2026-08-10_ce42ee8079ceeb7e64baa525f9a8e29a_amadey_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_ce42ee8079ceeb7e64baa525f9a8e29a_amadey_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop
Size 1.2MB
Sample260810-a4nd1a11ev
SHA256 e03d8d4da50adb45b562845c65b8d28d48d6dfa56f8253aabd20692209957917
MD5 ce42ee8079ceeb7e64baa525f9a8e29a
SHA1 273544f4f95d881f7a0e4d57689a2f211517aaf6
SHA512 690d69e313218dc7d9906ccfe0b57f46bfa6bb98e1a57271ce35231e2f687305facd34ff6acd3672c5b6c14d96cdfd43d8e078a2ce84aacfc4a62be53d91be50
SSDEEP 24576:RL/+xE1gROjGMhoCEgcBnCT4nbnAfYLH8AcevDN0FImbwQuq3Wia7gD:RLqE1QOjOC1T4nbnAQgAT76sQuE
TLSH
T16A45E00BB68294B7E573417921B7937A4E37FA21432AD2C3779828658F312E05E3E3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_ce42ee8079ceeb7e64baa525f9a8e29a_amadey_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-08-10_ce42ee8079ceeb7e64baa525f9a8e29a_amadey_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

.exe 1.2MB

2026-08-10_ce42ee8079ceeb7e64baa525f9a8e29a_amadey_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 55931c20fd1475969430a4a0d979c9f5
SHA256 e03d8d4da50adb45b562845c65b8d28d48d6dfa56f8253aabd20692209957917
MD5 ce42ee8079ceeb7e64baa525f9a8e29a
SHA1 273544f4f95d881f7a0e4d57689a2f211517aaf6
SHA512 690d69e313218dc7d9906ccfe0b57f46bfa6bb98e1a57271ce35231e2f687305facd34ff6acd3672c5b6c14d96cdfd43d8e078a2ce84aacfc4a62be53d91be50
SSDEEP 24576:RL/+xE1gROjGMhoCEgcBnCT4nbnAfYLH8AcevDN0FImbwQuq3Wia7gD:RLqE1QOjOC1T4nbnAQgAT76sQuE
TLSH
T16A45E00BB68294B7E573417921B7937A4E37FA21432AD2C3779828658F312E05E3E3D5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

61655

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\xinyi\mgyadb\Release\romaster_daemon.pdb

adbwinapi

ord65 ord67 ord68 ord57 ord63 ord76 ord71 ord58 ord55 ord72 ord79 ord70 ord61

ws2_32

connect WSAStartup htonl send setsockopt accept WSAGetLastError WSAEnumNetworkEvents htons WSAEventSelect shutdown WSACleanup recv bind socket WSACreateEvent closesocket listen gethostbyname

kernel32

TlsAlloc SetConsoleMode ReadConsoleInputA SetUnhandledExceptionFilter GetCurrentProcess SetHandleInformation WriteFile LoadLibraryW Sleep CreateProcessA TerminateProcess ReadFile CreateFileW GetTempPathW GetStdHandle GetLastError GetProcAddress GetLocalTime SetConsoleCtrlHandler CreatePipe GetModuleFileNameA GetCurrentThreadId CloseHandle GetCurrentProcessId WriteProcessMemory GetTickCount InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection CreateFileA GetFileSize SetFilePointer WaitForSingleObject InterlockedCompareExchange SetEvent CreateEventA ResetEvent WaitForMultipleObjects SetLastError HeapFree HeapAlloc GetModuleHandleW ExitProcess FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA FindFirstFileA ExitThread ResumeThread CreateThread UnhandledExceptionFilter FindNextFileA SetEnvironmentVariableA GetCurrentDirectoryA SetCurrentDirectoryA HeapReAlloc GetCommandLineA CreateDirectoryA SetFileAttributesA GetFileAttributesA MultiByteToWideChar FlushConsoleInputBuffer GetFullPathNameA IsDebuggerPresent HeapCreate VirtualFree VirtualAlloc TlsGetValue DeleteFileA TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement SetHandleCount GetFileType GetStartupInfoA WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers HeapSize FreeLibrary LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage SetStdHandle GetTimeZoneInformation FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringA CompareStringW GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetEndOfFile GetProcessHeap GetVersionExA GlobalMemoryStatus GetVersion GetModuleHandleA

shell32

SHGetFolderPathA

user32

wsprintfW MessageBoxW GetDesktopWindow MessageBoxA GetProcessWindowStation GetUserObjectInformationW

dbghelp

MiniDumpWriteDump

advapi32

ReportEventA RegisterEventSourceA DeregisterEventSource

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_ce42ee8079ceeb7e64baa525f9a8e29a_amadey_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

adbwinapi

ws2_32

kernel32

shell32

user32

dbghelp

advapi32

generic