2026-07-11_4d563c6e9e2e3a06632f65be3f332e79_elex_glassworm_manuscrypt_rhadamanthys_stop

General

Target
2026-07-11_4d563c6e9e2e3a06632f65be3f332e79_elex_glassworm_manuscrypt_rhadamanthys_stop
Size 472KB
Sample260711-lf3dssft2j
SHA256 3b266d06d91896cf897219f4bd7ca558ee3556e5b0db6a1f2f16d3cdaebc57c2
MD5 4d563c6e9e2e3a06632f65be3f332e79
SHA1 fb33dfa974a812ee08ba2113c210efa80f905d62
SHA512 6841d6cb875626e1598f118e1ecf3dc30672c83a55509a2a8ee0fa6fe6e30d8aff418ef2dc1bbedc3a0f6d2ba64f3bcd06c5201c275b5d6ebeb3be4369a6eda3
SSDEEP 12288:ihUGb8EztoXGRbPLPy0l4SGGvGGvGGvGGpBMg:QXxoWRbPLKXSGGvGGvGGvGGp5
TLSH
T13DA48D5A3298CA62D47F0FFA9122411007B4EE179A8BFB1B1ED475DA1C323806D5F6E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-11_4d563c6e9e2e3a06632f65be3f332e79_elex_glassworm_manuscrypt_rhadamanthys_stop

File Explorer

2026-07-11_4d563c6e9e2e3a06632f65be3f332e79_elex_glassworm_manuscrypt_rhadamanthys_stop

.exe 472KB

2026-07-11_4d563c6e9e2e3a06632f65be3f332e79_elex_glassworm_manuscrypt_rhadamanthys_stop

IMPHASH 0dafd88c1a8511ef0fe8f94cc704a88e
SHA256 3b266d06d91896cf897219f4bd7ca558ee3556e5b0db6a1f2f16d3cdaebc57c2
MD5 4d563c6e9e2e3a06632f65be3f332e79
SHA1 fb33dfa974a812ee08ba2113c210efa80f905d62
SHA512 6841d6cb875626e1598f118e1ecf3dc30672c83a55509a2a8ee0fa6fe6e30d8aff418ef2dc1bbedc3a0f6d2ba64f3bcd06c5201c275b5d6ebeb3be4369a6eda3
SSDEEP 12288:ihUGb8EztoXGRbPLPy0l4SGGvGGvGGvGGpBMg:QXxoWRbPLKXSGGvGGvGGvGGp5
TLSH
T13DA48D5A3298CA62D47F0FFA9122411007B4EE179A8BFB1B1ED475DA1C323806D5F6E7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

16342

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

LoadResource SizeofResource WriteFile CloseHandle FindResourceW InitializeCriticalSectionAndSpinCount GetTempPathW GetTempFileNameW CreateFileW MultiByteToWideChar GetModuleHandleW FindResourceExW LockResource SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP RaiseException GetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap EncodePointer DecodePointer RtlUnwind GetCommandLineW GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent InterlockedDecrement ExitProcess GetModuleHandleExW GetProcAddress Sleep IsDebuggerPresent SetLastError InterlockedIncrement GetCurrentThreadId GetFileType GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree OutputDebugStringW LoadLibraryExW LoadLibraryW WideCharToMultiByte LCMapStringW IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW FlushFileBuffers WriteConsoleW

advapi32

RegOpenKeyExW

oleaut32

SysAllocStringLen

mscoree

CorBindToRuntimeEx

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-11_4d563c6e9e2e3a06632f65be3f332e79_elex_glassworm_manuscrypt_rhadamanthys_stop

kernel32

advapi32

oleaut32

mscoree

generic