2026-06-26_f66d6b620e7108d157b8e3f7f452b165_amadey_elex_glassworm_manuscrypt_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-26_f66d6b620e7108d157b8e3f7f452b165_amadey_elex_glassworm_manuscrypt_rhadamanthys_smoke-loader_stop
Size 15.7MB
Sample260629-m4dwsabt71
SHA256 be3c312bbdb644983b61c4e0c2c884864025d1fda89da5add678277c592843ff
MD5 f66d6b620e7108d157b8e3f7f452b165
SHA1 31ce8269557160ba19720bd42bf1aec51a8a9f1d
SHA512 5d502637dd3f5a5de2158505a74c6230dac58f411a4685f9e6221f3b00855a6b8cb9d6db39b912bf7583154e5d9daab944fe685e2c7be80a8838deb7acae2b52
SSDEEP 196608:Ol8yHF9G3/TEXMTuyHFkyHFJ5IRb+ki7:Nyvo/qMTuyiyH5IRb+ki7
TLSH
T164F66B13EF998165E4B66A388579B326A7B6BC205B34C7CF5144769ECEB27C09C303D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-06-26_f66d6b620e7108d157b8e3f7f452b165_amadey_elex_glassworm_manuscrypt_rhadamanthys_smoke-loader_stop

File Explorer

2026-06-26_f66d6b620e7108d157b8e3f7f452b165_amadey_elex_glassworm_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 15.7MB

2026-06-26_f66d6b620e7108d157b8e3f7f452b165_amadey_elex_glassworm_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH 260725db05d85038f0d2595a14b7e42a
SHA256 be3c312bbdb644983b61c4e0c2c884864025d1fda89da5add678277c592843ff
MD5 f66d6b620e7108d157b8e3f7f452b165
SHA1 31ce8269557160ba19720bd42bf1aec51a8a9f1d
SHA512 5d502637dd3f5a5de2158505a74c6230dac58f411a4685f9e6221f3b00855a6b8cb9d6db39b912bf7583154e5d9daab944fe685e2c7be80a8838deb7acae2b52
SSDEEP 196608:Ol8yHF9G3/TEXMTuyHFkyHFJ5IRb+ki7:Nyvo/qMTuyiyH5IRb+ki7
TLSH
T164F66B13EF998165E4B66A388579B326A7B6BC205B34C7CF5144769ECEB27C09C303D2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

39:53:5c:4c:3e:ca:19:f4:bf:0b:94:7e:b8:71:4e:6f:6c:b6:15:2b

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 24, 2007

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0f:78:4d:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 23, 2007 - Feb 23, 2009

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:14:2c:a7:00:00:00:00:00:06

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 12, 2007 - Jun 13, 2012

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Minor OS version

Major OS version

Entry point

18731

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

aspnet_state.pdb

kernel32

SetWaitableTimer CloseHandle CreateThread CreateWaitableTimerW CreateEventW SetConsoleCtrlHandler FormatMessageW InterlockedIncrement InterlockedDecrement GetSystemTimeAsFileTime lstrlenW WideCharToMultiByte FileTimeToSystemTime FileTimeToLocalFileTime QueryPerformanceCounter GetTickCount GetCurrentThreadId Sleep TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetSystemInfo WaitForSingleObject SetEvent GetProcessAffinityMask SwitchToThread MultiByteToWideChar GetLastError HeapReAlloc InterlockedCompareExchange InterlockedExchange HeapFree HeapAlloc GetProcAddress HeapDestroy HeapCreate FreeLibrary GetCurrentProcessId

msvcr80

__set_app_type _except_handler4_common _unlock __dllonexit _lock _onexit _decode_pointer ?terminate@@YAXXZ _invoke_watson _controlfp_s _encode_pointer __p__fmode __p__commode _adjust_fdiv __setusermatherr _configthreadlocale _initterm_e _purecall strncmp memcpy _vsnwprintf_s memset _itoa_s _amsg_exit __wgetmainargs _cexit _exit _XcptFilter exit __winitenv _initterm strtol strstr strchr

advapi32

RegCloseKey RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW RegQueryValueExW RegOpenKeyExW SetServiceStatus

mswsock

GetAcceptExSockaddrs AcceptEx

ole32

CoUninitialize CoInitializeEx

ws2_32

recv select WSASend WSARecv WSAGetOverlappedResult WSAAddressToStringA gethostbyname ntohs WSACleanup WSAStartup closesocket WSASocketW WSAGetLastError setsockopt htons htonl bind listen inet_ntoa

mscoree

ClrCreateManagedInstance

webengine

PerfCounterInitialize InitializeLibrary XspLogEvent AttachHandleToThreadPool LoadLibraryUsingFullPath PrintResourceString AspnetLoadResourceDLL GetXSPHeap

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-26_f66d6b620e7108d157b8e3f7f452b165_amadey_elex_glassworm_manuscrypt_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

msvcr80

advapi32

mswsock

ole32

ws2_32

mscoree

webengine

generic