2026-09-20_4e7dd4a543d030c7f13eb8cc2861e9d4_akira_amadey_elex_glassworm

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-20_4e7dd4a543d030c7f13eb8cc2861e9d4_akira_amadey_elex_glassworm
Size 2.5MB
Sample260920-ym8wdadj7x
SHA256 320db76f6e39496e785070d449f64567040d8b895da1015948b0b51afb64845a
MD5 4e7dd4a543d030c7f13eb8cc2861e9d4
SHA1 57684d2ebf1ad94c8f740ab0c22df7aebc897cda
SHA512 9c44b9def3714ece7a082efe5316bba3fcb1f2685cb4af6b60b5698835ca8e10a7953af47a50c888f062bc4537bba0b68e6ce051fb9ce8eae49f136222a57dc4
SSDEEP 49152:Ms6tVxmwhNxSYdykLV2B3Hf3FOunYcW1BknyyMSsvM0PuW:GVxrNxSeLVwv7xnyy+
TLSH
T13DC55C43F943A0F7C3CF4271B41DB36F9B27594547108DE7A790ADB8A8752A01EA2B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-20_4e7dd4a543d030c7f13eb8cc2861e9d4_akira_amadey_elex_glassworm

File Explorer

2026-09-20_4e7dd4a543d030c7f13eb8cc2861e9d4_akira_amadey_elex_glassworm

.exe 2.5MB

2026-09-20_4e7dd4a543d030c7f13eb8cc2861e9d4_akira_amadey_elex_glassworm

IMPHASH a711ed0229e282de5037e2f53b82d653
SHA256 320db76f6e39496e785070d449f64567040d8b895da1015948b0b51afb64845a
MD5 4e7dd4a543d030c7f13eb8cc2861e9d4
SHA1 57684d2ebf1ad94c8f740ab0c22df7aebc897cda
SHA512 9c44b9def3714ece7a082efe5316bba3fcb1f2685cb4af6b60b5698835ca8e10a7953af47a50c888f062bc4537bba0b68e6ce051fb9ce8eae49f136222a57dc4
SSDEEP 49152:Ms6tVxmwhNxSYdykLV2B3Hf3FOunYcW1BknyyMSsvM0PuW:GVxrNxSeLVwv7xnyy+
TLSH
T13DC55C43F943A0F7C3CF4271B41DB36F9B27594547108DE7A790ADB8A8752A01EA2B2D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1832850

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

window_capture_native.pdb

kernel32

FormatMessageW LoadLibraryExA GetProcessHeap GetLastError HeapAlloc HeapFree GetSystemTimeAsFileTime InitializeSListHead SetFilePointerEx IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter HeapSize GetStartupInfoW IsProcessorFeaturePresent RtlUnwind RaiseException HeapReAlloc GetSystemInfo CloseHandle CompareStringOrdinal AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SwitchToThread CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject Sleep SetLastError GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW FlushFileBuffers WriteFileEx SleepEx ReadFileEx TerminateProcess GetExitCodeProcess GetCurrentProcessId QueryPerformanceCounter QueryPerformanceFrequency GetCurrentProcess RtlCaptureContext GetProcAddress ReleaseMutex WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA lstrlenW CreateMutexA CreateFileW SetFileInformationByHandle DeleteFileW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileExW FindClose GetModuleHandleW GetModuleFileNameW CreateNamedPipeW GetEnvironmentStringsW FreeEnvironmentStringsW GetFullPathNameW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetStdHandle DuplicateHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW ReadConsoleW CreateThread GetModuleHandleA UnmapViewOfFile LoadLibraryExW FreeLibrary MoveFileExW CreateDirectoryW LocalFree CreateJobObjectW SetInformationJobObject AssignProcessToJobObject CreateMutexW OpenProcess GetProcessTimes QueryFullProcessImageNameW GetModuleHandleExW GetTickCount64 VirtualProtect CreateFileMappingW MapViewOfFile IsWow64Process ProcessIdToSessionId GetCurrentThreadId EncodePointer LCMapStringW CompareStringW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc InitializeCriticalSectionEx TlsGetValue FlsFree FlsSetValue FlsGetValue FlsAlloc TlsSetValue TlsFree WriteFile ExitProcess GetCommandLineA DecodePointer FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo SetEnvironmentVariableW GetStringTypeW GetFileType SetStdHandle

oleaut32

GetErrorInfo

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ntdll

RtlNtStatusToDosError NtWriteFile NtReadFile

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory RoInitialize

ole32

CoIncrementMTAUsage

user32

GetWindow GetAncestor GetClassNameW IsWindow EnumChildWindows SetWindowsHookExW GetWindowThreadProcessId EnumWindows GetWindowTextW GetClientRect ClientToScreen GetCursorInfo GetSystemMetrics UnhookWindowsHookEx GetWindowPlacement GetWindowDisplayAffinity RegisterWindowMessageW TranslateMessage DispatchMessageW PeekMessageW SetWinEventHook IsZoomed GetWindowRect SystemParametersInfoW IsWindowVisible IsIconic ShowWindow SetWindowPlacement SetWindowPos MonitorFromWindow EnumDisplayMonitors GetMonitorInfoW DisplayConfigGetDeviceInfo QueryDisplayConfig GetDisplayConfigBufferSizes PrintWindow UnhookWinEvent SendMessageTimeoutW SetForegroundWindow GetForegroundWindow GetGUIThreadInfo GetWindowLongW ReleaseDC SetProcessDPIAware CloseDesktop OpenInputDesktop GetThreadDesktop GetProcessWindowStation GetUserObjectInformationW GetDC

gdi32

SelectObject DeleteObject DeleteDC GdiFlush BitBlt CreateDIBSection CreateCompatibleDC

d3d11

CreateDirect3D11DeviceFromDXGIDevice D3D11CreateDevice

dwmapi

DwmGetWindowAttribute DwmFlush

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation OpenProcessToken ConvertSidToStringSidW GetNamedSecurityInfoW

dxgi

CreateDXGIFactory1

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-20_4e7dd4a543d030c7f13eb8cc2861e9d4_akira_amadey_elex_glassworm

kernel32

oleaut32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

api-ms-win-core-winrt-l1-1-0

ole32

user32

gdi32

d3d11

dwmapi

advapi32

dxgi

generic