2026-08-03_cc0c318e251311444c7e19e28c142274_amadey_elex_glassworm_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_cc0c318e251311444c7e19e28c142274_amadey_elex_glassworm_smoke-loader
Size 2.7MB
Sample260803-fdft5a11hw
SHA256 945fdc20b474a9e294a4604f2ece34b316ec34d4dae3c50a2c81be66d86827f7
MD5 cc0c318e251311444c7e19e28c142274
SHA1 7e0efb473534057d4ec8a99f7863f5675eb1e1c7
SHA512 157992d011ee1d92109b86726851a854a476e1c7837e0ed5ffc8913a111b87459ef0ef142b58794957950164373734c8596396178f31aef2d743fc0f5cab707a
SSDEEP 49152:TFUcx88PWPOpX0Sp3fLUy471Bv0fvemL4HyOCz168yGFV:T+K88uPCHx4fv38TRxyG
TLSH
T15BD5CF97E7828AE8E64D04766F598141D62EF631A74F271139AC121DCF9338B8F61E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_cc0c318e251311444c7e19e28c142274_amadey_elex_glassworm_smoke-loader

File Explorer

2026-08-03_cc0c318e251311444c7e19e28c142274_amadey_elex_glassworm_smoke-loader

.exe 2.7MB

2026-08-03_cc0c318e251311444c7e19e28c142274_amadey_elex_glassworm_smoke-loader

IMPHASH 95122753ea27818b35f9b51859e4c692
SHA256 945fdc20b474a9e294a4604f2ece34b316ec34d4dae3c50a2c81be66d86827f7
MD5 cc0c318e251311444c7e19e28c142274
SHA1 7e0efb473534057d4ec8a99f7863f5675eb1e1c7
SHA512 157992d011ee1d92109b86726851a854a476e1c7837e0ed5ffc8913a111b87459ef0ef142b58794957950164373734c8596396178f31aef2d743fc0f5cab707a
SSDEEP 49152:TFUcx88PWPOpX0Sp3fLUy471Bv0fvemL4HyOCz168yGFV:T+K88uPCHx4fv38TRxyG
TLSH
T15BD5CF97E7828AE8E64D04766F598141D62EF631A74F271139AC121DCF9338B8F61E3C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

306880

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualProtect Sleep GetCurrentProcessId GetCurrentThreadId GetModuleHandleW lstrlenW WideCharToMultiByte MoveFileExW GetTempFileNameW GetTempPathW DeleteFileW MoveFileW WriteFile ReadFile GetFileSize CreateFileW SetFileAttributesW GetModuleFileNameW GetComputerNameA GetSystemTime RaiseException RtlUnwind HeapAlloc HeapFree GetCommandLineW HeapSetInformation GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent EncodePointer DecodePointer TlsAlloc TlsGetValue TlsSetValue InterlockedIncrement SetLastError InterlockedDecrement ExitProcess GetStdHandle HeapCreate HeapDestroy FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW HeapReAlloc HeapSize SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers MultiByteToWideChar GetStringTypeW SetStdHandle WriteConsoleW SetEndOfFile GetProcessHeap CloseHandle GetLastError DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetCurrentProcess GetModuleHandleA CreateProcessW LoadLibraryW SystemTimeToFileTime FindResourceExW FindResourceW LoadResource LockResource SizeofResource LoadLibraryA TlsFree GetProcAddress

user32

FlashWindow

advapi32

CreateServiceW RegCreateKeyExW OpenSCManagerW OpenServiceW QueryServiceConfigW ChangeServiceConfigW StartServiceW CloseServiceHandle RegCloseKey RegOpenKeyExW CryptAcquireContextW CryptReleaseContext GetUserNameW GetUserNameA AllocateAndInitializeSid CheckTokenMembership FreeSid RegQueryValueExW RegSetValueExW

shell32

ShellExecuteW SHGetSpecialFolderPathW

shlwapi

PathIsRootW PathAddExtensionW PathAppendW PathRemoveExtensionW PathFileExistsW

Name

.text

Size

348KB

Virtual Size

347KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

365KB

Virtual Size

365KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

ohLUfUBu

Size

14KB

Virtual Size

14KB

Characteristics

Name

ZGjEKKOm

Size

1KB

Virtual Size

1KB

Characteristics

Name

BXAxDPeh

Size

4KB

Virtual Size

3KB

Characteristics

Name

iIvRopla

Size

32KB

Virtual Size

32KB

Characteristics

Name

GonniIKz

Size

624KB

Virtual Size

623KB

Characteristics

Name

DpQNnDxC

Size

6KB

Virtual Size

5KB

Characteristics

Name

qkyrpKLR

Size

1024B

Virtual Size

888B

Characteristics

Name

GJfarnLm

Size

1024B

Virtual Size

624B

Characteristics

Name

AVaqpDcJ

Size

2KB

Virtual Size

1KB

Characteristics

Name

XnZWyttU

Size

35KB

Virtual Size

35KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_cc0c318e251311444c7e19e28c142274_amadey_elex_glassworm_smoke-loader

kernel32

user32

advapi32

shell32

shlwapi

generic