Extracted

• • Target
    2026-10-19_35ac4e19e5f7df6c8585cb9585dd4faf_amadey_elex_glassworm_rhadamanthys_smoke-loader_stop
  • Size 13.3MB
  • SHA256 c15fb7cad371b43cc9cbd47cc8193e4ffdb4992ea7151fd7dc3b061ab256807c
  • MD5 35ac4e19e5f7df6c8585cb9585dd4faf
  • SHA1 22d85cc0b34928be971541fd33fbfd46e90fda08
  • SHA512 daf83591484f628d3a60c9130d6fee00c0dc2237e180650c08dd14889656b183f46db039fef76ba9166ef7b7623bbe12e69eee3c81bade399858645ae1496b93
  • SSDEEP 196608:g6c1qpT4zNgmqsJLKeV1tbq5AzA4qj44HNF7MiNs8w8U2VDoUOZj/d42RuT7zj:g6cY7iV1458AH44Hn7MiNRHDUh8/
  • TLSH
    T1D4E62322B6C1C072D053423299A9E336BA7AFD214B31C917B3D4678E1E712D2BB36757
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarediscoverymacoutepersistencespywarestealerworm

  • Detects Macoute worm

  • Family: Macoute

    Macoute is a Windows worm.

    wormmacoute

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2