General
- Target 2026-09-11_18f3876886943eb689682e921fec8970_amadey_elex_glassworm_hijackloader_rhadamanthys_smoke-loader_stop_tofsee_wannacry
- Size 3.4MB
- Sample260912-pzfwpaxcpf
- SHA256 1e7be643d57793805c9354b15949e5a0be4e85f0f3b314c0b3ce263f686ee0e7
- MD5 18f3876886943eb689682e921fec8970
- SHA1 52c81e8da8829421f09041f71e91b9069ee4b635
- SHA512 af047ab2efe1dbf41b3ccf5234a78e6eab24827eb9c37f384da248070564fd894278fa2d58ec8892f873286f8e61884a374f364990c07f59b8dd90a7973702d3
- SSDEEP 49152:kpC0biT3S9tsgX8zEC8ULgCSA/Bkj0nPji0AjJ:kIOiTIOSANjod
- TLSH T1DDF56B1273E84637E0BE563E80B10A7D97B5793B9B37C78F7404B99E58A27428917323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-09-11_18f3876886943eb689682e921fec8970_amadey_elex_glassworm_hijackloader_rhadamanthys_smoke-lo.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-11_18f3876886943eb689682e921fec8970_amadey_elex_glassworm_hijackloader_rhadamanthys_smoke-lo.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-11_18f3876886943eb689682e921fec8970_amadey_elex_glassworm_hijackloader_rhadamanthys_smoke-loader_stop_tofsee_wannacry
- Size 3.4MB
- SHA256 1e7be643d57793805c9354b15949e5a0be4e85f0f3b314c0b3ce263f686ee0e7
- MD5 18f3876886943eb689682e921fec8970
- SHA1 52c81e8da8829421f09041f71e91b9069ee4b635
- SHA512 af047ab2efe1dbf41b3ccf5234a78e6eab24827eb9c37f384da248070564fd894278fa2d58ec8892f873286f8e61884a374f364990c07f59b8dd90a7973702d3
- SSDEEP 49152:kpC0biT3S9tsgX8zEC8ULgCSA/Bkj0nPji0AjJ:kIOiTIOSANjod
- TLSH T1DDF56B1273E84637E0BE563E80B10A7D97B5793B9B37C78F7404B99E58A27428917323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Drops file in System32 directory