2026-10-04_ebb41741792cb688f3fa1b819c4055cc_amadey_chir_elex_glassworm_manuscrypt_rhadamanthys_smoke-loader_stop

General

Target
2026-10-04_ebb41741792cb688f3fa1b819c4055cc_amadey_chir_elex_glassworm_manuscrypt_rhadamanthys_smoke-loader_stop
Size 103KB
Sample261004-2vrtlsyfmg
SHA256 30febdeafa7cebef0b663d9968b28c2a2b9aa70589cc28125a11293a2b927ada
MD5 ebb41741792cb688f3fa1b819c4055cc
SHA1 edfaa5fa9dd144a3add6cfcbf79cf8ea84a0575d
SHA512 7959916f139d51db69930f4b54cead3ad110230170fb790b4f0f17e51faacc3cff6e92d10c90ac86517824d11f7151bc5fc77268d09eacc4b90f9720badc981a
SSDEEP 1536:84TM3JJZDc0tA5gibJxURgofhbbOgPkAG0j3v+Ute9Heq/XzR/osAisKldh:FTM3lptA7bwdGa2Ute9Heq/XVo4V
TLSH
T1C3A3190236D5C572F5B32E306CB45292AF77BD429D3ACD0E2354459D1EB2A81DA3A373
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-04_ebb41741792cb688f3fa1b819c4055cc_amadey_chir_elex_glassworm_manuscrypt_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-04_ebb41741792cb688f3fa1b819c4055cc_amadey_chir_elex_glassworm_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 103KB

2026-10-04_ebb41741792cb688f3fa1b819c4055cc_amadey_chir_elex_glassworm_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH d76b0d681009fd566d7425e08f54123b
SHA256 30febdeafa7cebef0b663d9968b28c2a2b9aa70589cc28125a11293a2b927ada
MD5 ebb41741792cb688f3fa1b819c4055cc
SHA1 edfaa5fa9dd144a3add6cfcbf79cf8ea84a0575d
SHA512 7959916f139d51db69930f4b54cead3ad110230170fb790b4f0f17e51faacc3cff6e92d10c90ac86517824d11f7151bc5fc77268d09eacc4b90f9720badc981a
SSDEEP 1536:84TM3JJZDc0tA5gibJxURgofhbbOgPkAG0j3v+Ute9Heq/XzR/osAisKldh:FTM3lptA7bwdGa2Ute9Heq/XVo4V
TLSH
T1C3A3190236D5C572F5B32E306CB45292AF77BD429D3ACD0E2354459D1EB2A81DA3A373
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

87:54:a5:c2:87:b9:4d:60:40:47:3c:a6:1e:95:55:6e:88:11:8a:e1

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Dec 23, 2005

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7e

Issuer

Key Usages

KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 23, 2002 - Sep 25, 2011

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:87:58:00:03:00:00:00:5a

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 5, 2005 - Apr 5, 2006

Minor OS version

0

Major OS version

5

Entry point

116736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

gacutil.pdb

kernel32

GetVersionExW GetLastError MultiByteToWideChar GetFullPathNameA SetLastError WideCharToMultiByte GetFullPathNameW lstrlenW LocalFree LocalAlloc FormatMessageA FormatMessageW CreateFileA CreateFileW WriteFile GetConsoleOutputCP GetProcAddress GetModuleHandleA GetFileType GetStdHandle CloseHandle lstrlenA ReadFile FreeLibrary HeapFree GetVersionExA HeapAlloc GetProcessHeap RtlUnwind ExitProcess GetModuleFileNameA UnhandledExceptionFilter GetModuleFileNameW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent RaiseException GetCPInfo GetACP GetOEMCP LeaveCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSection Sleep VirtualAlloc HeapReAlloc HeapSize SetFilePointer GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA WriteConsoleW FlushFileBuffers

mscoree

ord22 LoadLibraryShim

user32

LoadStringA LoadStringW

shlwapi

PathCombineW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-04_ebb41741792cb688f3fa1b819c4055cc_amadey_chir_elex_glassworm_manuscrypt_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

mscoree

user32

shlwapi

generic