2026-05-27_fb69c88cd279956dcfa55817a8580a6e_amadey_elex_glassworm_smoke-loader_stop

General

Target
2026-05-27_fb69c88cd279956dcfa55817a8580a6e_amadey_elex_glassworm_smoke-loader_stop
Size 1.9MB
Sample260527-ebe95sey2n
SHA256 00cf458fadbd35db26ed469f7a8e9a27dbafc6039d26d0af611bba3a4f2f3145
MD5 fb69c88cd279956dcfa55817a8580a6e
SHA1 780409b48fc47252c4e1a325d447f64275257900
SHA512 1b6d60c2a451c1ed4ab504aa7de221f07d35cc73701a345d0e6505e2e667d790eb34063b7e4d8010a1ccf5dc28e4a990b1310dff0797779de4e4e3b6341f2a97
SSDEEP 24576:N45HfxGCV5tLtWR6SBvd9TgRNGaefYk8KeflD+eP:N4pfxGuNHStTgRJ2YzLfJ+e
TLSH
T1F195CF22D3528C25F4A340B782EC54FFCD21F130978A50CBBAA5DBD5E6157E0623B5BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-27_fb69c88cd279956dcfa55817a8580a6e_amadey_elex_glassworm_smoke-loader_stop

File Explorer

2026-05-27_fb69c88cd279956dcfa55817a8580a6e_amadey_elex_glassworm_smoke-loader_stop

.exe 1.9MB

2026-05-27_fb69c88cd279956dcfa55817a8580a6e_amadey_elex_glassworm_smoke-loader_stop

IMPHASH 2a19b6f3e40597434d04316d1939ef38
SHA256 00cf458fadbd35db26ed469f7a8e9a27dbafc6039d26d0af611bba3a4f2f3145
MD5 fb69c88cd279956dcfa55817a8580a6e
SHA1 780409b48fc47252c4e1a325d447f64275257900
SHA512 1b6d60c2a451c1ed4ab504aa7de221f07d35cc73701a345d0e6505e2e667d790eb34063b7e4d8010a1ccf5dc28e4a990b1310dff0797779de4e4e3b6341f2a97
SSDEEP 24576:N45HfxGCV5tLtWR6SBvd9TgRNGaefYk8KeflD+eP:N4pfxGuNHStTgRJ2YzLfJ+e
TLSH
T1F195CF22D3528C25F4A340B782EC54FFCD21F130978A50CBBAA5DBD5E6157E0623B5BA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

396596

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\dev\auth\auth\Debug\mysqlauth.pdb

wsock32

inet_addr WSAStartup WSACleanup gethostbyname getpeername shutdown closesocket setsockopt send recv inet_ntoa getservbyname ntohs socket WSAGetLastError ioctlsocket htons connect

kernel32

HeapSize GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID SetEnvironmentVariableW SetEnvironmentVariableA GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryA VirtualQuery GetProcessTimes GetCurrentProcess FormatMessageA GetDiskFreeSpaceA GetFileAttributesA GetTimeZoneInformation Sleep GetCurrentDirectoryA GetLastError GetVersionExA GetSystemTime GetLocaleInfoW SetNamedPipeHandleState WaitNamedPipeA CreateFileA UnmapViewOfFile WaitForSingleObject SetEvent MapViewOfFile OpenFileMappingA OpenEventA GetWindowsDirectoryA LeaveCriticalSection EnterCriticalSection ReadFile WriteFile WaitForMultipleObjects InitializeCriticalSection TlsAlloc DeleteCriticalSection TlsFree TlsSetValue TlsGetValue InterlockedIncrement SetThreadPriority CreateSemaphoreA InterlockedDecrement ReleaseSemaphore GetFileAttributesExA CompareStringA CompareStringW CloseHandle RemoveDirectoryA GetEnvironmentStrings FreeEnvironmentStringsA HeapFree GetCurrentProcessId GetModuleHandleW GetProcAddress ExitProcess GetSystemTimeAsFileTime MoveFileA DeleteFileA FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA FindFirstFileA HeapReAlloc HeapAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter SetEndOfFile SetFileAttributesA GetFileInformationByHandle PeekNamedPipe GetFileType FindNextFileA WideCharToMultiByte SetFileTime LocalFileTimeToFileTime SystemTimeToFileTime GetTimeFormatA GetDateFormatA CreateDirectoryA SetConsoleCtrlHandler ReadConsoleInputA SetConsoleMode GetConsoleMode PeekConsoleInputA GetNumberOfConsoleInputEvents WriteConsoleW GetStdHandle GetModuleFileNameW RaiseException IsDebuggerPresent DebugBreak MultiByteToWideChar lstrlenA LoadLibraryA GetCommandLineA ExitThread ResumeThread CreateThread SetLastError GetCurrentThreadId GetCurrentThread HeapCreate HeapDestroy VirtualFree FatalAppExitA VirtualAlloc SetHandleCount GetStartupInfoA TerminateProcess GetConsoleCP FlushFileBuffers RtlUnwind GetModuleFileNameA FreeLibrary InterlockedExchange InitializeCriticalSectionAndSpinCount GetFullPathNameA SetCurrentDirectoryA GetModuleHandleA GetCPInfo GetACP GetOEMCP IsValidCodePage SetFilePointer SetStdHandle LCMapStringA LCMapStringW LoadLibraryW GetProcessHeap

advapi32

RegEnumValueA RegCloseKey RegOpenKeyExA

shell32

ShellExecuteA

Name

.textbss

Size

Virtual Size

377KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

779KB

Virtual Size

778KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.0MB

Virtual Size

10.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

787B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-27_fb69c88cd279956dcfa55817a8580a6e_amadey_elex_glassworm_smoke-loader_stop

wsock32

kernel32

advapi32

shell32

generic