2026-07-30_3511388e7f6faa2a02750f9a19f861fa_amadey_elex_glassworm_poet-rat_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_3511388e7f6faa2a02750f9a19f861fa_amadey_elex_glassworm_poet-rat_smoke-loader_stop
Size 13.6MB
Sample260730-1bcpxagj2x
SHA256 ce63d43b78145ced165ac57e0e72cf6379e68aad5935e06049375146d3f67111
MD5 3511388e7f6faa2a02750f9a19f861fa
SHA1 9bfd85ef140e83e5f1cc5d87a4a9d6f6c9c6a6af
SHA512 bfad91e2db7ac484ad4f0803442508731544655def5e19e364cb9cf0ff714b194369ac1012b73170436ffb4d30658330862524853343485ae4a2d8b291dd2596
SSDEEP 393216:AVTJra2BnSzXER8IgpTUrzz+SopcvoOQbVl4effnK:ENBncS8thgzj5voxbVKeffK
TLSH
T1BCE61211EE81C93FD743E17D5809D5D7BA3A51AA628987330BE00E96CA24D4CDA17FCE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

backdoor rat

Malware Config

Signatures

SimpleHelp remote administration tool 1 IoCs

SimpleHelp is a remote administration tool that can be used as a backdoor

backdoor rat

resource	yara_rule
sample	rat_simplehelp

File Explorer

2026-07-30_3511388e7f6faa2a02750f9a19f861fa_amadey_elex_glassworm_poet-rat_smoke-loader_stop

.exe 13.6MB

2026-07-30_3511388e7f6faa2a02750f9a19f861fa_amadey_elex_glassworm_poet-rat_smoke-loader_stop

IMPHASH ec3d55528df9b48ff8e5d2ff74321ad6
SHA256 ce63d43b78145ced165ac57e0e72cf6379e68aad5935e06049375146d3f67111
MD5 3511388e7f6faa2a02750f9a19f861fa
SHA1 9bfd85ef140e83e5f1cc5d87a4a9d6f6c9c6a6af
SHA512 bfad91e2db7ac484ad4f0803442508731544655def5e19e364cb9cf0ff714b194369ac1012b73170436ffb4d30658330862524853343485ae4a2d8b291dd2596
SSDEEP 393216:AVTJra2BnSzXER8IgpTUrzz+SopcvoOQbVl4effnK:ENBncS8thgzj5voxbVKeffK
TLSH
T1BCE61211EE81C93FD743E17D5809D5D7BA3A51AA628987330BE00E96CA24D4CDA17FCE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

SimpleHelp remote administration tool

SimpleHelp is a remote administration tool that can be used as a backdoor

backdoor rat

Digest

31:b0:66:91:18:e8:db:b5:f0:25:91:b0:0c:f3:2e:85:4d:0b:b3:db:bb:e0:cd:c9:eb:43:aa:07:61:81:83:50

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=SC331902,CN=SimpleHelp Ltd,O=SimpleHelp Ltd,ST=Midlothian,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130853636f746c616e64,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Jul 15, 2026

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Digest

d7:5e:a5:83:9f:97:60:8b:00:b4:bf:f2:ed:e4:af:08:18:79:25:ed

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Jul 15, 2026

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:b9:3d:d9:e7:e9:26:32:ac:d6:0a:be:ac:38

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

4b:2c:3b:01:01:8b:ad:2a:bc:8c:7b:5b:3e:ed:90:57

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 22, 2021 - Mar 21, 2046

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Globalsign R45 TSA for Authenticode 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:b8:30:0d:fb:a8:75:b3:3b:57:cc:26:37:82

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

Serial Number

88:df:10:3c:59:00:2f:69:0f:44:29:d9:10:54:87:8b

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 15, 2024 - Mar 15, 2027

Minor OS version

Major OS version

Entry point

125697

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

timeGetTime

comctl32

InitCommonControlsEx

wininet

HttpSendRequestA InternetErrorDlg InternetOpenA InternetSetOptionA InternetReadFile InternetCrackUrlA InternetConnectA InternetOpenUrlA HttpQueryInfoA InternetCloseHandle InternetQueryOptionA HttpOpenRequestA

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle WinHttpOpen WinHttpGetProxyForUrl

kernel32

GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings MoveFileExA FreeLibrary Sleep GetProcAddress LoadLibraryA GetVersion GetTempPathA WaitForSingleObject SetEvent TerminateThread CreateEventA GetLastError GetModuleHandleA CloseHandle CreateMutexA ReleaseMutex CreateThread SetEnvironmentVariableA GlobalFree DeleteFileA InitializeCriticalSection LeaveCriticalSection SetStdHandle DeleteCriticalSection GetExitCodeProcess CreateProcessA GetCurrentDirectoryA lstrlenA GetCurrentProcess FormatMessageA GetShortPathNameA SetCurrentDirectoryA LocalAlloc GetVersionExA LocalFree FreeEnvironmentStringsA SetFilePointer HeapSize ReadFile RtlUnwind FlushFileBuffers GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount GetOEMCP GetACP GetCPInfo InterlockedDecrement SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleFileNameA GetStdHandle WriteFile WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEndOfFile CompareStringA CompareStringW EnterCriticalSection InterlockedExchange RaiseException HeapFree HeapAlloc FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileA FindNextFileA FindClose MoveFileA ExitProcess GetTimeFormatA GetDateFormatA GetDriveTypeA GetFullPathNameA GetTimeZoneInformation GetSystemTimeAsFileTime ExitThread GetCurrentThreadId MultiByteToWideChar WideCharToMultiByte GetFileAttributesA CreateDirectoryA RemoveDirectoryA GetCommandLineA GetProcessHeap HeapReAlloc TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapDestroy HeapCreate VirtualFree VirtualAlloc

user32

SetTimer GetWindowRect KillTimer SetWindowPos GetDesktopWindow DestroyWindow GetMessageA PostThreadMessageA MonitorFromPoint LoadIconA SendMessageA GetMonitorInfoA TranslateMessage SetWindowLongA GetWindowLongA CreateWindowExA PeekMessageA DefWindowProcA GetCursorPos ShowWindow DispatchMessageA SystemParametersInfoA LoadCursorA ValidateRect RegisterClassA

advapi32

GetUserNameA GetExplicitEntriesFromAclA GetNamedSecurityInfoA EqualSid ConvertStringSidToSidA SetNamedSecurityInfoA SetEntriesInAclA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_3511388e7f6faa2a02750f9a19f861fa_amadey_elex_glassworm_poet-rat_smoke-loader_stop

winmm

comctl32

wininet

winhttp

kernel32

user32

advapi32

generic