2026-08-10_288327f9394b2e7008f6f235da041e62_elex_glassworm_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_288327f9394b2e7008f6f235da041e62_elex_glassworm_rhadamanthys_smoke-loader_stop
Size 1.8MB
Sample260810-bda7esstby
SHA256 75352962b4b4966692a0ad92f5f19c0d7ae3c7635e193f7ebf841e4139d79da3
MD5 288327f9394b2e7008f6f235da041e62
SHA1 2d93bcc1db6c6199b16d066bca6f1f2b790e1e92
SHA512 747fc8915b1b28a65061c7eaac67bb7f1026d6300322c7fa0c9af35632b99f226ed0d2819cbc620560e1dbc78147139a47fc224323e1f538dd95d1466449fb96
SSDEEP 49152:g3DqFO33qBV80Jsv6tWKFdu9C2Twu/LyvL/6mShMZtmjNUVrciV5P+7QVg07qJ/7:oDqF43S80Jsv6tWKFdu9C
TLSH
T1E6957C00A7E641B7F6F75A7555BF922A863BBE22473191DF12CC790A69303E09A37703
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_288327f9394b2e7008f6f235da041e62_elex_glassworm_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-10_288327f9394b2e7008f6f235da041e62_elex_glassworm_rhadamanthys_smoke-loader_stop

.exe 1.8MB

2026-08-10_288327f9394b2e7008f6f235da041e62_elex_glassworm_rhadamanthys_smoke-loader_stop

IMPHASH 6707951a68f998f21364f7bd751f1c24
SHA256 75352962b4b4966692a0ad92f5f19c0d7ae3c7635e193f7ebf841e4139d79da3
MD5 288327f9394b2e7008f6f235da041e62
SHA1 2d93bcc1db6c6199b16d066bca6f1f2b790e1e92
SHA512 747fc8915b1b28a65061c7eaac67bb7f1026d6300322c7fa0c9af35632b99f226ed0d2819cbc620560e1dbc78147139a47fc224323e1f538dd95d1466449fb96
SSDEEP 49152:g3DqFO33qBV80Jsv6tWKFdu9C2Twu/LyvL/6mShMZtmjNUVrciV5P+7QVg07qJ/7:oDqF43S80Jsv6tWKFdu9C
TLSH
T1E6957C00A7E641B7F6F75A7555BF922A863BBE22473191DF12CC790A69303E09A37703
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

758913

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\_projects\RedefineBSTSVT\Script\vbkrn2.pdb

shlwapi

PathRemoveFileSpecW PathFileExistsW

ws2_32

WSAAsyncSelect

kernel32

HeapDestroy HeapReAlloc HeapSize UnhandledExceptionFilter IsDebuggerPresent ExitThread ExitProcess GetTimeZoneInformation GetConsoleCP WaitForSingleObject SetEvent InitializeCriticalSection LeaveCriticalSection EnterCriticalSection ResetEvent CreateEventW DeleteCriticalSection CloseHandle FindFirstFileW FindResourceExW FindResourceW LoadResource GetCurrentProcess GetSystemDirectoryW WideCharToMultiByte SizeofResource GetVersionExW GetLastError FindClose LockResource FindNextFileW GetWindowsDirectoryW GetCurrentProcessId LocalFree MultiByteToWideChar InterlockedIncrement InterlockedDecrement LoadLibraryW GetProcAddress Sleep WaitForSingleObjectEx CreateFileA GetFileSize HeapAlloc HeapFree GetModuleHandleW GetProcessHeap WriteFile GetFileAttributesW TerminateProcess ReadFile CreateFileW FlushFileBuffers GetTempPathW GetConsoleMode DeviceIoControl GetSystemInfo WaitForMultipleObjects GetFileAttributesExW DeleteFileW GetPrivateProfileStringW GetModuleFileNameW GetPrivateProfileIntW FreeResource InterlockedCompareExchange InterlockedExchange SetFilePointer GetSystemTimeAsFileTime SetLastError TerminateThread GetModuleFileNameA DeleteFileA CreateThread GetUserDefaultLCID GetLocaleInfoW GetSystemTime SetUnhandledExceptionFilter GetTickCount VerifyVersionInfoW VerSetConditionMask FormatMessageW CompareStringW GetCommandLineW TlsFree TlsSetValue GetCurrentThreadId SwitchToThread GetCurrentThread TlsAlloc SetThreadPriority ResumeThread GetThreadPriority TlsGetValue DuplicateHandle QueryPerformanceFrequency QueryPerformanceCounter CompareStringA GetTimeFormatW GetCurrencyFormatW GetUserDefaultUILanguage GetFileType SetEndOfFile GetLogicalDrives MapViewOfFile UnmapViewOfFile SetErrorMode GetCurrentDirectoryW GetFullPathNameW FindFirstFileExW CreateMutexA CreateEventA ReleaseMutex GetVersionExA AreFileApisANSI UnlockFile LockFile LockFileEx UnlockFileEx GetFileAttributesA GetTempPathA FormatMessageA GetFullPathNameA GetDiskFreeSpaceA GetDiskFreeSpaceW CreateFileMappingA VirtualAlloc VirtualFree GetACP GetOEMCP IsValidCodePage GetStdHandle RaiseException SetStdHandle RtlUnwind GetCPInfo LCMapStringW LCMapStringA GetStringTypeW HeapCreate GetStringTypeA SetHandleCount GetStartupInfoA LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleHandleA SetEnvironmentVariableA SetEnvironmentVariableW WriteConsoleA GetConsoleOutputCP WriteConsoleW GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetDateFormatW

user32

CharNextExA PeekMessageW PostMessageW SetTimer CallNextHookEx KillTimer GetQueueStatus DefWindowProcW SetWindowLongW CreateWindowExW RegisterClassW UnregisterClassW DestroyWindow UnhookWindowsHookEx SetWindowsHookExW DispatchMessageW TranslateMessage MsgWaitForMultipleObjectsEx GetWindowLongW

advapi32

OpenProcessToken RegOpenKeyExW RegCloseKey GetTokenInformation RegQueryValueExW FreeSid GetLengthSid CopySid

shell32

SHGetSpecialFolderPathW

ole32

CoUninitialize CoCreateInstance CoInitialize

generic

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=9, id=105, version=2067,

count=2, id=150, version=20413,

count=57, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=109, productName=VS2005 build 50727, version=50727,

count=307, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=222, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=132, productName=VS2008 build 21022, version=21022,

count=4, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=41, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=432, id=1, productName=Unmarked objects,

count=111, id=138, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,