rhadamanthys | 2026-03-08_02ca6803651635cdef1d86d7c0b39471_cobalt-strike_elex_glassworm_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-03-08_02ca6803651635cdef1d86d7c0b39471_cobalt-strike_elex_glassworm_rhadamanthys_stop
Size 984KB
Sample260308-mj4lpscv8j
SHA256 8a2eb3a097a5e0a32101e3ba60e963f2a1fe318f652ce25277fc099614a5b7c0
MD5 02ca6803651635cdef1d86d7c0b39471
SHA1 4783758e381994906d0d88bae0b2087f4f39f0b7
SHA512 091b9e207acf9a670c7dbba506eb76d6bc8d176435e0b135263282cb6349de1efce9b35dbbe94b433490f6ee09a67180082ecbb2ddb5f95f397c896ea13fbe2c
SSDEEP 6144:ORH6o+yOQn0PlBZCBjPeMfoT5kr6a89/drLHgDe7eVvaDtZV7+TgK0z/MPvi0qe7:s6lyY9GCmAYA1YaL8vmer5+nIr
TLSH
T1FD25C4A7EB925AE8E64D44766F594140D72EF221A74F6350786C020DCF8738B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rhadamanthys

Malware Config

Extracted

Family

rhadamanthys

http://81.161.229.234/blob/eduw5y.24nr

Signatures

Rhadamanthys family
rhadamanthys

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-03-08_02ca6803651635cdef1d86d7c0b39471_cobalt-strike_elex_glassworm_rhadamanthys_stop

File Explorer

2026-03-08_02ca6803651635cdef1d86d7c0b39471_cobalt-strike_elex_glassworm_rhadamanthys_stop

.exe 984KB

2026-03-08_02ca6803651635cdef1d86d7c0b39471_cobalt-strike_elex_glassworm_rhadamanthys_stop

IMPHASH 617157d4575ac8c2cf6618c9730ab986
SHA256 8a2eb3a097a5e0a32101e3ba60e963f2a1fe318f652ce25277fc099614a5b7c0
MD5 02ca6803651635cdef1d86d7c0b39471
SHA1 4783758e381994906d0d88bae0b2087f4f39f0b7
SHA512 091b9e207acf9a670c7dbba506eb76d6bc8d176435e0b135263282cb6349de1efce9b35dbbe94b433490f6ee09a67180082ecbb2ddb5f95f397c896ea13fbe2c
SSDEEP 6144:ORH6o+yOQn0PlBZCBjPeMfoT5kr6a89/drLHgDe7eVvaDtZV7+TgK0z/MPvi0qe7:s6lyY9GCmAYA1YaL8vmer5+nIr
TLSH
T1FD25C4A7EB925AE8E64D44766F594140D72EF221A74F6350786C020DCF8738B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21277

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

IsBadReadPtr GetQueuedCompletionStatus GetLastError CloseHandle IsBadStringPtrA IsBadCodePtr VirtualQuery InterlockedIncrement HeapFree FlushFileBuffers CreateFileA GetSystemInfo CreateIoCompletionPort HeapDestroy GetProcessHeap HeapCreate ExitProcess GetTickCount GetModuleHandleA lstrlenA HeapSize WriteConsoleW HeapReAlloc HeapAlloc GetConsoleOutputCP WriteConsoleA SetStdHandle RtlUnwind VirtualAlloc InitializeCriticalSection LoadLibraryA GetCommandLineA GetVersionExA GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement GetCPInfo GetACP GetOEMCP WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection Sleep LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA

user32

GetMessageW DrawTextW TranslateMessage DispatchMessageW

gdi32

CreateBitmap CreateCompatibleBitmap CreatePen DeleteDC BitBlt CreateRectRgn CreateCompatibleDC DeleteObject

shlwapi

PathCompactPathExW PathMakeSystemFolderW

advapi32

IsTextUnicode GetUserNameW ReportEventW

shell32

SHGetSpecialFolderPathW Shell_NotifyIconW SHGetFolderPathW CommandLineToArgvW

ole32

CoInitialize CoCreateInstance CoUninitialize

winmm

waveOutGetNumDevs PlaySoundW

Name

.text

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

144KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

UVUOoMDf

Size

28KB

Virtual Size

26KB

Characteristics

Name

nbUFdDMF

Size

4KB

Virtual Size

1KB

Characteristics

Name

IIVttSfg

Size

4KB

Virtual Size

1KB

Characteristics

Name

FqSPhJED

Size

8KB

Virtual Size

4KB

Characteristics

Name

PydOzLSs

Size

576KB

Virtual Size

573KB

Characteristics

Name

QbNrvtZZ

Size

84KB

Virtual Size

82KB

Characteristics

Name

uMNMLuSd

Size

4KB

Virtual Size

3KB

Characteristics

Name

yZBYYAgv

Size

24KB

Virtual Size

22KB

Characteristics

Name

barGUVUE

Size

4KB

Virtual Size

1KB

Characteristics

Name

jAECjjFV

Size

36KB

Virtual Size

35KB

Characteristics

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-03-08_02ca6803651635cdef1d86d7c0b39471_cobalt-strike_elex_glassworm_rhadamanthys_stop

kernel32

user32

gdi32

shlwapi

advapi32

shell32

ole32

winmm

generic