2026-08-16_27510ecd8f940e37c106a52a8af774f5_amadey_chir_elex_glassworm_rhadamanthys_smoke-loader_stop

General

Target
2026-08-16_27510ecd8f940e37c106a52a8af774f5_amadey_chir_elex_glassworm_rhadamanthys_smoke-loader_stop
Size 141KB
Sample260816-3rewbazbpd
SHA256 735925bed40bc1e899652fe33d4e67717b18211f4177661318a4ce742ae71b67
MD5 27510ecd8f940e37c106a52a8af774f5
SHA1 aca2ee0b2c4f613916dcb940936cf148bc55c663
SHA512 959eee9966fb8e930ab93c651eeca67ab04050d92bad9db27955df21d0947b07d2513a8a595bc2d81984a9226a9e30ab231049148cf9ae3b1f8c413c72063973
SSDEEP 3072:aQEqFLILekflQrZQ1I+qmQ3oanPZqulpVlM70jpmEXVIhj4ouaAWMIOcPiv79QHf:0qFLIqkfmII+04oAUraC3chVRnRgIeZ8
TLSH
T105E3A60572F8406DF4F38A7058B187A2C97BBD31AE32D25D1AC406BE5E31D91DA22B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-16_27510ecd8f940e37c106a52a8af774f5_amadey_chir_elex_glassworm_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-16_27510ecd8f940e37c106a52a8af774f5_amadey_chir_elex_glassworm_rhadamanthys_smoke-loader_stop

.exe 141KB

2026-08-16_27510ecd8f940e37c106a52a8af774f5_amadey_chir_elex_glassworm_rhadamanthys_smoke-loader_stop

IMPHASH 697377e7bec4638f1a92f7ae3cab7937
SHA256 735925bed40bc1e899652fe33d4e67717b18211f4177661318a4ce742ae71b67
MD5 27510ecd8f940e37c106a52a8af774f5
SHA1 aca2ee0b2c4f613916dcb940936cf148bc55c663
SHA512 959eee9966fb8e930ab93c651eeca67ab04050d92bad9db27955df21d0947b07d2513a8a595bc2d81984a9226a9e30ab231049148cf9ae3b1f8c413c72063973
SSDEEP 3072:aQEqFLILekflQrZQ1I+qmQ3oanPZqulpVlM70jpmEXVIhj4ouaAWMIOcPiv79QHf:0qFLIqkfmII+04oAUraC3chVRnRgIeZ8
TLSH
T105E3A60572F8406DF4F38A7058B187A2C97BBD31AE32D25D1AC406BE5E31D91DA22B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

15:97:e2:1d:91:93:5b:38:1d:8c:8d:fa:ba:0a:9a:b7:51:9a:30:66

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Facebook\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Facebook\, Inc.,L=Menlo Park,ST=California,C=US

Chains

Jul 2, 2012

CN=Facebook\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Facebook\, Inc.,L=Menlo Park,ST=California,C=US

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Facebook\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Facebook\, Inc.,L=Menlo Park,ST=California,C=US

Serial Number

27:87:80:83:40:0d:b8:6d:07:db:ab:6b:43:fb:a4:9c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2012 - Jun 19, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

152432

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

FacebookUpdate_unsigned.pdb

advapi32

GetTokenInformation RegOpenKeyExW OpenProcessToken

kernel32

GetCommandLineW FindResourceExW FindResourceW FreeLibrary LoadResource LoadLibraryExW VerSetConditionMask GetCurrentProcess GetModuleHandleW SizeofResource GetModuleFileNameW lstrlenW RaiseException VerifyVersionInfoW GetLastError GetProcAddress LockResource GetFileAttributesExW CloseHandle SetLastError LocalAlloc SetStdHandle SetFilePointer InterlockedExchange LoadLibraryA EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetVersionExA HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW WideCharToMultiByte TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleCP GetConsoleMode FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA

ole32

CoCreateGuid

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_27510ecd8f940e37c106a52a8af774f5_amadey_chir_elex_glassworm_rhadamanthys_smoke-loader_stop

PE Signature issue

advapi32

kernel32

ole32

generic