2026-07-10_7c796ef0cf3a62347faf517c42a2d40f_amadey_elex_floxif_glassworm_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_7c796ef0cf3a62347faf517c42a2d40f_amadey_elex_floxif_glassworm_smoke-loader
Size 6.3MB
Sample260710-2edxtacy8j
SHA256 fcef2dfbbd3fa0e8df9d8a37ff83bce32e13ad626d40f90d4f76d883fe4e1ec9
MD5 7c796ef0cf3a62347faf517c42a2d40f
SHA1 b081e76453a8533d4ca020b3c28c707aec4665a8
SHA512 c4514ec01ad697eb19ec7fb601e16921a7dd4c1ca468060cd5fdd95aa9b76c0d8ea8bb3cf697c38ba23f16d93d18ca0bea674ec78f3e218b91ff56f5fd039350
SSDEEP 49152:RbA1AZFlSjRniIsY86GwBan2qXg4q1PS+DG4EqJpTTlhCAPa9j+D5NUOWWuvks9r:Rb4AZmDiwB0BihCAPa9s5YH9b1
TLSH
T1BB66AE0ABE6E0662C4D9073905E7B6212F3C6F99F7364BCB715DB590D9323C908BEA44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-10_7c796ef0cf3a62347faf517c42a2d40f_amadey_elex_floxif_glassworm_smoke-loader

File Explorer

2026-07-10_7c796ef0cf3a62347faf517c42a2d40f_amadey_elex_floxif_glassworm_smoke-loader

.exe 6.3MB

2026-07-10_7c796ef0cf3a62347faf517c42a2d40f_amadey_elex_floxif_glassworm_smoke-loader

IMPHASH 6a822419a67a170751b62c728ad3aa64
SHA256 fcef2dfbbd3fa0e8df9d8a37ff83bce32e13ad626d40f90d4f76d883fe4e1ec9
MD5 7c796ef0cf3a62347faf517c42a2d40f
SHA1 b081e76453a8533d4ca020b3c28c707aec4665a8
SHA512 c4514ec01ad697eb19ec7fb601e16921a7dd4c1ca468060cd5fdd95aa9b76c0d8ea8bb3cf697c38ba23f16d93d18ca0bea674ec78f3e218b91ff56f5fd039350
SSDEEP 49152:RbA1AZFlSjRniIsY86GwBan2qXg4q1PS+DG4EqJpTTlhCAPa9j+D5NUOWWuvks9r:Rb4AZmDiwB0BihCAPa9s5YH9b1
TLSH
T1BB66AE0ABE6E0662C4D9073905E7B6212F3C6F99F7364BCB715DB590D9323C908BEA44
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

0c:08:a2:85:ca:ef:f8:5d:d6:0a:a8:92:44:83:94:28:6e:59:78:55

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Tally Solutions Private Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RnD,O=Tally Solutions Private Limited,L=Bangalore,ST=Karnataka,C=IN

Chains

Jun 4, 2013

CN=Tally Solutions Private Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RnD,O=Tally Solutions Private Limited,L=Bangalore,ST=Karnataka,C=IN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Tally Solutions Private Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RnD,O=Tally Solutions Private Limited,L=Bangalore,ST=Karnataka,C=IN

Serial Number

0b:dc:0e:72:b5:62:8c:50:bd:df:dd:df:d2:64:f5:78

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 29, 2012 - Feb 28, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

2137587

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\work\tally.erp9a\release\prod.tally9-erp9a4.61.STABLE\tally.migtool\main\bin\release\tally72migration.pdb

kernel32

LockResource LoadResource FindResourceA SetLastError GetCurrentThreadId GetVersion GetFileType GetStdHandle GetTickCount GlobalMemoryStatus FlushConsoleInputBuffer GetSystemDirectoryA GetTimeZoneInformation GetDriveTypeA GetWindowsDirectoryA GetSystemInfo lstrlenA LocalFree HeapFree HeapAlloc GetSystemTimeAsFileTime GetModuleHandleA GetStartupInfoA GetCommandLineA SizeofResource EnterCriticalSection LeaveCriticalSection HeapReAlloc FileTimeToSystemTime FileTimeToLocalFileTime RtlUnwind SetConsoleCtrlHandler WriteFile SetConsoleMode GetConsoleMode RaiseException HeapDestroy HeapCreate VirtualFree DeleteCriticalSection VirtualAlloc IsBadWritePtr TlsAlloc TlsFree TlsSetValue TlsGetValue HeapSize UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings SetHandleCount LCMapStringA SetStdHandle GetFullPathNameA GetCurrentDirectoryA InterlockedExchange VirtualQuery VirtualProtect InitializeCriticalSection GetACP GetOEMCP CompareStringA SetEnvironmentVariableA GetStringTypeA GetLocaleInfoA IsBadReadPtr IsBadCodePtr SetEndOfFile SetFilePointer FlushFileBuffers ReadFile UnlockFile LockFile GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetVersionExA FreeLibrary GetCurrentProcessId QueryPerformanceCounter SetErrorMode GetModuleFileNameA FormatMessageA GetProfileStringA LoadLibraryA InterlockedDecrement ResetEvent OpenProcess WaitForSingleObject TerminateProcess CreateFileMappingA GetCurrentProcess DuplicateHandle CreateProcessA GetExitCodeProcess MapViewOfFile CreateEventA Beep FindNextFileA SetFileAttributesA GetLastError GetDiskFreeSpaceA CreateFileA GetFileSize CloseHandle FindFirstFileA FindClose SetUnhandledExceptionFilter DeleteFileA LocalUnlock LocalLock LocalAlloc MoveFileExA Sleep ReadConsoleInputA CreateDirectoryA ExitProcess RemoveDirectoryA

user32

SetTimer GetWindowThreadProcessId EnumWindows SendMessageA WaitForInputIdle HideCaret CreateCaret SetCaretPos ShowCaret GetDC EnumDisplaySettingsA GetKeyboardState MessageBoxA GetWindowDC DrawIcon ReleaseDC KillTimer LoadIconA LoadCursorA RegisterClassA SystemParametersInfoA GetSystemMetrics CreateWindowExA ShowWindow SetFocus GetClientRect DispatchMessageA GetQueueStatus PeekMessageA GetMessageA TranslateMessage LoadImageA GetDesktopWindow SetWindowPos EndPaint BeginPaint DefWindowProcA SetRect FrameRect FillRect CloseClipboard SetClipboardData GetKeyState ShowScrollBar OpenClipboard EmptyClipboard InvalidateRect SetScrollInfo SetScrollPos PostMessageA GetFocus GetUpdateRect PostQuitMessage RegisterClassExA GetProcessWindowStation GetUserObjectInformationW PtInRect GetCursorPos DestroyWindow UpdateWindow wsprintfA

gdi32

SetTextJustification GetDIBits SetEnhMetaFileBits GetEnhMetaFileHeader PlayEnhMetaFile CreateDCA CreateCompatibleBitmap CreateEnhMetaFileA GetTextMetricsA LineTo CreateRectRgn SetRectRgn DeleteDC GetDeviceCaps CreateCompatibleDC GetStockObject DeleteObject SelectObject CreatePen SetTextColor CreateSolidBrush SetBkColor GetRgnBox GetTextExtentPointA BitBlt FrameRgn SelectClipRgn CreateFontIndirectA StretchBlt MoveToEx PatBlt SetStretchBltMode TextOutA SetBkMode CreateBitmap SetTextAlign SetTextCharacterExtra Escape StartPage StartDocA AbortDoc EndDoc EndPage DeleteEnhMetaFile GetEnhMetaFileBits CloseEnhMetaFile PtInRegion CreateHalftonePalette CreatePalette GetDIBColorTable GetObjectA RealizePalette SelectPalette PaintRgn CombineRgn

rpcrt4

UuidFromStringA

wininet

InternetCrackUrlA InternetCanonicalizeUrlA InternetCreateUrlA InternetSetOptionA InternetCloseHandle InternetReadFile HttpSendRequestA HttpOpenRequestA InternetConnectA InternetOpenA HttpQueryInfoA InternetWriteFile HttpEndRequestA InternetQueryOptionA HttpSendRequestExA InternetQueryDataAvailable InternetAttemptConnect InternetSetFilePointer FtpOpenFileA

ole32

CoCreateGuid CoCreateInstance CLSIDFromProgID CoUninitialize CoInitialize

oleaut32

GetErrorInfo SysAllocString VariantClear SysFreeString VariantInit

winspool.drv

EndDocPrinter DeviceCapabilitiesA ClosePrinter DocumentPropertiesA OpenPrinterA StartPagePrinter StartDocPrinterA EndPagePrinter WritePrinter

wsock32

WSACleanup accept WSAAsyncSelect connect recv send WSAGetLastError gethostbyname ioctlsocket htonl ntohl inet_addr gethostbyaddr getsockname WSASetLastError ntohs socket WSAStartup closesocket shutdown htons

odbc32

ord13 ord15 ord14 ord16 ord27 ord11 ord41 ord75 ord24 ord18 ord36 ord4

advapi32

RegCloseKey RegQueryValueExA RegisterEventSourceW RegOpenKeyExA CryptReleaseContext ReportEventW DeregisterEventSource CryptAcquireContextA CryptGenRandom

rasapi32

RasHangUpA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_7c796ef0cf3a62347faf517c42a2d40f_amadey_elex_floxif_glassworm_smoke-loader

PE Signature issue

kernel32

user32

gdi32

rpcrt4

wininet

ole32

oleaut32

winspool.drv

wsock32

odbc32

advapi32

rasapi32

generic