2026-07-23_8be6f76da36d9b8ca1cb9e462f43ee9e_akira_amadey_elex_glassworm

General

Target
2026-07-23_8be6f76da36d9b8ca1cb9e462f43ee9e_akira_amadey_elex_glassworm
Size 3.8MB
Sample260724-abtejsdf93
SHA256 6a123a1120a6bb8121b619259c31421ff18b76cc1024bf78ea923362c51c3c00
MD5 8be6f76da36d9b8ca1cb9e462f43ee9e
SHA1 2f795815a494d2953a94bce51bd1d9d7d2b8f776
SHA512 a2632551ab46497e53774e54aca9ed29eaaeee205cf80155a3ae7d8bd98cc5b0051ad4185e695ad64fa57ebe550017ed55f42f32b63cbf08a1dbd73588d96a5d
SSDEEP 49152:JiXcIrcOfnzDH0w9H0ybfGo0s//vkry7T:+rNfnPX8rE
TLSH
T131060A1260D0BEF5C516A07229BB6610FDBE57304B0E8DEBD64B8C6C1A3ABF66D34C45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-23_8be6f76da36d9b8ca1cb9e462f43ee9e_akira_amadey_elex_glassworm

File Explorer

2026-07-23_8be6f76da36d9b8ca1cb9e462f43ee9e_akira_amadey_elex_glassworm

.exe 3.8MB

2026-07-23_8be6f76da36d9b8ca1cb9e462f43ee9e_akira_amadey_elex_glassworm

IMPHASH 870043f1c47477988b8bd9f0f82f1d3d
SHA256 6a123a1120a6bb8121b619259c31421ff18b76cc1024bf78ea923362c51c3c00
MD5 8be6f76da36d9b8ca1cb9e462f43ee9e
SHA1 2f795815a494d2953a94bce51bd1d9d7d2b8f776
SHA512 a2632551ab46497e53774e54aca9ed29eaaeee205cf80155a3ae7d8bd98cc5b0051ad4185e695ad64fa57ebe550017ed55f42f32b63cbf08a1dbd73588d96a5d
SSDEEP 49152:JiXcIrcOfnzDH0w9H0ybfGo0s//vkry7T:+rNfnPX8rE
TLSH
T131060A1260D0BEF5C516A07229BB6610FDBE57304B0E8DEBD64B8C6C1A3ABF66D34C45
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

72:5d:65:0d:87:04:fc:6e:08:14:b8:c9:77:c3:4b:77:a5:51:07:01

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Take-Two Interactive Software\, Inc.,OU=Rockstar Games+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Take-Two Interactive Software\, Inc.,L=New York,ST=New York,C=US

Chains

Jul 23, 2026

CN=Take-Two Interactive Software\, Inc.,OU=Rockstar Games+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Take-Two Interactive Software\, Inc.,L=New York,ST=New York,C=US

Minor OS version

0

Major OS version

6

Entry point

3705130

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Poltarbi.pdb

kernel32

WriteConsoleW GetModuleHandleW FormatMessageW GetModuleHandleA GetFullPathNameW FindFirstFileExW FindClose CreateFileW SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW ExitProcess GetTempPathW DeleteFileW CopyFileExW MoveFileExW CreateWaitableTimerExW SetWaitableTimer Sleep GetFinalPathNameByHandleW CloseHandle HeapAlloc CreateMutexA LoadLibraryA WaitForSingleObjectEx ReleaseMutex GetProcAddress RtlCaptureContext GetStdHandle GetCurrentProcess WaitForSingleObject GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter GetConsoleOutputCP GetStartupInfoW IsProcessorFeaturePresent TerminateProcess RtlUnwind EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RaiseException WriteFile GetModuleFileNameW GetModuleHandleExW FindNextFileW SetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect HeapSize FlushFileBuffers DecodePointer SetLastError SetUnhandledExceptionFilter GetCurrentThreadId GetLastError SetFilePointerEx GetCurrentProcessId GetSystemTimePreciseAsFileTime HeapFree HeapReAlloc GetProcessHeap GetCurrentThread SetThreadStackGuarantee GetConsoleMode AddVectoredExceptionHandler LCMapStringW GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineW GetCommandLineA QueryPerformanceCounter MultiByteToWideChar WideCharToMultiByte lstrlenW GetCurrentDirectoryW GetEnvironmentVariableW CompareStringW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ntdll

NtWriteFile RtlNtStatusToDosError NtReadFile

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

149KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_8be6f76da36d9b8ca1cb9e462f43ee9e_akira_amadey_elex_glassworm

PE Signature issue

kernel32

api-ms-win-core-synch-l1-2-0

ntdll

generic