Extracted

• • Target
    2026-04-04_e1dcde0f60edc7a331c70be6825fc4f7_elex_glassworm_stop
  • Size 2.1MB
  • SHA256 6b05b5a22c8ccef52ad25a0d2956c727cfaf5095a886a390ed01e5c9ec4cbe05
  • MD5 e1dcde0f60edc7a331c70be6825fc4f7
  • SHA1 d2a180a98c78d3a99ab0bedf9713a78925bc14a0
  • SHA512 397b14a41cd4ea86a2b99f25c33347fc512be09a9c0b84ab8eb9d58f4abfc0fba72cd0bd3597e272507cf63db1542d85e2bab7f1fc15a647d9f34181e786d48f
  • SSDEEP 49152:Q0lrax49sKfUSM27mNWx9J7ZfCzOrUhz0Vb:pdXv76GJZfSA
  • TLSH
    T19DA5ADA7E7418AD8EA8D41776B0A4580D22EF221A74F6351796C060DCF43BCB9F64E3D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderlgoogloaderrhadamanthysstealer

  • Detect rhadamanthys stealer shellcode

  • Detects LgoogLoader payload

  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

    downloaderlgoogloader

  • Lgoogloader family

    lgoogloader

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Detects Windows executables referencing non-Windows User-Agents

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2