2026-10-30_c240c194ec612630ca1bc9f510654801_akira_elex_glassworm

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-30_c240c194ec612630ca1bc9f510654801_akira_elex_glassworm
Size 2.5MB
Sample261030-we6pyazzgy
SHA256 a6e5348ae52714bee217800604f5751e4570dbf7326a7de5d72ece4f435f57b8
MD5 c240c194ec612630ca1bc9f510654801
SHA1 2f85ef15910bbeedb223833bcb53ff60082082a2
SHA512 21770a59cf82ecc608c46b2c0bedab160c54bba54a051b01e22e2e90294f96b06ab35c7be27a0dd7e233df349cad985042ef8d3d7abe4fcdc0a1e3acebf67c37
SSDEEP 49152:b4hQd+eK6A9U1EpktAPiE1AFIi/Al3CWcinkFRKa:eukFktpIblyikFY
TLSH
T17DC57C52F30291EEC45B62B0E02D8B3D5AB74214571289E7D6BC9DF635662E0EE3392C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables packed with Themida 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-30_c240c194ec612630ca1bc9f510654801_akira_elex_glassworm

File Explorer

2026-10-30_c240c194ec612630ca1bc9f510654801_akira_elex_glassworm

.exe 2.5MB

2026-10-30_c240c194ec612630ca1bc9f510654801_akira_elex_glassworm

IMPHASH 5655d977f3d37a79ae51ba250193e43a
SHA256 a6e5348ae52714bee217800604f5751e4570dbf7326a7de5d72ece4f435f57b8
MD5 c240c194ec612630ca1bc9f510654801
SHA1 2f85ef15910bbeedb223833bcb53ff60082082a2
SHA512 21770a59cf82ecc608c46b2c0bedab160c54bba54a051b01e22e2e90294f96b06ab35c7be27a0dd7e233df349cad985042ef8d3d7abe4fcdc0a1e3acebf67c37
SSDEEP 49152:b4hQd+eK6A9U1EpktAPiE1AFIi/Al3CWcinkFRKa:eukFktpIblyikFY
TLSH
T17DC57C52F30291EEC45B62B0E02D8B3D5AB74214571289E7D6BC9DF635662E0EE3392C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects executables packed with Themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1701632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

mida_cli.pdb

kernel32

GetFileInformationByHandle GetLastError CreateFileW GetConsoleMode CloseHandle InitializeSListHead SetUnhandledExceptionFilter GetSystemTimePreciseAsFileTime GetSystemTimeAsFileTime FindNextFileW RtlCaptureContext VirtualProtectEx SetThreadContext VirtualQueryEx OpenProcess QueryFullProcessImageNameW CreateToolhelp32Snapshot Module32FirstW Module32NextW ReadProcessMemory GetModuleHandleA GetProcAddress GetModuleHandleW GetCurrentProcessId GetCurrentProcess LoadLibraryExA TerminateProcess WaitForDebugEvent ContinueDebugEvent WriteProcessMemory OpenThread GetThreadContext CreateProcessW GetNativeSystemInfo LoadLibraryA FormatMessageW GetProcessHeap HeapFree HeapReAlloc lstrlenW WaitForSingleObjectEx CreateMutexA ReleaseMutex WideCharToMultiByte SetFilePointerEx SetFileInformationByHandle DuplicateHandle WaitForSingleObject AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW CreateDirectoryW GetFinalPathNameByHandleW GetFileInformationByHandleEx SwitchToThread SetFileTime CreateEventW GetOverlappedResult DeleteFileW FindFirstFileExW FindClose GetFileType GetFullPathNameW GetTempPathW GetModuleFileNameW ExitProcess QueryPerformanceFrequency ReadFile CancelIo HeapAlloc ReadConsoleW MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep CreateThread CompareStringOrdinal WaitForMultipleObjects ReadFileEx SleepEx GetFileAttributesW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW WriteFileEx IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetExitCodeProcess

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

advapi32

RegCloseKey RegQueryValueExW RegEnumKeyExW RegOpenKeyExW

ole32

CoCreateInstance CoInitializeEx

oleaut32

SysFreeString SysStringLen

ntdll

NtCreateNamedPipeFile NtOpenFile RtlNtStatusToDosError NtReadFile NtWriteFile NtQueryInformationProcess

vcruntime140

memmove __current_exception_context memcpy _CxxThrowException memcmp __CxxFrameHandler3 _except_handler4_common memset __current_exception

api-ms-win-crt-math-l1-1-0

log2f __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc terminate _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _controlfp_s _set_app_type _seh_filter_exe _crt_atexit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_c240c194ec612630ca1bc9f510654801_akira_elex_glassworm

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

ole32

oleaut32

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic