Extracted

• • Target
    2026-04-04_c1c35ff31fb7ac899ade803d1af0f441_elex_glassworm_stop
  • Size 2.7MB
  • SHA256 24c320c473c7fbdd7f9a2826dbb9866133edd18645d631762887d31b25a41a05
  • MD5 c1c35ff31fb7ac899ade803d1af0f441
  • SHA1 104df9cffaff3f6caf19cf5ff09a188f664e396e
  • SHA512 a84d0e4df4f5c0f9f0d5eb7d35606b022a290987c1261aac42c61a1b50bd7bb51dcacbe5601b4545ef57843be3dabcd40b5ee5d14fde9ca1d47c7b8f20bc544e
  • SSDEEP 49152:nRcqo3dZbk00y4u3kh6K2DTAIJlT6cHk/xv6Sn9IdIIIeVi:qq9Fu3kh6K2DTAILT6cH2dH9I6IIN
  • TLSH
    T1E0D56A53EB914AD8E75D0932DF584150A72EF134ABEF62213868624CCE53387BF61A3D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderlgoogloaderrhadamanthysstealer

  • Detect rhadamanthys stealer shellcode

  • Detects LgoogLoader payload

  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

    downloaderlgoogloader

  • Lgoogloader family

    lgoogloader

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Detects Windows executables referencing non-Windows User-Agents

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2