2026-07-27_b2285bd126c36152d3f58b119a9dd7d6_amadey_dharma_elex_glassworm_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_b2285bd126c36152d3f58b119a9dd7d6_amadey_dharma_elex_glassworm_rhadamanthys_smoke-loader_stop
Size 416KB
Sample260727-rm9pcabe28
SHA256 23fd4cc7f6e2ac045c1060e68b7086fcea571f895ff12fb810171b9227e7e91d
MD5 b2285bd126c36152d3f58b119a9dd7d6
SHA1 73183707fd876ce53b7893f0292e552ac4922246
SHA512 fa2984e9461b3bda3f6208f3676a3cd3253b5caf8bf525b5fa072b868b58e07e277934baf003b040ea35c3d8888ecdfe23994bf858899b9da7ae470633ba1987
SSDEEP 12288:xKmgotakw9rp4DYj1AXFKzphxsD/N8ERy:6o09ouAXFix0b4
TLSH
T18894BE11A7A1C035F5B322F815BA43F9692A79B05730A0CF53CAE5FE52346F4AA30797
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_b2285bd126c36152d3f58b119a9dd7d6_amadey_dharma_elex_glassworm_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-27_b2285bd126c36152d3f58b119a9dd7d6_amadey_dharma_elex_glassworm_rhadamanthys_smoke-loader_stop

.exe 416KB

2026-07-27_b2285bd126c36152d3f58b119a9dd7d6_amadey_dharma_elex_glassworm_rhadamanthys_smoke-loader_stop

IMPHASH 21de328d7cc7e16cdfba704ebdd8de8a
SHA256 23fd4cc7f6e2ac045c1060e68b7086fcea571f895ff12fb810171b9227e7e91d
MD5 b2285bd126c36152d3f58b119a9dd7d6
SHA1 73183707fd876ce53b7893f0292e552ac4922246
SHA512 fa2984e9461b3bda3f6208f3676a3cd3253b5caf8bf525b5fa072b868b58e07e277934baf003b040ea35c3d8888ecdfe23994bf858899b9da7ae470633ba1987
SSDEEP 12288:xKmgotakw9rp4DYj1AXFKzphxsD/N8ERy:6o09ouAXFix0b4
TLSH
T18894BE11A7A1C035F5B322F815BA43F9692A79B05730A0CF53CAE5FE52346F4AA30797
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetConsoleMode GetConsoleCP FlushFileBuffers VirtualAlloc HeapReAlloc HeapSize VirtualFree HeapFree HeapCreate HeapDestroy SetHandleCount GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetSystemTimeAsFileTime QueryPerformanceCounter InitializeCriticalSectionAndSpinCount IsValidCodePage GetCPInfo GetOEMCP GetACP GetModuleFileNameA GetLocaleInfoA OutputDebugStringW GetFileType WriteConsoleW OutputDebugStringA WriteFile GetStdHandle DebugBreak SetStdHandle WriteConsoleA GetConsoleOutputCP SetFilePointer CloseHandle CreateFileA CreateEventA WaitForSingleObject ResetEvent GetLastError FormatMessageA GetCurrentProcessId GetTickCount GetConsoleTitleA SetConsoleTitleA Sleep SetLastError TlsFree GetCurrentThreadId TlsSetValue TlsAlloc TlsGetValue IsDebuggerPresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter IsBadReadPtr HeapValidate GetStartupInfoA GetCommandLineA GetModuleHandleW GetModuleFileNameW RtlUnwind RaiseException LeaveCriticalSection EnterCriticalSection GetConsoleWindow GetProcAddress lstrlenA MultiByteToWideChar GetFullPathNameA HeapAlloc GetCurrentProcess ExitProcess GetModuleHandleA LoadLibraryW LoadLibraryA InterlockedIncrement InterlockedDecrement InitializeCriticalSection DeleteCriticalSection

user32

IsDialogMessageW SendMessageA TranslateAcceleratorA GetWindowRect GetDlgItem CreateDialogParamW GetDC GetSubMenu IsWindowEnabled EnableWindow GetMenu EnableMenuItem DefWindowProcA LoadIconA BeginPaint EndPaint InvalidateRect wsprintfA SetWindowTextA FindWindowA SetWindowPos LoadImageA DestroyAcceleratorTable GetDlgItemTextW ReleaseDC SetScrollRange SetScrollPos GetClientRect GetSysColor DrawTextA GetMenuItemInfoA DestroyMenu SetMenuItemInfoA GetMenuItemCount CreatePopupMenu InsertMenuItemA GetSystemMetrics ShowWindow SetFocus CharLowerBuffA GetDlgCtrlID EnumChildWindows GetWindowTextA GetWindow SetRect FillRect LoadBitmapA IsMenu GetParent GetDesktopWindow MapWindowPoints CreateWindowExA SetScrollInfo CallWindowProcA PostQuitMessage

gdi32

GetTextMetricsA CreateDCA CreateRectRgn DeleteObject Rectangle TextOutA CreateSolidBrush SelectObject SetBkColor SetTextColor SetBkMode GetTextExtentPoint32A CreateCompatibleDC GetMapMode SetMapMode GetObjectA DPtoLP BitBlt DeleteDC CreateCompatibleBitmap GetStockObject CreatePen

comdlg32

ChooseColorA

advapi32

GetUserNameW

ole32

OleUninitialize OleInitialize CoInitialize CreateILockBytesOnHGlobal CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeEx CoInitializeSecurity

oleaut32

SysAllocStringLen SysAllocStringByteLen SysFreeString SysAllocString

netapi32

NetApiBufferFree NetUserGetInfo

psapi

GetModuleInformation EnumProcesses

shlwapi

wnsprintfA

comctl32

ImageList_Create ImageList_ReplaceIcon ImageList_Draw ImageList_AddMasked ImageList_Destroy ImageList_GetImageInfo ord17 ImageList_GetImageCount

imm32

ImmGetDefaultIMEWnd

Name

.text

Size

149KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wata

Size

103KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cita

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.htext

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_b2285bd126c36152d3f58b119a9dd7d6_amadey_dharma_elex_glassworm_rhadamanthys_smoke-loader_stop

kernel32

user32

gdi32

comdlg32

advapi32

ole32

oleaut32

netapi32

psapi

shlwapi

comctl32

imm32

generic