2026-08-01_340f10397166b20ccacfbe323703e76f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_340f10397166b20ccacfbe323703e76f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 14.2MB
Sample260801-d3e8sada28
SHA256 407f7632234892b8f50a22432a6b97e60071c0b58a41c61f073dfa435cce5115
MD5 340f10397166b20ccacfbe323703e76f
SHA1 8d25bcab0ad68da0da5b9fae4f2ff207a0d11e61
SHA512 371661099bcd36ff773fd3d59d597819b355dcd52339cdc8165f0fd9003899656b76b3750d45aa8b273f952a808979ddf7a75d3ebc610615b5de6dfd6f18774b
SSDEEP 12288:I6taj3k61Ccer5+nZonLvA1YaL8i0DMUNLtG4+tbQIzKYZL5er5+n:I660scAVDKUTbQIzFL
TLSH
T1D4E63087292634E3E3965BB0B81A6861A172C8E5BFB70AE0455403C34CE67DDDF4BB35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_340f10397166b20ccacfbe323703e76f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-08-01_340f10397166b20ccacfbe323703e76f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 14.2MB

2026-08-01_340f10397166b20ccacfbe323703e76f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 9ae33731e854d7500b6b6eac229715f1
SHA256 407f7632234892b8f50a22432a6b97e60071c0b58a41c61f073dfa435cce5115
MD5 340f10397166b20ccacfbe323703e76f
SHA1 8d25bcab0ad68da0da5b9fae4f2ff207a0d11e61
SHA512 371661099bcd36ff773fd3d59d597819b355dcd52339cdc8165f0fd9003899656b76b3750d45aa8b273f952a808979ddf7a75d3ebc610615b5de6dfd6f18774b
SSDEEP 12288:I6taj3k61Ccer5+nZonLvA1YaL8i0DMUNLtG4+tbQIzKYZL5er5+n:I660scAVDKUTbQIzFL
TLSH
T1D4E63087292634E3E3965BB0B81A6861A172C8E5BFB70AE0455403C34CE67DDDF4BB35
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28220

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetDriveTypeW EnumCalendarInfoW MoveFileExW InterlockedDecrement CreateJobObjectW SetHandleInformation GetProfileStringW SetVolumeMountPointW GetComputerNameW FreeEnvironmentStringsA GetModuleHandleW GenerateConsoleCtrlEvent GetConsoleAliasesLengthA GetConsoleAliasExesW EnumTimeFormatsA EnumTimeFormatsW TzSpecificLocalTimeToSystemTime GetEnvironmentStrings GetConsoleCP GlobalAlloc LoadLibraryW TerminateThread FatalAppExitW GetCalendarInfoW GetStartupInfoW RaiseException GetPrivateProfileIntW InterlockedExchange GetStartupInfoA SetThreadLocale GetLastError GetCurrentDirectoryW GetNumaProcessorNode PeekConsoleInputW MoveFileW EnumSystemCodePagesW OpenMutexA GetProcessId LocalAlloc BuildCommDCBAndTimeoutsW GetNumberFormatW RemoveDirectoryW GlobalGetAtomNameW FindNextFileA EnumDateFormatsA GlobalUnWire GetModuleHandleA SetLocaleInfoW EnumResourceNamesA CreateMailslotA VirtualProtect EnumDateFormatsW GetShortPathNameW OpenSemaphoreW FindFirstVolumeA FindAtomW FindFirstVolumeW GetVolumeNameForVolumeMountPointW DeleteFileW AddConsoleAliasA CreateFileW ReadFile FlushFileBuffers FindFirstFileW SetDefaultCommConfigA GetCommandLineW GetFileSize BackupRead WriteConsoleW SetStdHandle InterlockedIncrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer HeapFree HeapAlloc GetProcAddress ExitProcess DeleteFileA HeapSetInformation RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent HeapCreate WriteFile GetStdHandle GetModuleFileNameW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage GetStringTypeW MultiByteToWideChar SetFilePointer WideCharToMultiByte GetConsoleMode HeapReAlloc LCMapStringW CloseHandle

user32

CharUpperW LoadMenuA

gdi32

SelectPalette GetTextFaceW

advapi32

LookupAccountSidW

shell32

DragFinish

Name

.text

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

89KB

Virtual Size

30.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

79KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

FUyUfSXX

Size

93KB

Virtual Size

93KB

Characteristics

Name

sakbAHKw

Size

3KB

Virtual Size

2KB

Characteristics

Name

nkOPcKFz

Size

512B

Virtual Size

268B

Characteristics

Name

HKdRMoVw

Size

30KB

Virtual Size

29KB

Characteristics

Name

PuyHezuI

Size

1007KB

Virtual Size

1007KB

Characteristics

Name

gwktBLcf

Size

34KB

Virtual Size

34KB

Characteristics

Name

SkBUzFkJ

Size

2KB

Virtual Size

1KB

Characteristics

Name

nzQSOkuH

Size

135KB

Virtual Size

134KB

Characteristics

Name

JgqgHnXr

Size

3KB

Virtual Size

2KB

Characteristics

Name

xhXlZxlQ

Size

12.6MB

Virtual Size

4KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_340f10397166b20ccacfbe323703e76f_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

gdi32

advapi32

shell32

generic