirstVolumeW GetVolumeNameForVolumeMountPointW DeleteFileW AddConsoleAliasA CreateFileW ReadFile FlushFileBuffers FindFirstFileW SetDefaultCommConfigA GetCommandLineW GetFileSize BackupRead WriteConsoleW SetStdHandle InterlockedIncrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer HeapFree HeapAlloc GetProcAddress ExitProcess DeleteFileA HeapSetInformation RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent HeapCreate WriteFile GetStdHandle GetModuleFileNameW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage GetStringTypeW MultiByteToWideChar SetFilePointer WideCharToMultiByte GetConsoleMode HeapReAlloc LCMapStringW CloseHandle

user32

CharUpperW LoadMenuA

gdi32

SelectPalette GetTextFaceW

advapi32

LookupAccountSidW

shell32

DragFinish

Name

.text

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

89KB

Virtual Size

30.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

79KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

FUyUfSXX

Size

93KB

Virtual Size

93KB

Characteristics

Name

sakbAHKw

Size

3KB

Virtual Size

2KB

Characteristics

Name

nkOPcKFz

Size

512B

Virtual Size

268B

Characteristics

Name

HKdRMoVw

Size

30KB

Virtual Size

29KB

Characteristics

Name

PuyHezuI

Size

1007KB

Virtual Size

1007KB

Characteristics

Name

gwktBLcf

Size

34KB

Virtual Size

34KB

Characteristics

Name

SkBUzFkJ

Size

2KB

Virtual Size

1KB

Characteristics

Name

nzQSOkuH

Size

135KB

Virtual Size

134KB

Characteristics

Name

JgqgHnXr

Size

3KB

Virtual Size

2KB

Characteristics

Name

xhXlZxlQ

Size

8.7MB

Virtual Size

4KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-15_9e1d27460d4296b55073a0ec7376f72d_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

gdi32

advapi32

shell32

generic