2026-08-10_d6e482b3eb225d1f059960008db65257_akira_amadey_elex_glassworm

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_d6e482b3eb225d1f059960008db65257_akira_amadey_elex_glassworm
Size 3.1MB
Sample260810-caf4yahj6t
SHA256 c172c600ab91b9d728bd03f4ddae1320bed1324cec20046ce38d361eeff56c53
MD5 d6e482b3eb225d1f059960008db65257
SHA1 a57a89974c89f2a4711c23476372400cbab90190
SHA512 01ba4d8ca6528b184579668dbda9e9e7c718ff099aeae47e5fafd3449ce54118a02b31fd24ce953558df396f3227555199f81ae3b19a1c7a27bc1412c4837f88
SSDEEP 49152:YUduzfew7SR11pSd75N259nnVMtV1OlfAQgdHA2mvR:uewuR4d75ttShNKY5
TLSH
T1EBE57B41FAA341FADA4B0470302EB63FDB32650D871CCAE3DBE45E60A96A3E114B555F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_d6e482b3eb225d1f059960008db65257_akira_amadey_elex_glassworm

File Explorer

2026-08-10_d6e482b3eb225d1f059960008db65257_akira_amadey_elex_glassworm

.exe 3.1MB

2026-08-10_d6e482b3eb225d1f059960008db65257_akira_amadey_elex_glassworm

IMPHASH 67241be87dc9bb2692f12ef080e34ecd
SHA256 c172c600ab91b9d728bd03f4ddae1320bed1324cec20046ce38d361eeff56c53
MD5 d6e482b3eb225d1f059960008db65257
SHA1 a57a89974c89f2a4711c23476372400cbab90190
SHA512 01ba4d8ca6528b184579668dbda9e9e7c718ff099aeae47e5fafd3449ce54118a02b31fd24ce953558df396f3227555199f81ae3b19a1c7a27bc1412c4837f88
SSDEEP 49152:YUduzfew7SR11pSd75N259nnVMtV1OlfAQgdHA2mvR:uewuR4d75ttShNKY5
TLSH
T1EBE57B41FAA341FADA4B0470302EB63FDB32650D871CCAE3DBE45E60A96A3E114B555F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2446430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

MicrosoftEdgeUpdate.pdb

bcryptprimitives

ProcessPrng

kernel32

TerminateProcess GetExitCodeProcess AllocConsole CreateMutexW GetModuleHandleW EnumResourceNamesW BeginUpdateResourceW UpdateResourceW EndUpdateResourceW GetFileAttributesW SleepEx ReadFileEx PostQueuedCompletionStatus HeapReAlloc GetStringTypeW SetEnvironmentVariableW GetCPInfo GetOEMCP GetACP GetProcessId GetSystemTimePreciseAsFileTime SetLastError SetThreadStackGuarantee GetCurrentThread GetStdHandle SwitchToThread IsValidCodePage UnhandledExceptionFilter IsDebuggerPresent GetQueuedCompletionStatusEx GetCommandLineW GetCommandLineA RaiseException CreateIoCompletionPort SetFileCompletionNotificationModes GetFinalPathNameByHandleW SetFileAttributesW CompareStringW Sleep GetModuleHandleA LockResource SizeofResource LCMapStringW DeleteCriticalSection InitializeCriticalSectionEx LoadResource EnterCriticalSection EncodePointer GetCurrentThreadId GetCurrentProcess ReleaseMutex WaitForSingleObjectEx LoadLibraryA CreateMutexA GetConsoleMode GetConsoleOutputCP WriteConsoleW HeapAlloc FindResourceW CreateDirectoryW GetFullPathNameW FindFirstFileExW CreateFileW SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx RtlUnwind GetModuleFileNameW GetTempPathW DecodePointer SetUnhandledExceptionFilter SetHandleInformation DeleteFileW InitializeSListHead CopyFileExW MoveFileExW GetFileType WriteFileEx CreateWaitableTimerExW SetWaitableTimer ExitProcess WaitForMultipleObjects GetOverlappedResult CreateEventW CancelIo ReadFile GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW DuplicateHandle SetFilePointerEx FindNextFileW GetSystemInfo FlushFileBuffers HeapSize LoadLibraryExW WaitForSingleObject VirtualProtect CloseHandle SetStdHandle GetLastError CreateThread LeaveCriticalSection FindClose HeapFree GetProcessHeap GetCurrentProcessId GetProcAddress QueryPerformanceCounter AddVectoredExceptionHandler GetCurrentDirectoryW RtlCaptureContext lstrlenW WideCharToMultiByte MultiByteToWideChar GetEnvironmentVariableW FormatMessageW QueryPerformanceFrequency GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetModuleHandleExW GetSystemTimeAsFileTime GetStartupInfoW IsProcessorFeaturePresent FlsAlloc FlsGetValue FlsSetValue FlsFree WriteFile FreeLibrary

crypt32

CertDuplicateCertificateChain CertFreeCertificateContext CertDuplicateCertificateContext CertEnumCertificatesInStore CertFreeCertificateChain CertDuplicateStore CertCloseStore CertOpenStore CertVerifyCertificateChainPolicy CertGetCertificateChain CertAddCertificateContextToStore

secur32

DeleteSecurityContext EncryptMessage AcceptSecurityContext InitializeSecurityContextW QueryContextAttributesW AcquireCredentialsHandleA DecryptMessage FreeCredentialsHandle ApplyControlToken FreeContextBuffer

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ws2_32

WSASocketW WSASend WSAIoctl bind freeaddrinfo getsockname getpeername shutdown send WSACleanup recv getsockopt getaddrinfo select connect closesocket WSAGetLastError ioctlsocket setsockopt WSAStartup

ntdll

RtlNtStatusToDosError NtDeviceIoControlFile NtCancelIoFileEx NtCreateNamedPipeFile NtCreateFile NtWriteFile NtReadFile NtOpenFile

bcrypt

BCryptGenRandom

advapi32

SystemFunction036 RegQueryValueExW RegOpenKeyExW RegCloseKey RegSetValueExW RegCreateKeyExW

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

521KB

Virtual Size

520KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_d6e482b3eb225d1f059960008db65257_akira_amadey_elex_glassworm

bcryptprimitives

kernel32

crypt32

secur32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

bcrypt

advapi32

generic