rhadamanthys | 2026-03-08_3d4ed07fc1a6377c0bee9bef9998d860_elex_glassworm_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-03-08_3d4ed07fc1a6377c0bee9bef9998d860_elex_glassworm_rhadamanthys_stop
Size 1.8MB
Sample260308-jcc9dsds6v
SHA256 04e35b2df8f7c1c773e9571562c4649820d35f2cec7c2e7aa408540189ec6de2
MD5 3d4ed07fc1a6377c0bee9bef9998d860
SHA1 5e0595f44c1a1c4d540987239e2e2742d7b6c854
SHA512 432854a83cbba32c67d1a5fc241ccd6a82ea0d920d5eec3826723e977f3bf5678b9d2593bf039ec5b2db148a4e1564b50b332e41307a5d98529af01b04b056d2
SSDEEP 24576:NfB9GMaAVDKUTbQIzFLwLIM0iwg99Vpibu9D:NjxVmgbQIzZMPXpB9
TLSH
T13C953957EB914AE8F68D04766F584150DB2EF221AA8F2350782C520CCF8738B9F65E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rhadamanthys

Malware Config

Extracted

Family

rhadamanthys

http://179.43.163.126/datalib/315y9t.cwbl

Signatures

Rhadamanthys family
rhadamanthys

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-03-08_3d4ed07fc1a6377c0bee9bef9998d860_elex_glassworm_rhadamanthys_stop

File Explorer

2026-03-08_3d4ed07fc1a6377c0bee9bef9998d860_elex_glassworm_rhadamanthys_stop

.exe 1.8MB

2026-03-08_3d4ed07fc1a6377c0bee9bef9998d860_elex_glassworm_rhadamanthys_stop

IMPHASH aadfbab8d412495f4fa7ffcb1329305d
SHA256 04e35b2df8f7c1c773e9571562c4649820d35f2cec7c2e7aa408540189ec6de2
MD5 3d4ed07fc1a6377c0bee9bef9998d860
SHA1 5e0595f44c1a1c4d540987239e2e2742d7b6c854
SHA512 432854a83cbba32c67d1a5fc241ccd6a82ea0d920d5eec3826723e977f3bf5678b9d2593bf039ec5b2db148a4e1564b50b332e41307a5d98529af01b04b056d2
SSDEEP 24576:NfB9GMaAVDKUTbQIzFLwLIM0iwg99Vpibu9D:NjxVmgbQIzZMPXpB9
TLSH
T13C953957EB914AE8F68D04766F584150DB2EF221AA8F2350782C520CCF8738B9F65E7D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21277

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

IsBadReadPtr GetQueuedCompletionStatus GetLastError CloseHandle IsBadStringPtrA IsBadCodePtr VirtualQuery InterlockedIncrement FlushFileBuffers CreateFileA GetSystemInfo CreateIoCompletionPort HeapDestroy GetProcessHeap HeapCreate ExitProcess GetTickCount HeapFree lstrlenA HeapReAlloc HeapAlloc GetModuleHandleA HeapSize WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle RtlUnwind VirtualAlloc InitializeCriticalSection LoadLibraryA GetCommandLineA GetVersionExA GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement GetCPInfo GetACP GetOEMCP WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection Sleep LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA

user32

DrawTextW GetMessageW TranslateMessage DispatchMessageW

gdi32

CreateBitmap CreateCompatibleBitmap CreatePen DeleteDC BitBlt CreateRectRgn CreateCompatibleDC DeleteObject

advapi32

IsTextUnicode GetUserNameW ReportEventW

shell32

SHGetSpecialFolderPathW Shell_NotifyIconW SHGetFolderPathW CommandLineToArgvW

ole32

CoCreateInstance CoInitialize CoUninitialize

shlwapi

PathCompactPathExW PathMakeSystemFolderW

winmm

waveOutGetNumDevs PlaySoundW

Name

.text

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

144KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

aIsfTUeF

Size

20KB

Virtual Size

19KB

Characteristics

Name

tIYDxGTI

Size

8KB

Virtual Size

4KB

Characteristics

Name

LunrIqxF

Size

4KB

Virtual Size

2KB

Characteristics

Name

ENeQVPGD

Size

48KB

Virtual Size

44KB

Characteristics

Name

bCKeHecr

Size

1.4MB

Virtual Size

1.4MB

Characteristics

Name

cmiFDfvt

Size

100KB

Virtual Size

98KB

Characteristics

Name

SxLqauRs

Size

4KB

Virtual Size

177B

Characteristics

Name

gRdUmozQ

Size

64KB

Virtual Size

62KB

Characteristics

Name

YINjsDCr

Size

4KB

Virtual Size

2KB

Characteristics

Name

uWeiUnVR

Size

28KB

Virtual Size

27KB

Characteristics

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-03-08_3d4ed07fc1a6377c0bee9bef9998d860_elex_glassworm_rhadamanthys_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

winmm

generic