2026-05-08_1f201c4e636f5356507d90d55487423f_akira_amadey_elex_glassworm

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-08_1f201c4e636f5356507d90d55487423f_akira_amadey_elex_glassworm
Size 11.9MB
Sample260509-acktssfx7x
SHA256 7e304505fd21e92560f4221e43369665c0bb31de111f1b34ad39ef2aad24f440
MD5 1f201c4e636f5356507d90d55487423f
SHA1 a020cca167c6281ac37904c135f4510c9c7dd630
SHA512 ca92d22bbed869ab46acf5dad4248176e03b04fbfa5b0a695ec774a681cce11339e44de77f59f8376df5058d5866d5ea5df6b01a0fed80737fb3dfc85ac8aaee
SSDEEP 98304:m0EM5sRGsKvIdj6WUwrG7SyIXofwY6EMDK4ZGl8tDou/1sSY4YciU+Yv6:dnOmvIdj6WUwrG76StMO4ZGlEoXoiUu
TLSH
T167C65C477B02A0FBC08B8270F01E933C5A73961867114EE78694AEBC5DF56D16D7BA2C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-05-08_1f201c4e636f5356507d90d55487423f_akira_amadey_elex_glassworm

.exe 11.9MB

2026-05-08_1f201c4e636f5356507d90d55487423f_akira_amadey_elex_glassworm

IMPHASH d585aac32c3637def33a274be438c004
SHA256 7e304505fd21e92560f4221e43369665c0bb31de111f1b34ad39ef2aad24f440
MD5 1f201c4e636f5356507d90d55487423f
SHA1 a020cca167c6281ac37904c135f4510c9c7dd630
SHA512 ca92d22bbed869ab46acf5dad4248176e03b04fbfa5b0a695ec774a681cce11339e44de77f59f8376df5058d5866d5ea5df6b01a0fed80737fb3dfc85ac8aaee
SSDEEP 98304:m0EM5sRGsKvIdj6WUwrG7SyIXofwY6EMDK4ZGl8tDou/1sSY4YciU+Yv6:dnOmvIdj6WUwrG76StMO4ZGlEoXoiUu
TLSH
T167C65C477B02A0FBC08B8270F01E933C5A73961867114EE78694AEBC5DF56D16D7BA2C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

81:92:16:7f:36:17:1d:f5:2b:d9:73:5d:e3:48:d4:9f:06:08:91:93:ee:08:69:5e:fd:2a:c0:71:d2:cc:b7:44

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=5735450,CN=Automox Inc.,O=Automox Inc.,L=Boulder,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Apr 9, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0c:aa:c1:19:8d:ba:dd:b8:b4:ab:e2:c9:42:b9:2e:3f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Jan 13, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

9302522

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

agent_ui.pdb

kernel32

FindNextFileW RtlCaptureContext TerminateProcess GetProcessId GetExitCodeProcess GetSystemInfo QueryPerformanceCounter GetSystemTimePreciseAsFileTime WriteFileEx CreateProcessW GetWindowsDirectoryW FormatMessageW InitializeSListHead LoadLibraryExW UnhandledExceptionFilter lstrlenW LoadLibraryA FreeLibrary LoadLibraryExA GetSystemDirectoryW FreeEnvironmentStringsW SleepEx ReadFileEx WaitForMultipleObjects WaitForSingleObject CompareStringOrdinal CreateThread SetWaitableTimer LCIDToLocaleName LoadLibraryW CreateWaitableTimerExW GetUserDefaultUILanguage GetModuleHandleW GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive GetConsoleOutputCP GetStdHandle WriteConsoleW MultiByteToWideChar CancelIo QueryPerformanceFrequency ExitProcess GetTempPathW GetFullPathNameW SetEnvironmentVariableW FindClose GetProcessHeap FindFirstFileExW HeapAlloc SetFileTime SwitchToThread GetFileInformationByHandleEx DeviceIoControl GetFinalPathNameByHandleW CreateDirectoryW MoveFileExW CopyFileExW RemoveDirectoryW GetCommandLineW GetEnvironmentStringsW GetCurrentDirectoryW SetLastError GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler DuplicateHandle SetFileInformationByHandle SetFilePointerEx WideCharToMultiByte ReleaseMutex CreateMutexA GetCurrentProcessId GetCurrentProcess WakeAllConditionVariable SleepConditionVariableSRW WaitForSingleObjectEx HeapReAlloc GetEnvironmentVariableW SetUnhandledExceptionFilter GetModuleHandleA Sleep GetQueuedCompletionStatusEx CreateIoCompletionPort CancelIoEx WriteFile ReadFile PostQueuedCompletionStatus GetOverlappedResult OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetProcAddress GetLastError GetSystemTimeAsFileTime IsDebuggerPresent DeleteFileW CloseHandle IsProcessorFeaturePresent HeapFree CreateEventW RtlUnwind RaiseException AttachConsole CreateFileW GetConsoleMode CreatePipe GetFileAttributesW GetFileInformationByHandle EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree DeleteCriticalSection ExpandEnvironmentStringsW InitializeCriticalSectionAndSpinCount

bcryptprimitives

ProcessPrng

advapi32

RegQueryValueExW RegNotifyChangeKeyValue RegCloseKey EventRegister EventSetInformation EventWriteTransfer EventUnregister RegGetValueW GetUserNameW RegOpenKeyExW

ntdll

NtDeviceIoControlFile NtWriteFile NtOpenFile NtCancelIoFileEx RtlGetVersion NtCreateNamedPipeFile RtlNtStatusToDosError NtReadFile

user32

GetAsyncKeyState GetKeyboardState MapVirtualKeyExW GetMenuBarInfo EnableMenuItem GetSystemMenu SetPropW SystemParametersInfoA GetKeyState DestroyWindow TranslateAcceleratorW GetMenu ShowCursor ClipCursor GetClipCursor IsWindowVisible DestroyIcon GetRawInputData EnumDisplayMonitors OffsetRect MonitorFromPoint SetWindowTextW GetWindowTextW GetWindowTextLengthW SetWindowDisplayAffinity SendInput SetForegroundWindow RegisterRawInputDevices GetKeyboardLayout ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx RegisterWindowMessageA SetParent GetWindowDC MapWindowPoints CreateIcon SendMessageW GetWindow SetFocus ShowWindow RegisterClassW DrawTextW IsProcessDPIAware EnableWindow IsWindowEnabled KillTimer GetWindowRect SetWindowLongW GetParent FindWindowExW TrackPopupMenu SetMenu DrawMenuBar DestroyAcceleratorTable CreateAcceleratorTableW PostQuitMessage InsertMenuW AppendMenuW GetWindowLongW SetMenuItemInfoW GetClientRect CreateMenu CreatePopupMenu ClientToScreen GetCursorPos RemoveMenu CheckMenuItem DrawIconEx DestroyMenu MonitorFromWindow GetMenuItemInfoW MonitorFromRect GetMonitorInfoW GetSystemMetrics FillRect SystemParametersInfoW TrackMouseEvent RedrawWindow GetTouchInputInfo ScreenToClient CloseTouchInputHandle SetCursor SetTimer ValidateRect PostThreadMessageW PeekMessageW ToUnicodeEx GetForegroundWindow GetUpdateRect TranslateMessage RegisterTouchWindow IsWindow AdjustWindowRectEx FlashWindowEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos DispatchMessageW InvalidateRgn GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW DefWindowProcW GetMessageW MapVirtualKeyW IsIconic EnumChildWindows DispatchMessageA GetMessageA CreateWindowExW RegisterClassExW AdjustWindowRect SetWindowRgn ReleaseDC GetDC SetWindowPos PostMessageW LoadCursorW

shell32

DragFinish SHAppBarMessage SHQueryUserNotificationState ShellExecuteW DragQueryFileW Shell_NotifyIconGetRect Shell_NotifyIconW SHGetKnownFolderPath ShellExecuteExW SHOpenFolderAndSelectItems ord190

ole32

RevokeDragDrop CoCreateInstance OleInitialize RegisterDragDrop CoInitialize CoIncrementMTAUsage CoCreateFreeThreadedMarshaler CoInitializeEx CoTaskMemFree CoTaskMemAlloc CoUninitialize

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

comctl32

RemoveWindowSubclass TaskDialogIndirect DefSubclassProc SetWindowSubclass

gdi32

GetDeviceCaps DeleteDC SelectObject DeleteObject SetBkMode CreateSolidBrush SetTextColor CreateRectRgn CreateDIBSection CombineRgn CreateCompatibleDC BitBlt

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetColorizationColor DwmGetWindowAttribute

shlwapi

SHCreateMemStream

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

oleaut32

SysFreeString SysStringLen GetErrorInfo SetErrorInfo

secur32

GetUserNameExW

api-ms-win-crt-math-l1-1-0

__setusermatherr round roundf pow floor trunc

api-ms-win-crt-string-l1-1-0

wcsncmp wcslen wcscmp wcsncat _wcsicmp strcpy_s

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-runtime-l1-1-0

_initterm _get_initial_narrow_environment _initialize_narrow_environment _register_onexit_function _initterm_e terminate exit _controlfp_s _crt_atexit _set_app_type _exit __p___argc _initialize_onexit_table __p___argv _configure_narrow_argv abort _register_thread_local_exe_atexit_callback _c_exit _cexit _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc _set_new_mode calloc

Name

.text

Size

9.0MB

Virtual Size

9.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.taubndl

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

301KB

Virtual Size

301KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-08_1f201c4e636f5356507d90d55487423f_akira_amadey_elex_glassworm

kernel32

bcryptprimitives

advapi32

ntdll

user32

shell32

ole32

api-ms-win-core-synch-l1-2-0

comctl32

gdi32

dwmapi

shlwapi

api-ms-win-core-winrt-l1-1-0

oleaut32

secur32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic