2026-10-21_8684b8f4d93b07eca5f3f798ec8937ad_amadey_elex_glassworm_rhadamanthys_smoke-loader

General

Target
2026-10-21_8684b8f4d93b07eca5f3f798ec8937ad_amadey_elex_glassworm_rhadamanthys_smoke-loader
Size 3.5MB
Sample261022-xk25datvas
SHA256 585e70c8e37f352e91efcff27d88137a69f7e5f64309d4f242e9a00a62c899c7
MD5 8684b8f4d93b07eca5f3f798ec8937ad
SHA1 0a411af1b1f5a3483e8c5282d309115534da4cc7
SHA512 e32863d2f882a97a0f56fef9ab441bc677f188af998f42ea941ea7698f70247d35194ef9f93b8af655d25f1d72f64b5a85fac81c6b2a57b2acb8dc16813bec86
SSDEEP 49152:xnWnlpWORpTLYrxuzOCg8BnUL3UDkB/ZnoHwoIln+2yj5FJPSSxMMF:xWnlVRaxAnUSHK1ONNMMF
TLSH
T1A2068D1237F18135F2F31A309E7A5BA566BAFD625F34C98B2358350C1F31A909A36727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-21_8684b8f4d93b07eca5f3f798ec8937ad_amadey_elex_glassworm_rhadamanthys_smoke-loader

File Explorer

2026-10-21_8684b8f4d93b07eca5f3f798ec8937ad_amadey_elex_glassworm_rhadamanthys_smoke-loader

.exe 3.5MB

2026-10-21_8684b8f4d93b07eca5f3f798ec8937ad_amadey_elex_glassworm_rhadamanthys_smoke-loader

IMPHASH 8c11856c93d5453a7f28931c0c03e00c
SHA256 585e70c8e37f352e91efcff27d88137a69f7e5f64309d4f242e9a00a62c899c7
MD5 8684b8f4d93b07eca5f3f798ec8937ad
SHA1 0a411af1b1f5a3483e8c5282d309115534da4cc7
SHA512 e32863d2f882a97a0f56fef9ab441bc677f188af998f42ea941ea7698f70247d35194ef9f93b8af655d25f1d72f64b5a85fac81c6b2a57b2acb8dc16813bec86
SSDEEP 49152:xnWnlpWORpTLYrxuzOCg8BnUL3UDkB/ZnoHwoIln+2yj5FJPSSxMMF:xWnlVRaxAnUSHK1ONNMMF
TLSH
T1A2068D1237F18135F2F31A309E7A5BA566BAFD625F34C98B2358350C1F31A909A36727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

3699609

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetStartupInfoA SetHandleCount TlsAlloc GetCurrentThreadId TlsFree TlsSetValue TlsGetValue QueryPerformanceCounter SetUnhandledExceptionFilter LoadLibraryA GetOEMCP GetCPInfo LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW IsBadReadPtr IsBadCodePtr DeleteCriticalSection SetLastError GetLastError InterlockedExchange RaiseException GetTempPathW lstrlenW GetACP GetModuleFileNameW lstrcpynW GetExitCodeProcess FormatMessageW InitializeCriticalSection GetTickCount GetModuleHandleW WaitForSingleObjectEx GetFileType GetLocaleInfoA GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetModuleFileNameA GetStdHandle IsBadWritePtr MultiByteToWideChar WideCharToMultiByte FindResourceW LockResource LoadResource CloseHandle LoadLibraryExW GetCurrentDirectoryW SetCurrentDirectoryW EnumResourceNamesW CreateFileW CreateFileMappingW MapViewOfFile UnmapViewOfFile CreateFileA WriteFile DeleteFileA FreeLibrary GetCurrentProcess GetProcAddress GetSystemTimeAsFileTime ExitProcess InterlockedCompareExchange Sleep InterlockedDecrement EnterCriticalSection LeaveCriticalSection GetCurrentProcessId VirtualQuery TerminateProcess GetVersionExA HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetModuleHandleA GetStartupInfoW VirtualProtect VirtualAlloc GetSystemInfo RtlUnwind HeapCreate VirtualFree CloseHandle CloseHandle CloseHandle GetStartupInfoA SetHandleCount TlsAlloc GetCurrentThreadId TlsFree TlsSetValue TlsGetValue QueryPerformanceCounter SetUnhandledExceptionFilter LoadLibraryA GetOEMCP GetCPInfo LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW IsBadReadPtr IsBadCodePtr DeleteCriticalSection SetLastError GetLastError InterlockedExchange RaiseException GetTempPathW lstrlenW GetACP GetModuleFileNameW lstrcpynW GetExitCodeProcess FormatMessageW InitializeCriticalSection GetTickCount GetModuleHandleW WaitForSingleObjectEx GetFileType GetLocaleInfoA GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetModuleFileNameA GetStdHandle IsBadWritePtr MultiByteToWideChar WideCharToMultiByte FindResourceW LockResource LoadResource CloseHandle LoadLibraryExW GetCurrentDirectoryW SetCurrentDirectoryW EnumResourceNamesW CreateFileW CreateFileMappingW MapViewOfFile UnmapViewOfFile CreateFileA WriteFile DeleteFileA FreeLibrary GetCurrentProcess GetProcAddress GetSystemTimeAsFileTime ExitProcess InterlockedCompareExchange Sleep InterlockedDecrement EnterCriticalSection LeaveCriticalSection GetCurrentProcessId VirtualQuery TerminateProcess GetVersionExA HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetModuleHandleA GetStartupInfoW VirtualProtect VirtualAlloc GetSystemInfo RtlUnwind HeapCreate VirtualFree CloseHandle CloseHandle ExitProcess EnterCriticalSection CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle VirtualProtect CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle ExitProcess CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle VirtualProtect CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle VirtualProtect CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle GetFileSizeEx CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle GetFileSizeEx GetFileSizeEx CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CreateFileA CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle SetFilePointerEx SetLastError CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle UnmapViewOfFile CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle ExitProcess CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle LoadLibraryA GetProcAddress VirtualAlloc VirtualFree LoadLibraryA GetProcAddress

shell32

SHCreateDirectoryExW SHFileOperationW SHCreateDirectoryExW SHFileOperationW

user32

DestroyWindow LoadStringW CreateWindowExW MessageBoxW CharLowerW DestroyWindow LoadStringW CreateWindowExW MessageBoxW CharLowerW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-21_8684b8f4d93b07eca5f3f798ec8937ad_amadey_elex_glassworm_rhadamanthys_smoke-loader

kernel32

shell32

user32

generic