2026-06-28_c94103443f99ee1c030adb50f9e02ae6_elex_glassworm_smoke-loader_stop_wapomi

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-28_c94103443f99ee1c030adb50f9e02ae6_elex_glassworm_smoke-loader_stop_wapomi
Size 6.1MB
Sample260628-xs71lab17t
SHA256 d65ef2c1e3a22311008c7a7d8b31e92095e5cb47c4f0f91a750c9ca20c7354eb
MD5 c94103443f99ee1c030adb50f9e02ae6
SHA1 dbfd75244f2d4433af8d51a2b801a777e96c919d
SHA512 e963b7ff30e54a289353e79a70c5f91ee0bb55ace64f0fddc20f37c921501f321d4d944d3d6feb5cca51c86bc8d4cc5602029646429eb7ebe3297191ef5d7279
SSDEEP 98304:lAAzv+uWj2PlbFncZKewtoS1lKEGMzVAVTcTRuCADGkJVhqwlAtT:uArOmyAjtoS1fVKVTIRuCse
TLSH
T179564C01A201953AFCE704F289BE5ABE95286B31172864C3E3C85D7E6BB65F33E31517
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-28_c94103443f99ee1c030adb50f9e02ae6_elex_glassworm_smoke-loader_stop_wapomi

File Explorer

2026-06-28_c94103443f99ee1c030adb50f9e02ae6_elex_glassworm_smoke-loader_stop_wapomi

.exe 6.1MB

2026-06-28_c94103443f99ee1c030adb50f9e02ae6_elex_glassworm_smoke-loader_stop_wapomi

IMPHASH c5ca484a6bcd0ddfcd3c5e2fae321afb
SHA256 d65ef2c1e3a22311008c7a7d8b31e92095e5cb47c4f0f91a750c9ca20c7354eb
MD5 c94103443f99ee1c030adb50f9e02ae6
SHA1 dbfd75244f2d4433af8d51a2b801a777e96c919d
SHA512 e963b7ff30e54a289353e79a70c5f91ee0bb55ace64f0fddc20f37c921501f321d4d944d3d6feb5cca51c86bc8d4cc5602029646429eb7ebe3297191ef5d7279
SSDEEP 98304:lAAzv+uWj2PlbFncZKewtoS1lKEGMzVAVTcTRuCADGkJVhqwlAtT:uArOmyAjtoS1fVKVTIRuCse
TLSH
T179564C01A201953AFCE704F289BE5ABE95286B31172864C3E3C85D7E6BB65F33E31517
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12165120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\do_work\src\doKorea\narayan\Release\do.pdb

ws2_32

__WSAFDIsSet WSASend send getsockopt setsockopt gethostname gethostbyname inet_ntoa getpeername shutdown WSASetLastError socket htons inet_addr WSAStartup closesocket WSAGetLastError recv WSACleanup ioctlsocket connect select WSARecv WSAGetOverlappedResult WSAWaitForMultipleEvents getsockname

winmm

timeGetTime

wininet

InternetOpenA InternetCloseHandle InternetOpenUrlA

imagehlp

EnumerateLoadedModules StackWalk GetTimestampForLoadedLibrary

kernel32

HeapAlloc CreateToolhelp32Snapshot Module32First Module32Next GlobalSize SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings GetCurrentDirectoryA CloseHandle ReadFile CreateFileA WriteFile FreeEnvironmentStringsA GetConsoleMode GetConsoleCP SetConsoleCtrlHandler SetEvent CreateEventA WaitForSingleObject Sleep GetPrivateProfileStringA GetModuleFileNameA IsValidCodePage GetOEMCP GetACP GetFileType SetHandleCount HeapCreate HeapDestroy HeapSize TlsFree TlsSetValue TlsAlloc TlsGetValue GetCPInfo LCMapStringW LCMapStringA GetFileAttributesA ExitThread GetStartupInfoA GetCommandLineA MoveFileA WritePrivateProfileStringA GetPrivateProfileIntA SetFileAttributesA GetTickCount GlobalUnlock GlobalLock GlobalAlloc InterlockedIncrement InterlockedDecrement MultiByteToWideChar lstrlenA WideCharToMultiByte GetModuleHandleA CreateDirectoryA GetTimeZoneInformation GetSystemTimeAsFileTime IsDebuggerPresent TerminateProcess UnhandledExceptionFilter GetDateFormatA GetTimeFormatA HeapReAlloc WinExec GetEnvironmentVariableA GetCurrentProcessId SetLastError GetCurrentThread DuplicateHandle EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FatalAppExitA SetUnhandledExceptionFilter LoadLibraryA GetProcAddress FreeLibrary InitializeCriticalSection GetCurrentProcess ReadProcessMemory GetLastError VirtualQuery GetLocalTime GetExitCodeThread SetThreadPriority GetThreadPriority ReleaseMutex CreateMutexA GetCurrentThreadId SetFilePointer GetFileSize FlushFileBuffers LocalFree FormatMessageA _lclose _lread _lopen _lwrite _lcreat GetVersionExA GlobalMemoryStatus GetSystemDirectoryA SetEndOfFile ResumeThread ResetEvent GetExitCodeProcess WaitForMultipleObjects CreateProcessA OpenEventA lstrcatA OpenMutexA CreateThread TerminateThread GetComputerNameA lstrcmpA ExitProcess QueryPerformanceCounter IsBadReadPtr VirtualAlloc VirtualFree VirtualProtect LoadLibraryExA CopyFileA GetTempFileNameA GetTempPathA HeapFree GetProcessHeap DeleteFileA FindClose FindNextFileA FindFirstFileA RaiseException GetFileInformationByHandle SetStdHandle CreatePipe GetStdHandle PeekNamedPipe lstrcpyA InterlockedExchange InterlockedCompareExchange IsProcessorFeaturePresent MapViewOfFile CreateFileMappingA CreateFileW UnmapViewOfFile LockResource LoadResource SizeofResource FindResourceA FindResourceW RtlUnwind GetSystemDefaultLangID

user32

DrawTextW GetIconInfo wsprintfA CloseClipboard SetClipboardData EmptyClipboard OpenClipboard SetRectEmpty CopyRect GetClientRect DrawTextA RemovePropA SetPropA DefWindowProcA GetPropA RegisterClassA LoadCursorA GetClassInfoA UnregisterClassA CreateWindowExA ClientToScreen PostQuitMessage ChangeDisplaySettingsA GetCaretPos GetKeyboardLayout GetCursorPos ScreenToClient GetSystemMetrics CreateDialogParamA SetWindowTextA DestroyWindow SetDlgItemInt EnableWindow GetDlgItem GetDlgItemInt GetDlgItemTextA MessageBoxA MessageBeep SetDlgItemTextA SendMessageA SendDlgItemMessageA ShowWindow GetDC GetWindowDC SetScrollPos SetScrollRange CallNextHookEx SetWindowPos GetWindowRect ShowCursor SetFocus UpdateWindow AdjustWindowRect SetRect LoadIconA FindWindowA SetMenu SetWindowLongA CloseWindow SetCursor ReleaseCapture SetCapture DispatchMessageA TranslateMessage GetMessageA PeekMessageA ReleaseDC

gdi32

SelectObject CreateCompatibleBitmap CreateCompatibleDC DeleteObject GetTextExtentPointA GetObjectA SetBkColor CreateFontA BitBlt PatBlt SetBrushOrgEx CreateDIBPatternBrushPt GetDIBits RealizePalette RestoreDC SetDIBitsToDevice SetStretchBltMode ExtSelectClipRgn CreateDIBSection GetStockObject SetTextColor GetTextExtentPoint32A SetBkMode CreateFontIndirectA CreateRectRgnIndirect GetClipBox SaveDC StretchBlt CreateBitmap RectVisible StretchDIBits CreateRectRgn CombineRgn DeleteDC

comdlg32

ChooseColorA

advapi32

RegOpenKeyA CryptGetHashParam CryptDeriveKey CryptDecrypt CryptImportKey CryptCreateHash CryptHashData CryptVerifySignatureA CryptDestroyHash CryptDestroyKey CryptReleaseContext CryptAcquireContextA RegEnumValueA RegDeleteValueA GetUserNameA InitializeSecurityDescriptor SetSecurityDescriptorDacl RegQueryValueExA RegCreateKeyExA RegCloseKey RegOpenKeyExA RegSetValueExA

shell32

ShellExecuteA

ole32

CLSIDFromString CoCreateInstance CoUninitialize CoInitialize

oleaut32

VariantClear SysAllocString VariantInit

ijl11

ord2 ord3 ord5

d3d8

Direct3DCreate8

bugtrap

BT_InsLogEntry BT_CallCppFilter BT_SetLogSizeInEntries BT_SetLogFlags BT_SetLogEchoMode BT_GetLogFileName BT_AddLogFile BT_CloseLogFile BT_InstallSehFilter BT_SetAppName BT_SetAppVersion BT_SetFlags BT_SetSupportServer BT_SetSupportEMail BT_OpenLogFile

dinput8

DirectInput8Create

ddraw

DirectDrawCreateEx

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

dsound

ord1

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext ImmSetConversionStatus ImmCreateContext ImmDestroyContext ImmGetConversionStatus ImmAssociateContext ImmIsUIMessageA ImmGetProperty ImmSetOpenStatus ImmSetCompositionFontA ImmGetCompositionStringA ImmSetCandidateWindow ImmGetDescriptionA ImmIsIME ImmGetCandidateListA ImmGetOpenStatus ImmGetCandidateWindow

Name

.text

Size

5.3MB

Virtual Size

5.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

632KB

Virtual Size

628KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128KB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

44KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

��ңu)

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=1, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=21, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=2, id=126, version=50327,

count=69, id=125, productName=VS2005 build 50727, version=50727,

count=2, id=28, version=9178,

count=77, id=29, version=9178,

count=1, id=18, version=8444,

count=8, productName=Unmarked objects (old),

count=5, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,

count=19, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=31, id=123, productName=VS2005 build 50727, version=50727,

count=8, id=25, version=9210,

count=373, id=1, productName=Unmarked objects,

count=296, id=109, productName=VS2005 build 50727, version=50727,

count=560, id=110, productName=VS2005 build 50727, version=50727,

count=1, id=122, productName=VS2005 build 50727, version=50727,

count=1, id=124, productName=VS2005 build 50727, version=50727,

count=1, id=120, productName=VS2005 build 50727, version=50727,