2026-07-31_0abf15c9a795a31e411b1e647bcd32f7_amadey_elex_floxif_glassworm_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_0abf15c9a795a31e411b1e647bcd32f7_amadey_elex_floxif_glassworm_smoke-loader
Size 6.3MB
Sample260731-sd3p4svfmf
SHA256 dbac79b9cd8b1c6184c4b228069271173de57196d1a4d81ade76ed1403daab05
MD5 0abf15c9a795a31e411b1e647bcd32f7
SHA1 598b4af18cc840a97b36ad621ab9bc3f6d0f7f5e
SHA512 db514d2283ecf7f5aaccf9e37c87006b2fb71c91e6eb0fc4bf766d5d86ed56b7077379fb52792b835ab34b3c8720340a350f51260cc3bb54ea4857a598ebcdfd
SSDEEP 49152:RbA17ZFlSjRniITY86GwBan2qXg4qPPS+DG4EqJpTTlhCAPa9j+D5NUOWWuvks9C:Rb47ZmEiwB0BEhCAPa9s5YH9bk
TLSH
T14A66AE0ABE6E0662C4D9073905E7B6212F3C6F99F7364BDB715DB490D9323C908BEA44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-31_0abf15c9a795a31e411b1e647bcd32f7_amadey_elex_floxif_glassworm_smoke-loader

File Explorer

2026-07-31_0abf15c9a795a31e411b1e647bcd32f7_amadey_elex_floxif_glassworm_smoke-loader

.exe 6.3MB

2026-07-31_0abf15c9a795a31e411b1e647bcd32f7_amadey_elex_floxif_glassworm_smoke-loader

IMPHASH 6a822419a67a170751b62c728ad3aa64
SHA256 dbac79b9cd8b1c6184c4b228069271173de57196d1a4d81ade76ed1403daab05
MD5 0abf15c9a795a31e411b1e647bcd32f7
SHA1 598b4af18cc840a97b36ad621ab9bc3f6d0f7f5e
SHA512 db514d2283ecf7f5aaccf9e37c87006b2fb71c91e6eb0fc4bf766d5d86ed56b7077379fb52792b835ab34b3c8720340a350f51260cc3bb54ea4857a598ebcdfd
SSDEEP 49152:RbA17ZFlSjRniITY86GwBan2qXg4qPPS+DG4EqJpTTlhCAPa9j+D5NUOWWuvks9C:Rb47ZmEiwB0BEhCAPa9s5YH9bk
TLSH
T14A66AE0ABE6E0662C4D9073905E7B6212F3C6F99F7364BDB715DB490D9323C908BEA44
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

90:8c:03:b1:30:ec:5a:09:97:ad:12:92:37:6c:66:60:58:07:0b:a8

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Tally Solutions Private Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RnD,O=Tally Solutions Private Limited,L=Bangalore,ST=Karnataka,C=IN

Chains

Jun 4, 2013

CN=Tally Solutions Private Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RnD,O=Tally Solutions Private Limited,L=Bangalore,ST=Karnataka,C=IN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Tally Solutions Private Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RnD,O=Tally Solutions Private Limited,L=Bangalore,ST=Karnataka,C=IN

Serial Number

0b:dc:0e:72:b5:62:8c:50:bd:df:dd:df:d2:64:f5:78

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 29, 2012 - Feb 28, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

2137587

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\work\tally.erp9a\release\prod.tally9-erp9a4.61.STABLE\tally.migtool\main\bin\release\tally72migration.pdb

kernel32

LockResource LoadResource FindResourceA SetLastError GetCurrentThreadId GetVersion GetFileType GetStdHandle GetTickCount GlobalMemoryStatus FlushConsoleInputBuffer GetSystemDirectoryA GetTimeZoneInformation GetDriveTypeA GetWindowsDirectoryA GetSystemInfo lstrlenA LocalFree HeapFree HeapAlloc GetSystemTimeAsFileTime GetModuleHandleA GetStartupInfoA GetCommandLineA SizeofResource EnterCriticalSection LeaveCriticalSection HeapReAlloc FileTimeToSystemTime FileTimeToLocalFileTime RtlUnwind SetConsoleCtrlHandler WriteFile SetConsoleMode GetConsoleMode RaiseException HeapDestroy HeapCreate VirtualFree DeleteCriticalSection VirtualAlloc IsBadWritePtr TlsAlloc TlsFree TlsSetValue TlsGetValue HeapSize UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings SetHandleCount LCMapStringA SetStdHandle GetFullPathNameA GetCurrentDirectoryA InterlockedExchange VirtualQuery VirtualProtect InitializeCriticalSection GetACP GetOEMCP CompareStringA SetEnvironmentVariableA GetStringTypeA GetLocaleInfoA IsBadReadPtr IsBadCodePtr SetEndOfFile SetFilePointer FlushFileBuffers ReadFile UnlockFile LockFile GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetVersionExA FreeLibrary GetCurrentProcessId QueryPerformanceCounter SetErrorMode GetModuleFileNameA FormatMessageA GetProfileStringA LoadLibraryA InterlockedDecrement ResetEvent OpenProcess WaitForSingleObject TerminateProcess CreateFileMappingA GetCurrentProcess DuplicateHandle CreateProcessA GetExitCodeProcess MapViewOfFile CreateEventA Beep FindNextFileA SetFileAttributesA GetLastError GetDiskFreeSpaceA CreateFileA GetFileSize CloseHandle FindFirstFileA FindClose SetUnhandledExceptionFilter DeleteFileA LocalUnlock LocalLock LocalAlloc MoveFileExA Sleep ReadConsoleInputA CreateDirectoryA ExitProcess RemoveDirectoryA

user32

SetTimer GetWindowThreadProcessId EnumWindows SendMessageA WaitForInputIdle HideCaret CreateCaret SetCaretPos ShowCaret GetDC EnumDisplaySettingsA GetKeyboardState MessageBoxA GetWindowDC DrawIcon ReleaseDC KillTimer LoadIconA LoadCursorA RegisterClassA SystemParametersInfoA GetSystemMetrics CreateWindowExA ShowWindow SetFocus GetClientRect DispatchMessageA GetQueueStatus PeekMessageA GetMessageA TranslateMessage LoadImageA GetDesktopWindow SetWindowPos EndPaint BeginPaint DefWindowProcA SetRect FrameRect FillRect CloseClipboard SetClipboardData GetKeyState ShowScrollBar OpenClipboard EmptyClipboard InvalidateRect SetScrollInfo SetScrollPos PostMessageA GetFocus GetUpdateRect PostQuitMessage RegisterClassExA GetProcessWindowStation GetUserObjectInformationW PtInRect GetCursorPos DestroyWindow UpdateWindow wsprintfA

gdi32

SetTextJustification GetDIBits SetEnhMetaFileBits GetEnhMetaFileHeader PlayEnhMetaFile CreateDCA CreateCompatibleBitmap CreateEnhMetaFileA GetTextMetricsA LineTo CreateRectRgn SetRectRgn DeleteDC GetDeviceCaps CreateCompatibleDC GetStockObject DeleteObject SelectObject CreatePen SetTextColor CreateSolidBrush SetBkColor GetRgnBox GetTextExtentPointA BitBlt FrameRgn SelectClipRgn CreateFontIndirectA StretchBlt MoveToEx PatBlt SetStretchBltMode TextOutA SetBkMode CreateBitmap SetTextAlign SetTextCharacterExtra Escape StartPage StartDocA AbortDoc EndDoc EndPage DeleteEnhMetaFile GetEnhMetaFileBits CloseEnhMetaFile PtInRegion CreateHalftonePalette CreatePalette GetDIBColorTable GetObjectA RealizePalette SelectPalette PaintRgn CombineRgn

rpcrt4

UuidFromStringA

wininet

InternetCrackUrlA InternetCanonicalizeUrlA InternetCreateUrlA InternetSetOptionA InternetCloseHandle InternetReadFile HttpSendRequestA HttpOpenRequestA InternetConnectA InternetOpenA HttpQueryInfoA InternetWriteFile HttpEndRequestA InternetQueryOptionA HttpSendRequestExA InternetQueryDataAvailable InternetAttemptConnect InternetSetFilePointer FtpOpenFileA

ole32

CoCreateGuid CoCreateInstance CLSIDFromProgID CoUninitialize CoInitialize

oleaut32

GetErrorInfo SysAllocString VariantClear SysFreeString VariantInit

winspool.drv

EndDocPrinter DeviceCapabilitiesA ClosePrinter DocumentPropertiesA OpenPrinterA StartPagePrinter StartDocPrinterA EndPagePrinter WritePrinter

wsock32

WSACleanup accept WSAAsyncSelect connect recv send WSAGetLastError gethostbyname ioctlsocket htonl ntohl inet_addr gethostbyaddr getsockname WSASetLastError ntohs socket WSAStartup closesocket shutdown htons

odbc32

ord13 ord15 ord14 ord16 ord27 ord11 ord41 ord75 ord24 ord18 ord36 ord4

advapi32

RegCloseKey RegQueryValueExA RegisterEventSourceW RegOpenKeyExA CryptReleaseContext ReportEventW DeregisterEventSource CryptAcquireContextA CryptGenRandom

rasapi32

RasHangUpA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_0abf15c9a795a31e411b1e647bcd32f7_amadey_elex_floxif_glassworm_smoke-loader

PE Signature issue

kernel32

user32

gdi32

rpcrt4

wininet

ole32

oleaut32

winspool.drv

wsock32

odbc32

advapi32

rasapi32

generic