2026-10-07_285e00481516e1e889befbaf0f3a87e5_amadey_elex_glassworm_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-10-07_285e00481516e1e889befbaf0f3a87e5_amadey_elex_glassworm_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 22.6MB
Sample261007-sgr3sacs2l
SHA256 b25786ce542e9b7283d21676f4952c8fb75c6016bb784542008b7105aaf538a1
MD5 285e00481516e1e889befbaf0f3a87e5
SHA1 ae81461dbe83b212f33b31d3acb1a9c0c587d03e
SHA512 57d4d2993ee30871d70a7b9bb635163238ad7747ed42840692f7f747b6baa34c2aa3128738e53099411e6431747cfcb1f2ef3d975c070235b36fe9d5fdb4d88f
SSDEEP 393216:cXGWOLBh2NPfs/dQETVlOBbpFEjdGphRqV56HpkoaH3D8P2Q6YS6x9DOc:c2/BhSHExi73qqHpu34kYbzOc
TLSH
T1493733159ACAE275C35718750DB6A239DDB28D609B2D41F376EC3820AE337EA13F6341
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-07_285e00481516e1e889befbaf0f3a87e5_amadey_elex_glassworm_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-10-07_285e00481516e1e889befbaf0f3a87e5_amadey_elex_glassworm_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 22.6MB

2026-10-07_285e00481516e1e889befbaf0f3a87e5_amadey_elex_glassworm_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH d619eda1a774da262071361b928bb2e4
SHA256 b25786ce542e9b7283d21676f4952c8fb75c6016bb784542008b7105aaf538a1
MD5 285e00481516e1e889befbaf0f3a87e5
SHA1 ae81461dbe83b212f33b31d3acb1a9c0c587d03e
SHA512 57d4d2993ee30871d70a7b9bb635163238ad7747ed42840692f7f747b6baa34c2aa3128738e53099411e6431747cfcb1f2ef3d975c070235b36fe9d5fdb4d88f
SSDEEP 393216:cXGWOLBh2NPfs/dQETVlOBbpFEjdGphRqV56HpkoaH3D8P2Q6YS6x9DOc:c2/BhSHExi73qqHpu34kYbzOc
TLSH
T1493733159ACAE275C35718750DB6A239DDB28D609B2D41F376EC3820AE337EA13F6341
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX dump on OEP (original entry point)
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

3d:3f:54:b9:3f:ea:62:da:80:82:be:d9:6b:11:69:50:46:d5:4a:94:12:e7:cd:56:9e:96:3c:13:79:2c:b7:f8

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

Chains

Jun 17, 2023

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

CN=Trustwave Global Code Signing CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

PE Signature issue

Digest

10:a0:42:48:53:dd:97:e6:c7:1d:35:83:22:3f:df:09:7a:54:47:b3

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

Chains

Jun 17, 2023

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

CN=Trustwave Global Code Signing CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Subject

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

Serial Number

07:7f:22:38:be:42:10:bc:dd:a8:7c:d5:bd:db:90:61:80:9f:32

Issuer

CN=Trustwave Global Code Signing CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 23, 2022 - Feb 2, 2026

Subject

CN=Trustwave Global Code Signing CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Serial Number

06:ce:82:d9:b3:d4:98:74:56:05:d6:66:6b:6d:6d:99:7b:cb:73

Issuer

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Mar 3, 2026

Timespan

Feb 6, 2018 - Aug 21, 2042

Subject

CN=Viking Cloud TWG Timestamping Responder 2022,O=Viking Cloud\, Inc.,C=US

Serial Number

07:71:c2:62:80:b4:da:77:02:03:13:ab:bc:fa:a3:ff:ed:8b:2a

Issuer

CN=Viking Cloud TWG Timestamping CA\, Level 1,O=Viking Cloud\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 10, 2022 - Nov 6, 2033

Subject

CN=Viking Cloud TWG Timestamping CA\, Level 1,O=Viking Cloud\, Inc.,C=US

Serial Number

07:71:c1:bc:fc:08:5f:97:f1:8c:6a:6a:23:c8:d3:7f:08:7d:f9

Issuer

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Revoked

Revocation Date

Mar 3, 2026

Timespan

Aug 10, 2022 - Aug 10, 2037

Minor OS version

1

Major OS version

5

Entry point

180224

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA lstrcpyA lstrcatA lstrlenA GetSystemDirectoryA GetProcAddress GetModuleHandleA _lclose GetModuleFileNameA _lread _llseek _lopen _lwrite _lcreat CreateDirectoryA SetCurrentDirectoryA GetDiskFreeSpaceA GetFileAttributesA CompareStringA DeleteFileA GetTempPathA GetCurrentDirectoryA CloseHandle GetExitCodeProcess GetLastError LocalFree GetCurrentProcess MoveFileExA GetStringTypeW MultiByteToWideChar LCMapStringW HeapReAlloc RtlUnwind HeapSize Sleep RemoveDirectoryA FreeLibrary IsValidCodePage GetOEMCP GetModuleHandleW ExitProcess DecodePointer HeapFree HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer LoadLibraryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent HeapCreate FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP

user32

TranslateMessage DispatchMessageA PeekMessageA wsprintfA LoadCursorA SetCursor MessageBoxA MsgWaitForMultipleObjects

advapi32

GetTokenInformation OpenProcessToken

shell32

ShellExecuteExA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-07_285e00481516e1e889befbaf0f3a87e5_amadey_elex_glassworm_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

shell32

generic