2026-08-10_6ea68423c136871242b7060e4110d56f_akira_amadey_elex_glassworm

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_6ea68423c136871242b7060e4110d56f_akira_amadey_elex_glassworm
Size 3.5MB
Sample260810-2aa1csvwb1
SHA256 16e22551e2276855d96c882726075def949c2644417ae6f9ef8071310d269240
MD5 6ea68423c136871242b7060e4110d56f
SHA1 58926c0025110d34f53782e0d98f646659627436
SHA512 94e3b63773e8e8fae3ca236d6ec80a90438e95923277bd8ea58214511e09e70adfdd220b5b0bfdc3a4096d5270efd32becf845beadb186430972b6575c7ebe91
SSDEEP 49152:ySoqbMb5I1IWDy0jzpBE/7Wo/UCihnGCTD4D1gXyUroOG70biPfuRUwCnrfsZgWc:rSb5sjzIWo/UConGClCUFG70Srsa
TLSH
T161F59E03B60191FBC60F4171A09DC3FCDE237958572189DFD684ADE9A8A77E02D3A639
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_6ea68423c136871242b7060e4110d56f_akira_amadey_elex_glassworm

File Explorer

2026-08-10_6ea68423c136871242b7060e4110d56f_akira_amadey_elex_glassworm

.exe 3.5MB

2026-08-10_6ea68423c136871242b7060e4110d56f_akira_amadey_elex_glassworm

IMPHASH 2c7636f996920f0cd3be3eb2a6f9fc23
SHA256 16e22551e2276855d96c882726075def949c2644417ae6f9ef8071310d269240
MD5 6ea68423c136871242b7060e4110d56f
SHA1 58926c0025110d34f53782e0d98f646659627436
SHA512 94e3b63773e8e8fae3ca236d6ec80a90438e95923277bd8ea58214511e09e70adfdd220b5b0bfdc3a4096d5270efd32becf845beadb186430972b6575c7ebe91
SSDEEP 49152:ySoqbMb5I1IWDy0jzpBE/7Wo/UCihnGCTD4D1gXyUroOG70biPfuRUwCnrfsZgWc:rSb5sjzIWo/UConGClCUFG70Srsa
TLSH
T161F59E03B60191FBC60F4171A09DC3FCDE237958572189DFD684ADE9A8A77E02D3A639
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2197162

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

inno_updater.pdb

kernel32

LCMapStringW FlushFileBuffers GetModuleHandleW LoadLibraryA GetProcAddress InitializeCriticalSectionEx FlsFree FlsSetValue GetModuleHandleA GetNativeSystemInfo GetSystemInfo LoadLibraryExW VirtualQuery FreeLibrary GetModuleFileNameW HeapAlloc SetHandleInformation FlsGetValue FlsAlloc LoadLibraryExA HeapReAlloc CompareStringW GetSystemTimePreciseAsFileTime SetLastError GetLastError CloseHandle FindClose SetFilePointerEx OpenProcess K32GetModuleFileNameExW TerminateProcess GetCommandLineW CreateFileA HeapFree SetConsoleMode GetConsoleScreenBufferInfo GetStdHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentProcess RtlCaptureContext ReleaseMutex WideCharToMultiByte WaitForSingleObjectEx lstrlenW GetCurrentProcessId CreateMutexA CreateWaitableTimerExW Sleep SetWaitableTimer WaitForSingleObject SwitchToThread GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage QueryPerformanceCounter CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateFileW MoveFileExW SetFileInformationByHandle FormatMessageW DecodePointer GetCommandLineA ExitProcess WriteFile TlsFree TlsSetValue TlsGetValue GetCurrentThreadId TlsAlloc FindFirstFileExW GetFileType GetFileInformationByHandleEx InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatusEx DeleteCriticalSection LeaveCriticalSection CreateIoCompletionPort SetFileCompletionNotificationModes GetFinalPathNameByHandleW PostQueuedCompletionStatus GetProcessHeap EnterCriticalSection EncodePointer GetConsoleMode RtlUnwind RaiseException IsProcessorFeaturePresent GetConsoleOutputCP GetStartupInfoW MultiByteToWideChar WriteConsoleW GetCurrentDirectoryW GetEnvironmentVariableW QueryPerformanceFrequency GetTempPathW GetFileInformationByHandle SetUnhandledExceptionFilter GetFullPathNameW FindNextFileW UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead HeapSize CreateThread VirtualProtect GetModuleHandleExW GetSystemTimeAsFileTime SetConsoleTextAttribute SetConsoleCursorPosition FillConsoleOutputCharacterW FillConsoleOutputAttribute GetComputerNameExW

bcryptprimitives

ProcessPrng

ntdll

NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile NtWriteFile NtReadFile NtOpenFile

crypt32

CertVerifyCertificateChainPolicy CertOpenStore CertFreeCertificateChain CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertFreeCertificateContext CertCloseStore CertGetCertificateChain CertAddCertificateContextToStore CertEnumCertificatesInStore

secur32

InitializeSecurityContextW FreeContextBuffer FreeCredentialsHandle DecryptMessage ApplyControlToken EncryptMessage AcceptSecurityContext QueryContextAttributesW DeleteSecurityContext AcquireCredentialsHandleA

oleaut32

SysFreeString SysStringLen

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

user32

SetDlgItemTextW MessageBoxW EndDialog GetWindowRect DialogBoxParamW ShutdownBlockReasonCreate GetSystemMetrics GetDesktopWindow SetWindowLongW SetWindowPos SendDlgItemMessageW PostThreadMessageW

ws2_32

WSASocketW setsockopt WSAIoctl bind closesocket getpeername WSAGetLastError getsockname connect getsockopt recv getaddrinfo freeaddrinfo WSAStartup WSACleanup send shutdown ioctlsocket WSASend

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

psapi

EnumProcessModules GetModuleFileNameExW GetModuleInformation

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

466KB

Virtual Size

466KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

154KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

660KB

Virtual Size

664KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_6ea68423c136871242b7060e4110d56f_akira_amadey_elex_glassworm

kernel32

bcryptprimitives

ntdll

crypt32

secur32

oleaut32

api-ms-win-core-synch-l1-2-0

user32

ws2_32

advapi32

psapi

shell32

ole32

generic