2026-09-30_36731e9a1fd9b7677c14fc4d6267fbc4_amadey_elex_glassworm_karagany_rhadamanthys_smoke-loader_stealc

General

Target
2026-09-30_36731e9a1fd9b7677c14fc4d6267fbc4_amadey_elex_glassworm_karagany_rhadamanthys_smoke-loader_stealc
Size 310KB
Sample260930-plj17afb73
SHA256 c6e03ebaa4ac6e41620b0f25bb8d6efaa290a25e8bdcfae9fce3fce656f526ac
MD5 36731e9a1fd9b7677c14fc4d6267fbc4
SHA1 483c9079ba0af9aae81f712e8de27187ba2c68c1
SHA512 a83ace606b39977dde194192be8f9f773a52efd89f39a956732b991d99d3f96cd8fdc241605ceb87cba34426c1392a389ace327258159717b10b8d2644a50c40
SSDEEP 6144:5V24jwRTGLyog2fsAu6i6xgB1A/W1Z0fu96euFeYc:5V2mwRTyyog2fsz6xgBumR
TLSH
T1D4646B0573F48E22E2FFCBB59532064507BAF9179926E78E1DC264DD1DF2B808912B93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_36731e9a1fd9b7677c14fc4d6267fbc4_amadey_elex_glassworm_karagany_rhadamanthys_smoke-loader_stealc

File Explorer

2026-09-30_36731e9a1fd9b7677c14fc4d6267fbc4_amadey_elex_glassworm_karagany_rhadamanthys_smoke-loader_stealc

.exe 310KB

2026-09-30_36731e9a1fd9b7677c14fc4d6267fbc4_amadey_elex_glassworm_karagany_rhadamanthys_smoke-loader_stealc

IMPHASH 872eec4dc671270dd40ad40c1873151e
SHA256 c6e03ebaa4ac6e41620b0f25bb8d6efaa290a25e8bdcfae9fce3fce656f526ac
MD5 36731e9a1fd9b7677c14fc4d6267fbc4
SHA1 483c9079ba0af9aae81f712e8de27187ba2c68c1
SHA512 a83ace606b39977dde194192be8f9f773a52efd89f39a956732b991d99d3f96cd8fdc241605ceb87cba34426c1392a389ace327258159717b10b8d2644a50c40
SSDEEP 6144:5V24jwRTGLyog2fsAu6i6xgB1A/W1Z0fu96euFeYc:5V2mwRTyyog2fsz6xgBumR
TLSH
T1D4646B0573F48E22E2FFCBB59532064507BAF9179926E78E1DC264DD1DF2B808912B93
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Tuguu\CStub\OUTPUT\CppHostCLR.pdb

kernel32

UnmapViewOfFile FindResourceW LoadResource SizeofResource CreateFileW MapViewOfFile CreateFileMappingW LockResource CloseHandle GetModuleHandleW GetTempPathW GetTempFileNameW GetCommandLineW HeapSetInformation GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection DecodePointer EncodePointer GetProcAddress ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetLastError InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage MultiByteToWideChar RtlUnwind LoadLibraryW HeapAlloc HeapReAlloc WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringW GetStringTypeW IsProcessorFeaturePresent ReadFile HeapSize WriteConsoleW SetFilePointer SetStdHandle

advapi32

RegOpenKeyExW

mscoree

CorBindToRuntimeEx

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_36731e9a1fd9b7677c14fc4d6267fbc4_amadey_elex_glassworm_karagany_rhadamanthys_smoke-loader_stealc

kernel32

advapi32

mscoree

generic