2026-08-16_5462af736b7f32a4a5f17f83216b17a0_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-16_5462af736b7f32a4a5f17f83216b17a0_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop
Size 1.8MB
Sample260816-e7nldszdke
SHA256 d88a8ddf0c8b01323f597d6e12486171ff23b8a93d4fed71aca603d87b08aef0
MD5 5462af736b7f32a4a5f17f83216b17a0
SHA1 8f4d34cbccd7d1c269fc607c87fc220fae25f9e3
SHA512 bc8c39588dae891083ca5c2b029c9826568aba23f3b4998a56fd0bfa53187eb3091604964328945f72b6b371f704f7445c5aaff4c24ba55f7fb4e1b8675dc6b7
SSDEEP 49152:GjBQpcicv0rK6AEftJsv6tWKFdu9CbTXuULyvL/6mShMZtmjNUVrciV5P+7QVg06:G9QpUvPEftJsv6tWKFdu9C3s
TLSH
T1D8957C00A6E641B7F5F71B3555BF922A863BBE224731A5DF12CC790A59303E09A37B07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_5462af736b7f32a4a5f17f83216b17a0_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-08-16_5462af736b7f32a4a5f17f83216b17a0_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

.exe 1.8MB

2026-08-16_5462af736b7f32a4a5f17f83216b17a0_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 2a55ef391c019cff7d207fc748ad4823
SHA256 d88a8ddf0c8b01323f597d6e12486171ff23b8a93d4fed71aca603d87b08aef0
MD5 5462af736b7f32a4a5f17f83216b17a0
SHA1 8f4d34cbccd7d1c269fc607c87fc220fae25f9e3
SHA512 bc8c39588dae891083ca5c2b029c9826568aba23f3b4998a56fd0bfa53187eb3091604964328945f72b6b371f704f7445c5aaff4c24ba55f7fb4e1b8675dc6b7
SSDEEP 49152:GjBQpcicv0rK6AEftJsv6tWKFdu9CbTXuULyvL/6mShMZtmjNUVrciV5P+7QVg06:G9QpUvPEftJsv6tWKFdu9C3s
TLSH
T1D8957C00A6E641B7F5F71B3555BF922A863BBE224731A5DF12CC790A59303E09A37B07
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

758948

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\_projects\RedefineBSTSVT\Script\vbkrn2.pdb

shlwapi

PathRemoveFileSpecW PathFileExistsW

ws2_32

WSAAsyncSelect

kernel32

LoadResource GetCurrentProcess GetSystemDirectoryW WideCharToMultiByte SizeofResource GetVersionExW GetLastError FindClose LockResource FindNextFileW GetWindowsDirectoryW GetCurrentProcessId LocalFree MultiByteToWideChar InterlockedIncrement InterlockedDecrement LoadLibraryW GetProcAddress Sleep WaitForSingleObjectEx CreateFileA GetFileSize HeapAlloc HeapFree GetModuleHandleW GetProcessHeap WriteFile GetFileAttributesW TerminateProcess ReadFile GetModuleFileNameW CreateFileW FlushFileBuffers GetTempPathW DeviceIoControl GetSystemInfo WaitForMultipleObjects GetFileAttributesExW DeleteCriticalSection GetPrivateProfileStringW GetPrivateProfileIntW FreeResource InterlockedCompareExchange InterlockedExchange SetFilePointer GetSystemTimeAsFileTime SetLastError TerminateThread GetModuleFileNameA DeleteFileA CreateEventW FindResourceW CreateThread GetUserDefaultLCID GetLocaleInfoW GetSystemTime SetUnhandledExceptionFilter GetTickCount VerifyVersionInfoW VerSetConditionMask FormatMessageW CompareStringW GetCommandLineW TlsFree TlsSetValue GetCurrentThreadId SwitchToThread GetCurrentThread TlsAlloc SetThreadPriority ResumeThread GetThreadPriority TlsGetValue DuplicateHandle QueryPerformanceFrequency QueryPerformanceCounter GetDateFormatW GetTimeFormatW GetCurrencyFormatW GetUserDefaultUILanguage GetFileType SetEndOfFile GetLogicalDrives MapViewOfFile UnmapViewOfFile SetErrorMode GetCurrentDirectoryW GetFullPathNameW FindFirstFileExW CompareStringA CreateEventA ReleaseMutex GetVersionExA AreFileApisANSI UnlockFile LockFile LockFileEx UnlockFileEx GetFileAttributesA GetTempPathA FormatMessageA GetFullPathNameA GetDiskFreeSpaceA GetDiskFreeSpaceW CreateFileMappingA VirtualAlloc VirtualFree GetACP GetOEMCP IsValidCodePage GetStdHandle RaiseException FindResourceExW FindFirstFileW CloseHandle ResetEvent EnterCriticalSection LeaveCriticalSection InitializeCriticalSection SetEvent WaitForSingleObject HeapDestroy HeapReAlloc HeapSize UnhandledExceptionFilter IsDebuggerPresent ExitThread ExitProcess GetTimeZoneInformation GetConsoleCP GetConsoleMode SetStdHandle RtlUnwind GetCPInfo LCMapStringW LCMapStringA GetStringTypeW HeapCreate GetStringTypeA SetHandleCount GetStartupInfoA LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleHandleA SetEnvironmentVariableA SetEnvironmentVariableW WriteConsoleA GetConsoleOutputCP WriteConsoleW GetLocaleInfoA EnumSystemLocalesA IsValidLocale DeleteFileW CreateMutexA

user32

CharNextExA PeekMessageW PostMessageW SetTimer CallNextHookEx KillTimer GetQueueStatus DefWindowProcW GetWindowLongW SetWindowLongW CreateWindowExW RegisterClassW UnregisterClassW DestroyWindow UnhookWindowsHookEx SetWindowsHookExW DispatchMessageW TranslateMessage MsgWaitForMultipleObjectsEx

advapi32

RegOpenKeyExW RegQueryValueExW OpenProcessToken RegCloseKey CopySid FreeSid GetLengthSid GetTokenInformation

shell32

SHGetSpecialFolderPathW

ole32

CoUninitialize CoInitialize CoCreateInstance

generic

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=10, id=105, version=2067,

count=2, id=150, version=20413,

count=57, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=109, productName=VS2005 build 50727, version=50727,

count=308, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=222, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=132, productName=VS2008 build 21022, version=21022,

count=7, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=41, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=480, id=1, productName=Unmarked objects,

count=125, id=138, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,