2026-07-11_61cbd0da228f125b45ce4f6f3b6a5fe9_elex_glassworm_manuscrypt_rhadamanthys_stop

General

Target
2026-07-11_61cbd0da228f125b45ce4f6f3b6a5fe9_elex_glassworm_manuscrypt_rhadamanthys_stop
Size 473KB
Sample260711-ldz6nahs21
SHA256 ce774885fcfc15e764847e66da11639080c92f74f28396ab6890062c1a606f0b
MD5 61cbd0da228f125b45ce4f6f3b6a5fe9
SHA1 4f239810a2ea0aded4971d2581baeb1797cb8864
SHA512 5612c4895ea6edea9e12eb6357e9cfe935d8cd1eb66158a1ead498b83a2c2d9dc69429ac5da0035e069dc17edcb1c8037575658831557177ed4ccdc6e92a4b60
SSDEEP 12288:ihUGb8EztoXGRbPLPy0l4SGGvGGvGGvGGpBMC:QXxoWRbPLKXSGGvGGvGGvGGpX
TLSH
T1C6A49D5A3298CA62D47F4FFAA122411007B0EE179A8BF71B1ED471DA1C323816D5F6E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-11_61cbd0da228f125b45ce4f6f3b6a5fe9_elex_glassworm_manuscrypt_rhadamanthys_stop

File Explorer

2026-07-11_61cbd0da228f125b45ce4f6f3b6a5fe9_elex_glassworm_manuscrypt_rhadamanthys_stop

.exe 473KB

2026-07-11_61cbd0da228f125b45ce4f6f3b6a5fe9_elex_glassworm_manuscrypt_rhadamanthys_stop

IMPHASH 0dafd88c1a8511ef0fe8f94cc704a88e
SHA256 ce774885fcfc15e764847e66da11639080c92f74f28396ab6890062c1a606f0b
MD5 61cbd0da228f125b45ce4f6f3b6a5fe9
SHA1 4f239810a2ea0aded4971d2581baeb1797cb8864
SHA512 5612c4895ea6edea9e12eb6357e9cfe935d8cd1eb66158a1ead498b83a2c2d9dc69429ac5da0035e069dc17edcb1c8037575658831557177ed4ccdc6e92a4b60
SSDEEP 12288:ihUGb8EztoXGRbPLPy0l4SGGvGGvGGvGGpBMC:QXxoWRbPLKXSGGvGGvGGvGGpX
TLSH
T1C6A49D5A3298CA62D47F4FFAA122411007B0EE179A8BF71B1ED471DA1C323816D5F6E7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

16342

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

LoadResource SizeofResource WriteFile CloseHandle FindResourceW InitializeCriticalSectionAndSpinCount GetTempPathW GetTempFileNameW CreateFileW MultiByteToWideChar GetModuleHandleW FindResourceExW LockResource SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP RaiseException GetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap EncodePointer DecodePointer RtlUnwind GetCommandLineW GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent InterlockedDecrement ExitProcess GetModuleHandleExW GetProcAddress Sleep IsDebuggerPresent SetLastError InterlockedIncrement GetCurrentThreadId GetFileType GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree OutputDebugStringW LoadLibraryExW LoadLibraryW WideCharToMultiByte LCMapStringW IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW FlushFileBuffers WriteConsoleW

advapi32

RegOpenKeyExW

oleaut32

SysAllocStringLen

mscoree

CorBindToRuntimeEx

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-11_61cbd0da228f125b45ce4f6f3b6a5fe9_elex_glassworm_manuscrypt_rhadamanthys_stop

kernel32

advapi32

oleaut32

mscoree

generic