2026-10-11_85cec73aaf32f18f654b9250e8a1116b_amadey_elex_glassworm_karagany_rhadamanthys_smoke-loader_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_85cec73aaf32f18f654b9250e8a1116b_amadey_elex_glassworm_karagany_rhadamanthys_smoke-loader_tofsee
Size 1.7MB
Sample261012-vpcdeacz4s
SHA256 e8808894d1d388e05c30e9db4873dbff01b756d3b72bbe13190d5d0d14e40c0e
MD5 85cec73aaf32f18f654b9250e8a1116b
SHA1 b07ceacec2dca6dbfe8c9e23786e4a8e2d0fca8a
SHA512 cc3987471198c20e18aeb4d1e679f8b54b2d3fbae78ebc4a4e622689cd253b459f34d703efb13baed012fb3df0e281fbc3c12a9b3e2106bdd8f7bef1816e7c18
SSDEEP 3072:Wy0N28mDd+/NEmQhqR1K4mzWPmlIbJrw1ovX:Wy0NuM1jXi4kIb13
TLSH
T10D858D3132E080B3E2A319705DB1EA7196BDBC358B31459BEB981E6E6E706C1D23D357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_85cec73aaf32f18f654b9250e8a1116b_amadey_elex_glassworm_karagany_rhadamanthys_smoke-loader_tofsee

File Explorer

2026-10-11_85cec73aaf32f18f654b9250e8a1116b_amadey_elex_glassworm_karagany_rhadamanthys_smoke-loader_tofsee

.exe 1.7MB

2026-10-11_85cec73aaf32f18f654b9250e8a1116b_amadey_elex_glassworm_karagany_rhadamanthys_smoke-loader_tofsee

IMPHASH 25eed7fa6b29d83223b6de8faeb5be1a
SHA256 e8808894d1d388e05c30e9db4873dbff01b756d3b72bbe13190d5d0d14e40c0e
MD5 85cec73aaf32f18f654b9250e8a1116b
SHA1 b07ceacec2dca6dbfe8c9e23786e4a8e2d0fca8a
SHA512 cc3987471198c20e18aeb4d1e679f8b54b2d3fbae78ebc4a4e622689cd253b459f34d703efb13baed012fb3df0e281fbc3c12a9b3e2106bdd8f7bef1816e7c18
SSDEEP 3072:Wy0N28mDd+/NEmQhqR1K4mzWPmlIbJrw1ovX:Wy0NuM1jXi4kIb13
TLSH
T10D858D3132E080B3E2A319705DB1EA7196BDBC358B31459BEB981E6E6E706C1D23D357
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10564

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapFree HeapCreate SetLastError InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection FindVolumeClose GetVersionExW FindNextVolumeW GetDiskFreeSpaceExW FindFirstVolumeW IsBadReadPtr LocalAlloc LocalFree CreateNamedPipeW GetCommandLineW GetCurrentThreadId SetCurrentDirectoryW CreateMutexW ReadDirectoryChangesW CreateFileMappingW CreateEventW WaitForMultipleObjects ReleaseMutex GetFileSize MapViewOfFile UnmapViewOfFile GlobalLock GlobalUnlock GetDriveTypeW GetVolumePathNamesForVolumeNameW FileTimeToSystemTime FindNextVolumeMountPointW GetCurrentDirectoryW FindVolumeMountPointClose FindFirstVolumeMountPointW GetOEMCP FileTimeToLocalFileTime GetVolumeNameForVolumeMountPointW ExpandEnvironmentStringsW HeapAlloc RtlUnwind TerminateProcess IsDebuggerPresent UnhandledExceptionFilter GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetStdHandle RaiseException GetStringTypeW LCMapStringW TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage InterlockedDecrement InterlockedIncrement GetCPInfo HeapSize HeapCompact HeapReAlloc GetVolumeInformationW SetFileAttributesW DeleteFileW FindNextFileW FindClose GetFileSizeEx IsProcessorFeaturePresent GetStartupInfoW HeapSetInformation GetCommandLineA DecodePointer CreateFileW ReadFile GetSystemWow64DirectoryW GetSystemDirectoryW WriteFile SetFileTime SetFilePointer GetEnvironmentVariableW FindFirstFileW CreateToolhelp32Snapshot Process32NextW Process32FirstW GetSystemTime GetLocalTime MoveFileW SetThreadPriority MultiByteToWideChar lstrcmpW GetACP FreeConsole CopyFileW GetCurrentThread GetTickCount GetModuleHandleW SleepEx SystemTimeToFileTime SetUnhandledExceptionFilter CreateProcessW FreeLibrary SetErrorMode lstrlenA ExitProcess lstrcmpiW GetProcAddress LoadLibraryW GetLastError GetCurrentProcess GetExitCodeThread ExitThread CreateThread CloseHandle TerminateThread WaitForSingleObject Sleep lstrcpyW GetWindowsDirectoryW lstrcatW GetTempPathW EncodePointer lstrlenW GetModuleFileNameW lstrcpynW GetComputerNameW OpenMutexW

user32

RegisterClassExW SetWindowLongW GetUserObjectInformationW SetThreadDesktop PostQuitMessage ReleaseDC PeekMessageW GetProcessWindowStation GetDesktopWindow GetWindowRect SetProcessWindowStation OpenClipboard GetClipboardData GetForegroundWindow CloseClipboard GetKeyboardLayoutNameW DispatchMessageW DefWindowProcW UnregisterDeviceNotification CreateWindowExW ShowWindow SetTimer GetMessageW GetThreadDesktop KillTimer RegisterDeviceNotificationW GetKeyboardType wsprintfA wsprintfW CharLowerW GetDC

gdi32

CreateCompatibleDC SelectObject BitBlt DeleteDC GetDIBits DeleteObject CreateCompatibleBitmap

winspool.drv

EnumPrintersW GetPrinterDataW OpenPrinterW ClosePrinter

advapi32

OpenSCManagerW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges LookupAccountSidA QueryServiceStatus CryptDestroyKey CryptEncrypt CryptImportKey CryptSetKeyParam CryptHashData CryptDestroyHash CryptCreateHash CryptReleaseContext CryptGetHashParam SetEntriesInAclW RegSetValueExW RegCloseKey RegOpenKeyExW RegEnumValueW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryInfoKeyW RegOpenKeyW RegQueryValueExW RegCreateKeyExW RegEnumKeyW GetTokenInformation OpenThreadToken CheckTokenMembership FreeSid AllocateAndInitializeSid GetUserNameW ChangeServiceConfigW CryptGenRandom StartServiceW OpenServiceW CryptAcquireContextW CloseServiceHandle

shell32

CommandLineToArgvW SHGetFolderPathW

ole32

IIDFromString CoCreateInstance CoInitialize CoInitializeSecurity CoTaskMemFree CoUninitialize

oleaut32

SysAllocString VariantClear VariantInit VariantChangeType

rpcrt4

RpcStringFreeW UuidToStringW UuidCreate

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

secur32

GetComputerObjectNameW

wininet

InternetGetLastResponseInfoW InternetGetConnectedState

ws2_32

WSAStartup WSACleanup

shlwapi

PathAppendW PathRemoveFileSpecW StrStrA

winmm

waveInGetDevCapsW mixerGetLineInfoW mixerSetControlDetails waveInClose waveInGetErrorTextW waveInPrepareHeader waveInGetNumDevs mixerGetControlDetailsW waveInUnprepareHeader waveInStart mixerOpen mixerGetLineControlsW mixerClose waveInOpen waveInReset waveInAddBuffer

crypt32

CryptUnprotectData

mpr

WNetAddConnection2W WNetCancelConnectionW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_85cec73aaf32f18f654b9250e8a1116b_amadey_elex_glassworm_karagany_rhadamanthys_smoke-loader_tofsee

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

rpcrt4

wtsapi32

secur32

wininet

ws2_32

shlwapi

winmm

crypt32

mpr

generic