2026-08-16_5f4a71f243b1f56b7864000374101799_elex_glassworm_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-16_5f4a71f243b1f56b7864000374101799_elex_glassworm_rhadamanthys_smoke-loader_stop
Size 1.8MB
Sample260816-e3xcqszclf
SHA256 6bbd0c9892089e19977e26382e6550415226fef03c2306445f6330a5b77eb397
MD5 5f4a71f243b1f56b7864000374101799
SHA1 a257fdf769ffd4008833c91b7b3c0354976d0e64
SHA512 f9b1cbae68f5f83fb166479d2e6dedc82a71e07a721f49a8be0e9891bfec3365747d50e3bd57e9688f79f407bfb0a7e5465056f187e9754a9e4a82c8d488cd70
SSDEEP 49152:pmYpmu8te+6BJsv6tWKFdu9CyjTIu/LyvL/6mShMZtmjNUVrciV5P+7QVg07mTou:pmYp6D6BJsv6tWKFdu9C
TLSH
T185958C10A7E641B7E6F76B7515BF922A8A3BBE62473190DF12CC790A59303D09A37703
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_5f4a71f243b1f56b7864000374101799_elex_glassworm_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-16_5f4a71f243b1f56b7864000374101799_elex_glassworm_rhadamanthys_smoke-loader_stop

.exe 1.8MB

2026-08-16_5f4a71f243b1f56b7864000374101799_elex_glassworm_rhadamanthys_smoke-loader_stop

IMPHASH ed5b3145c6742983f71c83df0f792d94
SHA256 6bbd0c9892089e19977e26382e6550415226fef03c2306445f6330a5b77eb397
MD5 5f4a71f243b1f56b7864000374101799
SHA1 a257fdf769ffd4008833c91b7b3c0354976d0e64
SHA512 f9b1cbae68f5f83fb166479d2e6dedc82a71e07a721f49a8be0e9891bfec3365747d50e3bd57e9688f79f407bfb0a7e5465056f187e9754a9e4a82c8d488cd70
SSDEEP 49152:pmYpmu8te+6BJsv6tWKFdu9CyjTIu/LyvL/6mShMZtmjNUVrciV5P+7QVg07mTou:pmYp6D6BJsv6tWKFdu9C
TLSH
T185958C10A7E641B7E6F76B7515BF922A8A3BBE62473190DF12CC790A59303D09A37703
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

750996

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\_projects\RedefineBSTSVT\Script\vbkrn2.pdb

shlwapi

PathRemoveFileSpecW PathFileExistsW

ws2_32

WSAAsyncSelect

kernel32

FindFirstFileW FindResourceExW FindResourceW LoadResource GetCurrentProcess GetSystemDirectoryW WideCharToMultiByte SizeofResource GetVersionExW GetLastError FindClose LockResource FindNextFileW GetWindowsDirectoryW GetCurrentProcessId LocalFree MultiByteToWideChar InterlockedIncrement InterlockedDecrement LoadLibraryW GetProcAddress Sleep WaitForSingleObjectEx CreateFileA GetFileSize HeapAlloc HeapFree GetModuleHandleW GetProcessHeap WriteFile GetFileAttributesW TerminateProcess ReadFile GetModuleFileNameW CreateFileW FlushFileBuffers GetTempPathW DeviceIoControl GetSystemInfo WaitForMultipleObjects GetFileAttributesExW EnterCriticalSection DeleteFileW GetPrivateProfileStringW GetPrivateProfileIntW FreeResource InterlockedCompareExchange InterlockedExchange SetFilePointer GetSystemTimeAsFileTime SetLastError LeaveCriticalSection TerminateThread GetModuleFileNameA CloseHandle CreateThread GetUserDefaultLCID GetLocaleInfoW GetSystemTime SetUnhandledExceptionFilter GetTickCount VerifyVersionInfoW VerSetConditionMask FormatMessageW CompareStringW GetCommandLineW TlsFree TlsSetValue GetCurrentThreadId SwitchToThread GetCurrentThread TlsAlloc SetThreadPriority ResumeThread GetThreadPriority TlsGetValue DuplicateHandle QueryPerformanceFrequency QueryPerformanceCounter GetDateFormatW GetTimeFormatW GetCurrencyFormatW GetUserDefaultUILanguage GetFileType SetEndOfFile GetLogicalDrives MapViewOfFile UnmapViewOfFile SetErrorMode GetCurrentDirectoryW GetFullPathNameW CompareStringA FindFirstFileExW CreateMutexA CreateEventA ReleaseMutex GetVersionExA AreFileApisANSI UnlockFile LockFile LockFileEx UnlockFileEx GetFileAttributesA GetTempPathA FormatMessageA GetFullPathNameA GetDiskFreeSpaceA GetDiskFreeSpaceW CreateFileMappingA VirtualAlloc VirtualFree RaiseException InitializeCriticalSection DeleteCriticalSection CreateEventW DeleteFileA ResetEvent SetEvent WaitForSingleObject HeapDestroy HeapReAlloc HeapSize UnhandledExceptionFilter IsDebuggerPresent ExitThread ExitProcess GetTimeZoneInformation GetConsoleCP GetConsoleMode SetStdHandle RtlUnwind GetCPInfo LCMapStringW LCMapStringA GetStringTypeW GetACP GetOEMCP IsValidCodePage HeapCreate GetStdHandle GetStringTypeA SetHandleCount GetStartupInfoA LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleHandleA SetEnvironmentVariableA SetEnvironmentVariableW WriteConsoleA GetConsoleOutputCP WriteConsoleW GetLocaleInfoA EnumSystemLocalesA IsValidLocale

user32

CharNextExA PeekMessageW PostMessageW SetTimer CallNextHookEx KillTimer GetQueueStatus DefWindowProcW GetWindowLongW SetWindowLongW CreateWindowExW RegisterClassW UnregisterClassW DestroyWindow UnhookWindowsHookEx SetWindowsHookExW DispatchMessageW TranslateMessage MsgWaitForMultipleObjectsEx

advapi32

RegOpenKeyExW RegQueryValueExW OpenProcessToken CopySid FreeSid GetLengthSid GetTokenInformation RegCloseKey

shell32

SHGetSpecialFolderPathW

ole32

CoInitialize CoCreateInstance CoUninitialize

generic

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=10, id=105, version=2067,

count=2, id=150, version=20413,

count=56, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=109, productName=VS2005 build 50727, version=50727,

count=259, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=220, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=132, productName=VS2008 build 21022, version=21022,

count=7, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=41, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=474, id=1, productName=Unmarked objects,

count=123, id=138, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,