2026-04-03_6ffa6220ee6b1a12bd93b4c0bd0dc22c_elex_gcleaner_glassworm_rhadamanthys_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-03_6ffa6220ee6b1a12bd93b4c0bd0dc22c_elex_gcleaner_glassworm_rhadamanthys_stealc_stop
Size 3.1MB
Sample260403-kghv4sct8r
SHA256 2832fbf935ef06cd4e13a0398719b8222ff5b7572a3507455cbf463d0dcaa305
MD5 6ffa6220ee6b1a12bd93b4c0bd0dc22c
SHA1 0d553b88f7163eb7283bb032c8a1a7c7760aad79
SHA512 868c3ec90e1c903523b126c7702db50afd6a626abf48db4c65c38df24db54b6c60ff163a285a3d301c61678c3799e763d3fc53b3649c2368f710db8556123207
SSDEEP 49152:yEVSoTs8lgBLGihk7xeVVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/:jVlzGBhhkde8nLrHp/qKm2/Sb/
TLSH
T149E56953EB914AD9E38D0536DF548150972AF22997FF2260342842CCEE87387BF65A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-03_6ffa6220ee6b1a12bd93b4c0bd0dc22c_elex_gcleaner_glassworm_rhadamanthys_stealc_stop

File Explorer

2026-04-03_6ffa6220ee6b1a12bd93b4c0bd0dc22c_elex_gcleaner_glassworm_rhadamanthys_stealc_stop

.exe 3.1MB

2026-04-03_6ffa6220ee6b1a12bd93b4c0bd0dc22c_elex_gcleaner_glassworm_rhadamanthys_stealc_stop

IMPHASH d36fec1c967de2874bf6e84e25ac7e04
SHA256 2832fbf935ef06cd4e13a0398719b8222ff5b7572a3507455cbf463d0dcaa305
MD5 6ffa6220ee6b1a12bd93b4c0bd0dc22c
SHA1 0d553b88f7163eb7283bb032c8a1a7c7760aad79
SHA512 868c3ec90e1c903523b126c7702db50afd6a626abf48db4c65c38df24db54b6c60ff163a285a3d301c61678c3799e763d3fc53b3649c2368f710db8556123207
SSDEEP 49152:yEVSoTs8lgBLGihk7xeVVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/:jVlzGBhhkde8nLrHp/qKm2/Sb/
TLSH
T149E56953EB914AD9E38D0536DF548150972AF22997FF2260342842CCEE87387BF65A3D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19203

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LocalCompact CreateHardLinkA GetModuleHandleW EnumResourceTypesA GetConsoleCP GlobalAlloc LoadLibraryW IsProcessInJob GetSystemDirectoryA GetLastError SetLastError GetProcAddress GetProcessHeaps VerLanguageNameA FindClose LoadLibraryA SetConsoleCtrlHandler AddAtomW CreateEventW SetEndOfFile GlobalHandle SetEnvironmentVariableA GlobalWire GetModuleFileNameA GetOEMCP GetModuleHandleA EnumResourceNamesA PeekConsoleInputA GetDiskFreeSpaceExA TerminateJobObject WriteConsoleW CloseHandle FlushFileBuffers GetConsoleMode SetStdHandle HeapReAlloc GetStringTypeW HeapWalk IsBadHugeReadPtr InterlockedIncrement InterlockedDecrement EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree GetCommandLineW HeapSetInformation GetStartupInfoW RaiseException RtlUnwind HeapAlloc WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo IsProcessorFeaturePresent GetACP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId HeapCreate ReadFile UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess ExitProcess SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType SetFilePointer WriteFile GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoW HeapSize GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale CreateFileW

user32

GetMessageExtraInfo CharUpperBuffA DrawStateW SetMenu GetSysColorBrush SetCaretPos SetClipboardViewer

advapi32

RegSetValueA

Name

.text

Size

696KB

Virtual Size

696KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

47KB

Virtual Size

32.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vepina

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.hihew

Size

1024B

Virtual Size

723B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

wLjrzuGS

Size

4KB

Virtual Size

4KB

Characteristics

Name

iexNcEmP

Size

4KB

Virtual Size

3KB

Characteristics

Name

gucUQMLf

Size

2KB

Virtual Size

2KB

Characteristics

Name

GOXovckm

Size

58KB

Virtual Size

57KB

Characteristics

Name

kMLchOzC

Size

2.1MB

Virtual Size

2.1MB

Characteristics

Name

gGMfWzrc

Size

28KB

Virtual Size

28KB

Characteristics

Name

tpoTqPHc

Size

2KB

Virtual Size

2KB

Characteristics

Name

lLbqWjhx

Size

134KB

Virtual Size

134KB

Characteristics

Name

ptIkzbJK

Size

1KB

Virtual Size

1KB

Characteristics

Name

WhcLdpdR

Size

17KB

Virtual Size

16KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-03_6ffa6220ee6b1a12bd93b4c0bd0dc22c_elex_gcleaner_glassworm_rhadamanthys_stealc_stop

kernel32

user32

advapi32

generic