2026-07-11_deeb8c3050a28fe6961e27af004261cc_elex_glassworm_magniber_rhadamanthys_smoke-loader_stop

General

Target
2026-07-11_deeb8c3050a28fe6961e27af004261cc_elex_glassworm_magniber_rhadamanthys_smoke-loader_stop
Size 784KB
Sample260711-sd3ecaey7t
SHA256 a6590bd89c717a0ac0f96c3e38dc5de95d24ebb5e827565851d12cbfeede9014
MD5 deeb8c3050a28fe6961e27af004261cc
SHA1 7b13335494108d2d9dc9ed514213ef13e961805c
SHA512 ce03f091b68497e1ffc855632508af96def081053fa6810eb7f1460f0e4d7f3edbbf6c4bed231742c2f7c9dd049efa4cac417671a272cfb2771b202c5ef3aa32
SSDEEP 12288:bSPWVyjZQvD1n6yrGYmqO7MgX3d9FM/TJggXe9ahpQGwvb:2ljZQv/47MgX3dXMLagXhpID
TLSH
T10F058B25776FDD55D42E1AB78862C52812B6B9078F82E77B7EC92FCF0C713890642293
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing base64 encoded User Agent 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_B64_Encoded_UserAgent

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-11_deeb8c3050a28fe6961e27af004261cc_elex_glassworm_magniber_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-11_deeb8c3050a28fe6961e27af004261cc_elex_glassworm_magniber_rhadamanthys_smoke-loader_stop

.exe 784KB

2026-07-11_deeb8c3050a28fe6961e27af004261cc_elex_glassworm_magniber_rhadamanthys_smoke-loader_stop

IMPHASH b7ebea437c5ce69fa2a675f1af8abccd
SHA256 a6590bd89c717a0ac0f96c3e38dc5de95d24ebb5e827565851d12cbfeede9014
MD5 deeb8c3050a28fe6961e27af004261cc
SHA1 7b13335494108d2d9dc9ed514213ef13e961805c
SHA512 ce03f091b68497e1ffc855632508af96def081053fa6810eb7f1460f0e4d7f3edbbf6c4bed231742c2f7c9dd049efa4cac417671a272cfb2771b202c5ef3aa32
SSDEEP 12288:bSPWVyjZQvD1n6yrGYmqO7MgX3d9FM/TJggXe9ahpQGwvb:2ljZQv/47MgX3dXMLagXhpID
TLSH
T10F058B25776FDD55D42E1AB78862C52812B6B9078F82E77B7EC92FCF0C713890642293
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects executables containing base64 encoded User Agent
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

19956

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

FindResourceW LoadResource WriteFile InitializeCriticalSectionAndSpinCount SizeofResource FindResourceExW MultiByteToWideChar GetTempPathW LockResource CloseHandle GetModuleHandleW CreateFileW GetTempFileNameW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP RaiseException GetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap EncodePointer DecodePointer GetCommandLineW RtlUnwind IsDebuggerPresent IsProcessorFeaturePresent InterlockedDecrement ExitProcess GetModuleHandleExW GetProcAddress AreFileApisANSI Sleep GetStdHandle GetModuleFileNameW SetLastError InterlockedIncrement GetCurrentThread GetCurrentThreadId GetFileType GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree CreateSemaphoreW FatalAppExitA InterlockedExchange FreeLibrary LoadLibraryExW SetConsoleCtrlHandler IsValidCodePage GetACP GetOEMCP GetCPInfo OutputDebugStringW LoadLibraryW WideCharToMultiByte GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStringTypeW FlushFileBuffers WriteConsoleW

advapi32

RegOpenKeyExW

oleaut32

SysAllocStringLen

mscoree

CorBindToRuntimeEx

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-11_deeb8c3050a28fe6961e27af004261cc_elex_glassworm_magniber_rhadamanthys_smoke-loader_stop

kernel32

advapi32

oleaut32

mscoree

generic