2026-05-10_49198077042845f16cc5a3ec825f6cbd_elex_glassworm_rhadamanthys_stop

General

Target
2026-05-10_49198077042845f16cc5a3ec825f6cbd_elex_glassworm_rhadamanthys_stop
Size 828KB
Sample260510-e9asbag13w
SHA256 e03d741a069a1aba83351db5b9f5f2e20509dea77ccc3978d829577f24d43c8d
MD5 49198077042845f16cc5a3ec825f6cbd
SHA1 965bc8c3cef191bd7673fe29d48d39c6ac4bd62b
SHA512 28f401e41a5a2ae3efc7a720c26dfdbf1ac5d1f4e7b0bff5e9c10fda93a55a2a9ddd5c64864e11b4b55b613edb642ae69ce0aa2d9694b05ea4bcb3f02ae8c164
SSDEEP 12288:ZLRgAJYpwl7vRLtvnM1YmEUl3O8Mq+KdEKKleo2cwJHPGhJCGDtPrw5bDAc2kHjA:fKMLt/8Ymdl3APB
TLSH
T15B05E558325071EEE857C93A8EA81C20A6607C774B1BD247A54776ED9A3D6E3CF201F3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables packed with ConfuserEx Mod 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ConfuserEx

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
sample	ConfuserEx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-10_49198077042845f16cc5a3ec825f6cbd_elex_glassworm_rhadamanthys_stop

File Explorer

2026-05-10_49198077042845f16cc5a3ec825f6cbd_elex_glassworm_rhadamanthys_stop

.exe 828KB

2026-05-10_49198077042845f16cc5a3ec825f6cbd_elex_glassworm_rhadamanthys_stop

IMPHASH 8d377bb699533bdff09b0767a380a79d
SHA256 e03d741a069a1aba83351db5b9f5f2e20509dea77ccc3978d829577f24d43c8d
MD5 49198077042845f16cc5a3ec825f6cbd
SHA1 965bc8c3cef191bd7673fe29d48d39c6ac4bd62b
SHA512 28f401e41a5a2ae3efc7a720c26dfdbf1ac5d1f4e7b0bff5e9c10fda93a55a2a9ddd5c64864e11b4b55b613edb642ae69ce0aa2d9694b05ea4bcb3f02ae8c164
SSDEEP 12288:ZLRgAJYpwl7vRLtvnM1YmEUl3O8Mq+KdEKKleo2cwJHPGhJCGDtPrw5bDAc2kHjA:fKMLt/8Ymdl3APB
TLSH
T15B05E558325071EEE857C93A8EA81C20A6607C774B1BD247A54776ED9A3D6E3CF201F3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects executables packed with ConfuserEx Mod
ConfuserEx .NET packer

Detects ConfuserEx .NET packer.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

24735

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

LoadResource SizeofResource WriteFile CloseHandle FindResourceW InitializeCriticalSectionAndSpinCount GetTempPathW GetTempFileNameW CreateFileW MultiByteToWideChar GetModuleHandleW FindResourceExW LockResource SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP RaiseException GetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap EncodePointer DecodePointer RtlUnwind GetCommandLineW GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent InterlockedDecrement ExitProcess GetModuleHandleExW GetProcAddress AreFileApisANSI Sleep IsDebuggerPresent SetLastError InterlockedIncrement GetCurrentThread GetCurrentThreadId GetFileType GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree CreateSemaphoreW OutputDebugStringW LoadLibraryExW LoadLibraryW SetConsoleCtrlHandler WideCharToMultiByte GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FatalAppExitA InterlockedExchange FreeLibrary IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW FlushFileBuffers WriteConsoleW

advapi32

RegOpenKeyExW

oleaut32

SysAllocStringLen

mscoree

CorBindToRuntimeEx

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-10_49198077042845f16cc5a3ec825f6cbd_elex_glassworm_rhadamanthys_stop

kernel32

advapi32

oleaut32

mscoree

generic