2026-08-08_5fbe4c344654613a5aea3982d10048f7_amadey_elex_floxif_glassworm_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_5fbe4c344654613a5aea3982d10048f7_amadey_elex_floxif_glassworm_remcos_smoke-loader_stop
Size 2.9MB
Sample260808-weypbssand
SHA256 6cdb3caab4c92257de0136e81e66eb82df8e64b465639050494a2de9620dbd82
MD5 5fbe4c344654613a5aea3982d10048f7
SHA1 789a4004652055157ef5621d95ea64ba629e8d66
SHA512 0f84f4ba960a50011163a103df4d267a9b0f21b1836eb674259b178ecc6badac007a6726d97f031ac4a34bbc3bd40e15d624a1ca37a916c844670daa5eb1b4e7
SSDEEP 49152:daUEDWq1hbPWq56NB5yPLMNyXS7kASoZigJLQDAr3PgB/v:daHDDfuq5qBoPQyUkoZigSy/k
TLSH
T14CE5A0227FC1C47AC6671272884D675EA3F5D2705B314AD3AAE9070E1F34AE3CE39952
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-08_5fbe4c344654613a5aea3982d10048f7_amadey_elex_floxif_glassworm_remcos_smoke-loader_stop

File Explorer

2026-08-08_5fbe4c344654613a5aea3982d10048f7_amadey_elex_floxif_glassworm_remcos_smoke-loader_stop

.exe 2.9MB

2026-08-08_5fbe4c344654613a5aea3982d10048f7_amadey_elex_floxif_glassworm_remcos_smoke-loader_stop

IMPHASH eb9e6e365cc704b9e7f1c5e99c5e733d
SHA256 6cdb3caab4c92257de0136e81e66eb82df8e64b465639050494a2de9620dbd82
MD5 5fbe4c344654613a5aea3982d10048f7
SHA1 789a4004652055157ef5621d95ea64ba629e8d66
SHA512 0f84f4ba960a50011163a103df4d267a9b0f21b1836eb674259b178ecc6badac007a6726d97f031ac4a34bbc3bd40e15d624a1ca37a916c844670daa5eb1b4e7
SSDEEP 49152:daUEDWq1hbPWq56NB5yPLMNyXS7kASoZigJLQDAr3PgB/v:daHDDfuq5qBoPQyUkoZigSy/k
TLSH
T14CE5A0227FC1C47AC6671272884D675EA3F5D2705B314AD3AAE9070E1F34AE3CE39952
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

f6:9a:34:aa:60:d3:7a:6e:ce:00:71:7c:4b:da:d4:0f:5a:25:8e:97

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Chains

Dec 24, 2009

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Serial Number

75:8f:5e:e8:26:3b:66:94:71:9d:84:34:eb:99:86:08

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 31, 2007 - Nov 24, 2010

Minor OS version

Major OS version

Entry point

1571513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

r:\depot_cont\Ghost\GSSTrunk\Ghost\Gdisk\vs2005\Win32\Release\Gdisk32.pdb

kernel32

InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection IsDebuggerPresent DebugBreak GetTickCount InterlockedIncrement InterlockedDecrement DeleteCriticalSection OutputDebugStringA VirtualFree VirtualAlloc GetSystemInfo GetModuleHandleA GetCurrentThreadId DeleteFileW GetThreadContext VirtualQuery GetModuleHandleW FindResourceW LoadResource WriteFile LoadLibraryW SizeofResource CreateFileW LockResource ResumeThread CreateThread WaitForSingleObject SetEvent SetCurrentDirectoryA CreateEventW SetCurrentDirectoryW GetModuleFileNameA WideCharToMultiByte MultiByteToWideChar FindResourceExA FindResourceA GetVersionExW VirtualProtectEx GetLocalTime GetStringTypeA GetLocaleInfoA GetLocaleInfoW ExpandEnvironmentStringsW DefineDosDeviceW InitializeCriticalSection GetCurrentThread IsBadWritePtr FreeConsole FormatMessageA GetCurrentProcessId CreateFileA RaiseException SetUnhandledExceptionFilter HeapFree HeapAlloc GetProcessHeap DeviceIoControl SetFilePointer SetLastError GetFileSize SetEndOfFile ReadFile VirtualLock SetProcessWorkingSetSize GetProcessWorkingSetSize VirtualUnlock GetOverlappedResult ResetEvent CreateEventA GetDriveTypeA InterlockedCompareExchange InterlockedExchange RtlUnwind GetTimeFormatA GetDateFormatA TerminateProcess UnhandledExceptionFilter GetCommandLineA ExitProcess LCMapStringA LCMapStringW GetCPInfo GetStringTypeW GetTimeZoneInformation TlsGetValue TlsAlloc TlsSetValue TlsFree GetACP GetOEMCP IsValidCodePage GetStdHandle SetHandleCount GetFileType GetStartupInfoA GetConsoleCP GetConsoleMode FlushFileBuffers FatalAppExitA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter SetConsoleCtrlHandler GetUserDefaultLCID EnumSystemLocalesA IsValidLocale WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CompareStringA CompareStringW SetEnvironmentVariableA lstrlenW ReadProcessMemory FindNextFileA BackupRead BackupSeek SetFileTime GetDiskFreeSpaceW GetVolumeInformationA GetFileInformationByHandle MoveFileA GetLogicalDrives GetSystemTimeAsFileTime LocalFileTimeToFileTime FileTimeToLocalFileTime FileTimeToSystemTime GetVersionExA LoadLibraryA GetProcAddress FreeLibrary Sleep GetSystemTime SystemTimeToFileTime GetCurrentProcess CloseHandle RemoveDirectoryA CreateDirectoryA GetDiskFreeSpaceA GetLastError GlobalMemoryStatus IsDBCSLeadByteEx GetEnvironmentVariableW GetFileAttributesW GetFileAttributesExW GetFileAttributesExA GetCurrentDirectoryA GetLogicalDriveStringsA GetBinaryTypeA GetFullPathNameA ReadConsoleInputA SetConsoleMode PeekConsoleInputA GetNumberOfConsoleInputEvents LocalAlloc LocalFree FindFirstFileA FindClose DeleteFileA GetFileAttributesA SetErrorMode SetFileAttributesA

rpcrt4

UuidCreate

user32

CreateWindowExA SetTimer ExitWindowsEx KillTimer DefWindowProcA DestroyWindow RegisterDeviceNotificationA RegisterClassA UnregisterClassA

advapi32

OpenSCManagerA DeleteService CloseServiceHandle LookupPrivilegeValueW RegOpenKeyA StartServiceA SetFileSecurityW GetFileSecurityW ControlService CreateServiceA RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegQueryInfoKeyW RegQueryValueExW RegCreateKeyExW RegSetValueExW RegOpenKeyExA RegQueryValueExA RegCloseKey OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges OpenServiceA

oleaut32

CreateErrorInfo SetErrorInfo VariantInit VariantClear SysAllocString VariantChangeType GetErrorInfo SafeArrayAccessData SafeArrayDestroy SysFreeString

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

ole32

CoSetProxyBlanket CoInitialize CoUninitialize CoCreateInstance OleRun CoInitializeEx

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_5fbe4c344654613a5aea3982d10048f7_amadey_elex_floxif_glassworm_remcos_smoke-loader_stop

PE Signature issue

kernel32

rpcrt4

user32

advapi32

oleaut32

version

ole32

generic