2026-08-04_006712bd9e749963b2906c9c195e7ea2_amadey_elex_floxif_glassworm_hijackloader_maze_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_006712bd9e749963b2906c9c195e7ea2_amadey_elex_floxif_glassworm_hijackloader_maze_smoke-loader
Size 1.4MB
Sample260805-brscvsvhpf
SHA256 e9bc2dbc2b9467493914d8480d6f5e104bd1eb1e234ee57e75a2cad5c8d5a849
MD5 006712bd9e749963b2906c9c195e7ea2
SHA1 c53239ba518e6e4bedceaebe1dcb95c6b1af375c
SHA512 91ee24a08436fef60f9cafba851b31aa8a328bc6687cb54dd23b08469230f48dd813c7fd2bc19ba715349ddb8aac99c4459fcfcad10e8fbd2d53ca8ef8430649
SSDEEP 24576:LKfyX4xuXbOiI/bjBswmbAqBnjP7GR4QOF3pcRp/dtKT/U1kkoWYZCyusfBTrEH6:UyXouLUHBREe0ZcRp/dUT/U1Z0ZCyus9
TLSH
T14765CF43B78282F2D4A202B651FB577B893AAE25472BC1D387D01D554D30AE1AB3E3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-04_006712bd9e749963b2906c9c195e7ea2_amadey_elex_floxif_glassworm_hijackloader_maze_smoke-loader

File Explorer

2026-08-04_006712bd9e749963b2906c9c195e7ea2_amadey_elex_floxif_glassworm_hijackloader_maze_smoke-loader

.exe 1.4MB

2026-08-04_006712bd9e749963b2906c9c195e7ea2_amadey_elex_floxif_glassworm_hijackloader_maze_smoke-loader

IMPHASH 8c9588b78929bf479d2b1ca1e354cffd
SHA256 e9bc2dbc2b9467493914d8480d6f5e104bd1eb1e234ee57e75a2cad5c8d5a849
MD5 006712bd9e749963b2906c9c195e7ea2
SHA1 c53239ba518e6e4bedceaebe1dcb95c6b1af375c
SHA512 91ee24a08436fef60f9cafba851b31aa8a328bc6687cb54dd23b08469230f48dd813c7fd2bc19ba715349ddb8aac99c4459fcfcad10e8fbd2d53ca8ef8430649
SSDEEP 24576:LKfyX4xuXbOiI/bjBswmbAqBnjP7GR4QOF3pcRp/dtKT/U1kkoWYZCyusfBTrEH6:UyXouLUHBREe0ZcRp/dUT/U1Z0ZCyus9
TLSH
T14765CF43B78282F2D4A202B651FB577B893AAE25472BC1D387D01D554D30AE1AB3E3D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c9:3d:f8:43:71:6c:fb:d4:41:a3:1c:19:47:a9:e8:45:28:17:46:23:fe:09:b2:3a:f8:13:00:be:41:aa:89:ce

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=220-81-96318,CN=UNIDOCS Inc.,O=UNIDOCS Inc.,L=Guro-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 27, 2022

SERIALNUMBER=220-81-96318,CN=UNIDOCS Inc.,O=UNIDOCS Inc.,L=Guro-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=220-81-96318,CN=UNIDOCS Inc.,O=UNIDOCS Inc.,L=Guro-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

0b:0c:9a:cd:da:2f:fe:0a:83:2b:45:22:97:39:e4:e9

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 4, 2021 - Dec 5, 2023

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Minor OS version

Major OS version

Entry point

864516

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

kernel32

SetEndOfFile GetCurrentDirectoryW WriteFile CreateFileA WaitNamedPipeA GetProcAddress LoadLibraryA GetCurrentProcess CloseHandle TerminateProcess OpenProcess GetLocalTime DeleteCriticalSection DeleteFileA GetLastError GetModuleFileNameA InitializeCriticalSection WideCharToMultiByte MultiByteToWideChar HeapFree GetProcessHeap HeapAlloc GetFullPathNameW GetFileSize GetFileInformationByHandle FileTimeToLocalFileTime WriteConsoleW SetEnvironmentVariableA OutputDebugStringW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW FindFirstFileExW FindClose SetStdHandle FlushFileBuffers GetConsoleCP FreeEnvironmentStringsW GetEnvironmentStringsW LoadLibraryExW SetFilePointerEx ReadConsoleW GetModuleFileNameW HeapSize GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetModuleHandleW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc Sleep PeekNamedPipe ReadFile GetCurrentThreadId GetModuleHandleA GetVersion GetFileType GetStdHandle GetTickCount QueryPerformanceCounter GetCurrentProcessId GlobalMemoryStatus FreeLibrary FlushConsoleInputBuffer SetLastError SetFilePointer GetSystemTimeAsFileTime CreateFileW EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer GetStringTypeW IsDebuggerPresent IsProcessorFeaturePresent CreateThread ExitThread ResumeThread HeapReAlloc ExitProcess GetModuleHandleExW AreFileApisANSI GetCommandLineA SetConsoleCtrlHandler GetConsoleMode ReadConsoleInputA SetConsoleMode GetTimeZoneInformation RaiseException RtlUnwind GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount

user32

GetForegroundWindow GetWindowThreadProcessId FindWindowA GetParent GetWindow WaitForInputIdle SetForegroundWindow SetFocus MessageBoxA GetProcessWindowStation GetUserObjectInformationW

advapi32

StartServiceA RegQueryValueExA RegisterEventSourceA ReportEventA DeregisterEventSource RegCloseKey OpenSCManagerA CreateProcessAsUserA DuplicateTokenEx AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetServiceStatus RegisterServiceCtrlHandlerA StartServiceCtrlDispatcherA CreateServiceA ControlService DeleteService OpenServiceA CloseServiceHandle RegCreateKeyExA

wtsapi32

WTSEnumerateSessionsA

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

ws2_32

getaddrinfo WSAGetLastError htons ntohs getsockname inet_addr bind freeaddrinfo closesocket send recv accept WSASetLastError listen socket setsockopt gethostname WSAWaitForMultipleEvents gethostbyname WSAResetEvent WSACreateEvent WSACleanup getprotobyname WSAEventSelect WSAEnumNetworkEvents select WSAStartup WSAIoctl ioctlsocket WSASetEvent WSACloseEvent connect shutdown

crypt32

CertAddEncodedCertificateToStore CertCloseStore CertOpenStore CertFreeCertificateContext

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_006712bd9e749963b2906c9c195e7ea2_amadey_elex_floxif_glassworm_hijackloader_maze_smoke-loader

PE Signature issue

version

kernel32

user32

advapi32

wtsapi32

userenv

ws2_32

crypt32

generic