2026-07-27_0aa7ff091ed3c2d61ef04d998821ec9f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_0aa7ff091ed3c2d61ef04d998821ec9f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 11.2MB
Sample260727-2cbpnser6z
SHA256 8654da5ad4ba9a41419cf7f33dc5ae28305ca86252877121611a6af9b22f4a91
MD5 0aa7ff091ed3c2d61ef04d998821ec9f
SHA1 35c774b5f175d5d69432a11ff1e63e94b5cb5cfa
SHA512 0066efbf004b3881b88560731fbb0329dac1c5e7ac5fc7ec8554ebd3510211a0674943bdf7fa87c519deab73473edecb6c1e45e93996e4df45b2db67d67fd8fd
SSDEEP 12288:B6taj3k61Ccer5+nZonLvA1YaL8i0DMUNLtG4+tbQIzKYZL5er5+n:B660scAVDKUTbQIzFL
TLSH
T15CC63F87292634E3E3965BB0B81A6861A272C8E5BFB706E0455403C34CE67DDDF4BB35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_0aa7ff091ed3c2d61ef04d998821ec9f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-07-27_0aa7ff091ed3c2d61ef04d998821ec9f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 11.2MB

2026-07-27_0aa7ff091ed3c2d61ef04d998821ec9f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 9ae33731e854d7500b6b6eac229715f1
SHA256 8654da5ad4ba9a41419cf7f33dc5ae28305ca86252877121611a6af9b22f4a91
MD5 0aa7ff091ed3c2d61ef04d998821ec9f
SHA1 35c774b5f175d5d69432a11ff1e63e94b5cb5cfa
SHA512 0066efbf004b3881b88560731fbb0329dac1c5e7ac5fc7ec8554ebd3510211a0674943bdf7fa87c519deab73473edecb6c1e45e93996e4df45b2db67d67fd8fd
SSDEEP 12288:B6taj3k61Ccer5+nZonLvA1YaL8i0DMUNLtG4+tbQIzKYZL5er5+n:B660scAVDKUTbQIzFL
TLSH
T15CC63F87292634E3E3965BB0B81A6861A272C8E5BFB706E0455403C34CE67DDDF4BB35
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28220

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetDriveTypeW EnumCalendarInfoW MoveFileExW InterlockedDecrement CreateJobObjectW SetHandleInformation GetProfileStringW SetVolumeMountPointW GetComputerNameW FreeEnvironmentStringsA GetModuleHandleW GenerateConsoleCtrlEvent GetConsoleAliasesLengthA GetConsoleAliasExesW EnumTimeFormatsA EnumTimeFormatsW TzSpecificLocalTimeToSystemTime GetEnvironmentStrings GetConsoleCP GlobalAlloc LoadLibraryW TerminateThread FatalAppExitW GetCalendarInfoW GetStartupInfoW RaiseException GetPrivateProfileIntW InterlockedExchange GetStartupInfoA SetThreadLocale GetLastError GetCurrentDirectoryW GetNumaProcessorNode PeekConsoleInputW MoveFileW EnumSystemCodePagesW OpenMutexA GetProcessId LocalAlloc BuildCommDCBAndTimeoutsW GetNumberFormatW RemoveDirectoryW GlobalGetAtomNameW FindNextFileA EnumDateFormatsA GlobalUnWire GetModuleHandleA SetLocaleInfoW EnumResourceNamesA CreateMailslotA VirtualProtect EnumDateFormatsW GetShortPathNameW OpenSemaphoreW FindFirstVolumeA FindAtomW FindFirstVolumeW GetVolumeNameForVolumeMountPointW DeleteFileW AddConsoleAliasA CreateFileW ReadFile FlushFileBuffers FindFirstFileW SetDefaultCommConfigA GetCommandLineW GetFileSize BackupRead WriteConsoleW SetStdHandle InterlockedIncrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer HeapFree HeapAlloc GetProcAddress ExitProcess DeleteFileA HeapSetInformation RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent HeapCreate WriteFile GetStdHandle GetModuleFileNameW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage GetStringTypeW MultiByteToWideChar SetFilePointer WideCharToMultiByte GetConsoleMode HeapReAlloc LCMapStringW CloseHandle

user32

CharUpperW LoadMenuA

gdi32

SelectPalette GetTextFaceW

advapi32

LookupAccountSidW

shell32

DragFinish

Name

.text

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

89KB

Virtual Size

30.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

79KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

FUyUfSXX

Size

93KB

Virtual Size

93KB

Characteristics

Name

sakbAHKw

Size

3KB

Virtual Size

2KB

Characteristics

Name

nkOPcKFz

Size

512B

Virtual Size

268B

Characteristics

Name

HKdRMoVw

Size

30KB

Virtual Size

29KB

Characteristics

Name

PuyHezuI

Size

1007KB

Virtual Size

1007KB

Characteristics

Name

gwktBLcf

Size

34KB

Virtual Size

34KB

Characteristics

Name

SkBUzFkJ

Size

2KB

Virtual Size

1KB

Characteristics

Name

nzQSOkuH

Size

135KB

Virtual Size

134KB

Characteristics

Name

JgqgHnXr

Size

3KB

Virtual Size

2KB

Characteristics

Name

xhXlZxlQ

Size

9.7MB

Virtual Size

4KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_0aa7ff091ed3c2d61ef04d998821ec9f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

gdi32

advapi32

shell32

generic