2026-07-09_eecc3a8be271c41a9128b304e255c828_akira_amadey_elex_glassworm

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_eecc3a8be271c41a9128b304e255c828_akira_amadey_elex_glassworm
Size 4.1MB
Sample260709-b57ppsbt9r
SHA256 b2ebc877e6d4117702648ec5e1509e8d753bfdbd4038d033b43a54e74ebac034
MD5 eecc3a8be271c41a9128b304e255c828
SHA1 fb70636938d873be93bdc1abedd3349af1aaa358
SHA512 8d981ef39aa3b67c3b5502d7dc35df174d67410eaadf91309b657770d5cb9a71295d5d850a5ad0baf05f7475d7128e8b3edcab74464d43e8231ed8ea6e96e006
SSDEEP 49152:iFQjmQye9I1FeM9D8gmAdz4CN09VDozZ9b6jPHYNhBrkXq18I/RRT74IamFL:iFQjHy1Fv99l0C8VD6ZQHYNhBr8q1rFl
TLSH
T13816AFC1FA8350FAC9472875702EB33FDB326906863CC6D7EBE41D51EA7A711581B24A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-09_eecc3a8be271c41a9128b304e255c828_akira_amadey_elex_glassworm

File Explorer

2026-07-09_eecc3a8be271c41a9128b304e255c828_akira_amadey_elex_glassworm

.exe 4.1MB

2026-07-09_eecc3a8be271c41a9128b304e255c828_akira_amadey_elex_glassworm

IMPHASH d1513e0cb088f10898e31c58b5b069a0
SHA256 b2ebc877e6d4117702648ec5e1509e8d753bfdbd4038d033b43a54e74ebac034
MD5 eecc3a8be271c41a9128b304e255c828
SHA1 fb70636938d873be93bdc1abedd3349af1aaa358
SHA512 8d981ef39aa3b67c3b5502d7dc35df174d67410eaadf91309b657770d5cb9a71295d5d850a5ad0baf05f7475d7128e8b3edcab74464d43e8231ed8ea6e96e006
SSDEEP 49152:iFQjmQye9I1FeM9D8gmAdz4CN09VDozZ9b6jPHYNhBrkXq18I/RRT74IamFL:iFQjHy1Fv99l0C8VD6ZQHYNhBr8q1rFl
TLSH
T13816AFC1FA8350FAC9472875702EB33FDB326906863CC6D7EBE41D51EA7A711581B24A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

3a:05:89:07:99:93:a2:46:e3:f7:5d:02:f9:8a:85:b3:a4:db:97:88:70:29:07:c0:4d:9a:f3:26:6c:dd:72:42

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Český statistický úřad,O=Český statistický úřad,L=Praha,C=CZ

Chains

Jan 1, 0001

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Český statistický úřad,O=Český statistický úřad,L=Praha,C=CZ

Serial Number

0b:fa:c5:40:0c:66:70:e2:f1:b5:5a:90:6d:6d:b0:5d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - Sep 22, 2028

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

2968312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

se_okrsek.pdb

kernel32

GetCurrentThread lstrlenW SetThreadStackGuarantee GlobalUnlock GlobalLock GetCurrentProcess GetSystemInfo OpenMutexW WaitForSingleObject GetNativeSystemInfo GetModuleHandleW EncodePointer ReleaseMutex ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime IsDebuggerPresent LCIDToLocaleName GetUserDefaultUILanguage IsProcessorFeaturePresent TerminateProcess RtlUnwind RaiseException TlsAlloc TlsGetValue TlsSetValue GetCurrentThreadId SwitchToThread LoadLibraryA Sleep GetModuleHandleA TlsFree GetTimeZoneInformationForYear InitializeSListHead UnhandledExceptionFilter FormatMessageW HeapAlloc HeapFree GetProcessHeap LoadLibraryExA GetProcAddress SetUnhandledExceptionFilter LoadLibraryW DeviceIoControl GetDriveTypeW GetLogicalDrives PostQueuedCompletionStatus WaitForSingleObjectEx GetCurrentProcessId WideCharToMultiByte MultiByteToWideChar DuplicateHandle GetModuleFileNameW SleepEx GetSystemTimePreciseAsFileTime SetWaitableTimer ExitProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW WriteFileEx FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter QueryPerformanceFrequency GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW RtlCaptureContext AddVectoredExceptionHandler ReadFileEx SetEnvironmentVariableW GetFinalPathNameByHandleW DeleteFileW CreateProcessW CreateWaitableTimerExW CreateThread WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle CreateMutexA SetHandleInformation GetTempPathW GetFileInformationByHandleEx GetFileInformationByHandle CreateFileW InitializeCriticalSectionAndSpinCount GetFullPathNameW CreateDirectoryW SetFileCompletionNotificationModes CreateIoCompletionPort GetQueuedCompletionStatusEx GlobalFree CopyFileExW DeleteCriticalSection SetFilePointerEx SetLastError CreateMutexW HeapReAlloc FindFirstFileExW FindClose FindNextFileW SetFileInformationByHandle GetLastError FreeLibrary LoadLibraryExW OutputDebugStringW OutputDebugStringA MoveFileExW CloseHandle

ntdll

RtlNtStatusToDosError NtCreateNamedPipeFile NtCreateFile NtReadFile NtOpenFile RtlGetVersion NtDeviceIoControlFile NtCancelIoFileEx NtWriteFile

oleaut32

SetErrorInfo SysStringLen SysFreeString GetErrorInfo

combase

CoCreateFreeThreadedMarshaler CoTaskMemFree CoTaskMemAlloc

bcryptprimitives

ProcessPrng

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute DwmEnableBlurBehindWindow

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

user32

SetWindowTextW GetWindowTextLengthW GetWindowTextW EnableWindow IsWindowVisible GetForegroundWindow InvalidateRect UpdateWindow SetCursorPos IsWindow CreateWindowExW SetWindowLongW SetParent GetKeyboardState EnumDisplayMonitors MonitorFromPoint SetWindowDisplayAffinity IsWindowEnabled RegisterTouchWindow GetMessageW MonitorFromRect ToUnicodeEx GetKeyState MapVirtualKeyExW IsIconic GetKeyboardLayout AdjustWindowRect RedrawWindow ClipCursor GetClipCursor ShowCursor SetCursor LoadCursorW FlashWindowEx SetWindowPos GetMessageA TranslateMessage DispatchMessageA GetAsyncKeyState EnumChildWindows GetSystemMenu SetFocus GetWindowLongW GetWindowPlacement GetMonitorInfoW SetWindowPlacement ChangeDisplaySettingsExW RegisterRawInputDevices AdjustWindowRectEx GetMenu InvalidateRgn ReleaseCapture SetCapture GetWindow SystemParametersInfoW RegisterWindowMessageA GetParent SetWindowRgn DefWindowProcW TrackMouseEvent FindWindowExW TrackPopupMenu SetForegroundWindow ClientToScreen IsProcessDPIAware MonitorFromWindow GetCursorPos EnableMenuItem DrawIconEx GetDC VkKeyScanW AppendMenuW InsertMenuW SendInput CheckMenuItem DrawTextW ReleaseDC FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo ShowWindow PostQuitMessage SystemParametersInfoA GetActiveWindow SetMenu RemoveMenu SetMenuItemInfoW DrawMenuBar CreatePopupMenu CreateMenu CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu CloseTouchInputHandle GetSystemMetrics MessageBoxW PostMessageW CreateIcon TranslateAcceleratorW GetMenuItemInfoW SendMessageW FindWindowW GetTouchInputInfo RegisterClassExW ScreenToClient MapVirtualKeyW GetUpdateRect ValidateRect GetRawInputData MsgWaitForMultipleObjectsEx DispatchMessageW PeekMessageW PostThreadMessageW DestroyWindow SetPropW

comctl32

SetWindowSubclass TaskDialogIndirect DefSubclassProc RemoveWindowSubclass

ole32

RevokeDragDrop CoInitializeEx RegisterDragDrop CoCreateInstance CoUninitialize OleInitialize

shlwapi

SHCreateMemStream

advapi32

RegGetValueW RegCloseKey EventUnregister EventWriteTransfer EventRegister EventSetInformation SystemFunction036 RegQueryValueExW RegOpenKeyExW

gdi32

CreateDIBSection CreateCompatibleDC SetBkMode SetTextColor CreateRectRgn SelectObject GetDeviceCaps BitBlt CreateSolidBrush DeleteDC CombineRgn DeleteObject

shell32

ShellExecuteW DragQueryFileW DragFinish SHGetKnownFolderPath SHCreateItemFromParsingName SHAppBarMessage

bcrypt

BCryptGenRandom

ws2_32

shutdown send recv freeaddrinfo getaddrinfo WSACleanup WSAStartup bind WSASend connect setsockopt ioctlsocket WSASocketW closesocket WSAIoctl getsockname WSAGetLastError getpeername getsockopt

crypt32

CertDuplicateCertificateContext CertFreeCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertGetCertificateChain CertVerifyCertificateChainPolicy CertAddCertificateContextToStore CertCloseStore CertFreeCertificateChain CertDuplicateCertificateChain CertOpenStore

secur32

QueryContextAttributesW AcquireCredentialsHandleA FreeCredentialsHandle DecryptMessage InitializeSecurityContextW EncryptMessage AcceptSecurityContext DeleteSecurityContext FreeContextBuffer ApplyControlToken

winspool.drv

GetDefaultPrinterW

comdlg32

PrintDlgW

api-ms-win-crt-string-l1-1-0

wcscmp wcsncmp strcpy_s strlen _wcsicmp wcslen

api-ms-win-crt-math-l1-1-0

trunc roundf round pow floor __setusermatherr

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-runtime-l1-1-0

_c_exit _crt_atexit _cexit __p___argv abort __p___argc _exit exit terminate _register_onexit_function _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _register_thread_local_exe_atexit_callback _set_app_type _initialize_onexit_table _seh_filter_exe _controlfp_s

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_callnewh malloc calloc _set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_eecc3a8be271c41a9128b304e255c828_akira_amadey_elex_glassworm

PE Signature issue

kernel32

ntdll

oleaut32

combase

bcryptprimitives

dwmapi

api-ms-win-core-synch-l1-2-0

user32

comctl32

ole32

shlwapi

advapi32

gdi32

shell32

bcrypt

ws2_32

crypt32

secur32

winspool.drv

comdlg32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic