2026-07-11_b3f36279910a483b938b428a7c7a2cfa_elex_glassworm_manuscrypt_rhadamanthys_stop

General

Target
2026-07-11_b3f36279910a483b938b428a7c7a2cfa_elex_glassworm_manuscrypt_rhadamanthys_stop
Size 473KB
Sample260711-sxpmlady6k
SHA256 24be5e959f3b347a9144989475d163e6bde392988ab2398ac718edc60030fba1
MD5 b3f36279910a483b938b428a7c7a2cfa
SHA1 e7312849051a01f7b8fa08c1712c44ffa1fcd090
SHA512 19e58190937a87fc16ec8d7585ff426744bb407d38fa06812bf4cfdd1952b647e738e7622a3b57ae580bf418161ee41c03f665caf080a8c5e6d484de9a5e15fd
SSDEEP 12288:ihUGb8EztoXGRbPLPy0l4SGGvGGvGGvGGpBMh:QXxoWRbPLKXSGGvGGvGGvGGpY
TLSH
T13CA48D5A3298CA62D47F4FFAA122411007B0EE179A8BF71B1ED471DA1C323806D5F6E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-11_b3f36279910a483b938b428a7c7a2cfa_elex_glassworm_manuscrypt_rhadamanthys_stop

File Explorer

2026-07-11_b3f36279910a483b938b428a7c7a2cfa_elex_glassworm_manuscrypt_rhadamanthys_stop

.exe 473KB

2026-07-11_b3f36279910a483b938b428a7c7a2cfa_elex_glassworm_manuscrypt_rhadamanthys_stop

IMPHASH 0dafd88c1a8511ef0fe8f94cc704a88e
SHA256 24be5e959f3b347a9144989475d163e6bde392988ab2398ac718edc60030fba1
MD5 b3f36279910a483b938b428a7c7a2cfa
SHA1 e7312849051a01f7b8fa08c1712c44ffa1fcd090
SHA512 19e58190937a87fc16ec8d7585ff426744bb407d38fa06812bf4cfdd1952b647e738e7622a3b57ae580bf418161ee41c03f665caf080a8c5e6d484de9a5e15fd
SSDEEP 12288:ihUGb8EztoXGRbPLPy0l4SGGvGGvGGvGGpBMh:QXxoWRbPLKXSGGvGGvGGvGGpY
TLSH
T13CA48D5A3298CA62D47F4FFAA122411007B0EE179A8BF71B1ED471DA1C323806D5F6E7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

16342

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

LoadResource SizeofResource WriteFile CloseHandle FindResourceW InitializeCriticalSectionAndSpinCount GetTempPathW GetTempFileNameW CreateFileW MultiByteToWideChar GetModuleHandleW FindResourceExW LockResource SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP RaiseException GetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap EncodePointer DecodePointer RtlUnwind GetCommandLineW GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent InterlockedDecrement ExitProcess GetModuleHandleExW GetProcAddress Sleep IsDebuggerPresent SetLastError InterlockedIncrement GetCurrentThreadId GetFileType GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree OutputDebugStringW LoadLibraryExW LoadLibraryW WideCharToMultiByte LCMapStringW IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW FlushFileBuffers WriteConsoleW

advapi32

RegOpenKeyExW

oleaut32

SysAllocStringLen

mscoree

CorBindToRuntimeEx

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-11_b3f36279910a483b938b428a7c7a2cfa_elex_glassworm_manuscrypt_rhadamanthys_stop

kernel32

advapi32

oleaut32

mscoree

generic