2026-08-02_d33b01ff8d661cd6a2c18fdf34ba0023_chir_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-08-02_d33b01ff8d661cd6a2c18fdf34ba0023_chir_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop
Size 80KB
Sample260802-jsxb7sfd27
SHA256 89c2ba9878a9a497890018452c8bc0dfece1d479e016ecf4efc99f9756762aad
MD5 d33b01ff8d661cd6a2c18fdf34ba0023
SHA1 6ba8f8443fce456693c2266ec402f917a4ecadab
SHA512 ea95cbabc4a8d09c23df5999b4d9772e496602ba08e852360ee8abd425ed4ca171a70441c9f19961a7e1fa252911abeb08315cb42e2b0d903604666f94feee07
SSDEEP 1536:gaz51LGk0eILJwbS7Ny5DEZRU/kIqsMOAXPisKldd:gaFxGkaLN7Ny5DYJshVh
TLSH
T1D483B0127891C073C81655B51466DFA0EA6FA6120BB9958B7F9C13BE1FB13C0963E33A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_d33b01ff8d661cd6a2c18fdf34ba0023_chir_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-02_d33b01ff8d661cd6a2c18fdf34ba0023_chir_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 80KB

2026-08-02_d33b01ff8d661cd6a2c18fdf34ba0023_chir_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 2a537dc919b56cda9b904db85f5277df
SHA256 89c2ba9878a9a497890018452c8bc0dfece1d479e016ecf4efc99f9756762aad
MD5 d33b01ff8d661cd6a2c18fdf34ba0023
SHA1 6ba8f8443fce456693c2266ec402f917a4ecadab
SHA512 ea95cbabc4a8d09c23df5999b4d9772e496602ba08e852360ee8abd425ed4ca171a70441c9f19961a7e1fa252911abeb08315cb42e2b0d903604666f94feee07
SSDEEP 1536:gaz51LGk0eILJwbS7Ny5DEZRU/kIqsMOAXPisKldd:gaFxGkaLN7Ny5DYJshVh
TLSH
T1D483B0127891C073C81655B51466DFA0EA6FA6120BB9958B7F9C13BE1FB13C0963E33A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

90624

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Documents and Settings\peni\Desktop\Current Device Projects (non-svn)\KillAutorun\Killautorun\Release\Killautorun.pdb

psapi

EnumProcesses EnumProcessModules GetModuleBaseNameW

kernel32

IsValidCodePage GetCommandLineW FindResourceExW FindResourceW LoadResource OpenProcess Sleep SizeofResource TerminateProcess MultiByteToWideChar GetProcessId LockResource CloseHandle GetCurrentProcessId RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetModuleHandleW GetProcAddress ExitProcess GetStartupInfoW GetLastError GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId LCMapStringW WriteFile GetStdHandle GetModuleFileNameA LoadLibraryA InitializeCriticalSectionAndSpinCount GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime VirtualAlloc RtlUnwind LCMapStringA WideCharToMultiByte GetStringTypeA GetStringTypeW GetLocaleInfoA

shell32

CommandLineToArgvW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_d33b01ff8d661cd6a2c18fdf34ba0023_chir_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop

psapi

kernel32

shell32

generic