2026-08-09_293d64b611ab2946808f24e344924306_amadey_elex_floxif_glassworm_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_293d64b611ab2946808f24e344924306_amadey_elex_floxif_glassworm_remcos_smoke-loader_stop
Size 2.7MB
Sample260809-gewseavwhw
SHA256 ccae0354c04b8e681e0ab50633588c58b34726c24a6983833032100e428457dc
MD5 293d64b611ab2946808f24e344924306
SHA1 6e6b699f24c259ae1f6e1ae5e9cfbcb742433eff
SHA512 0849dc067fe0106a714d6e74d0bc60364f06cf69bb97f6be655f1d7112ebaff02bea0792cdf784949f504509e628a8da85b2bda3c6151672c1d0335c5283ef13
SSDEEP 49152:bupeQ9Xpajz7BRCVBAAzcE/9puRnjqt5ig4Uc4zelgqGkXgcB/T:byeQ9XA9geE/9ARnjg5ig4UXkMkXz
TLSH
T101D53A36B741E53BC66314335D5E57EF1298B7B018B2541BEB4C0A2C27B5AE28B32763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_293d64b611ab2946808f24e344924306_amadey_elex_floxif_glassworm_remcos_smoke-loader_stop

File Explorer

2026-08-09_293d64b611ab2946808f24e344924306_amadey_elex_floxif_glassworm_remcos_smoke-loader_stop

.exe 2.7MB

2026-08-09_293d64b611ab2946808f24e344924306_amadey_elex_floxif_glassworm_remcos_smoke-loader_stop

IMPHASH 92d8cd5a16830461bf3b2db560fa7e3a
SHA256 ccae0354c04b8e681e0ab50633588c58b34726c24a6983833032100e428457dc
MD5 293d64b611ab2946808f24e344924306
SHA1 6e6b699f24c259ae1f6e1ae5e9cfbcb742433eff
SHA512 0849dc067fe0106a714d6e74d0bc60364f06cf69bb97f6be655f1d7112ebaff02bea0792cdf784949f504509e628a8da85b2bda3c6151672c1d0335c5283ef13
SSDEEP 49152:bupeQ9Xpajz7BRCVBAAzcE/9puRnjqt5ig4Uc4zelgqGkXgcB/T:byeQ9XA9geE/9ARnjg5ig4UXkMkXz
TLSH
T101D53A36B741E53BC66314335D5E57EF1298B7B018B2541BEB4C0A2C27B5AE28B32763
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

6d:18:21:8d:e6:b6:e3:2d:75:da:cc:82:29:20:8b:65:10:3f:dc:32

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Chains

Apr 19, 2007

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Serial Number

01:ed:f8:34:0c:df:06:0c:09:9e:1a:64:72:f7:6d:b4

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 11, 2006 - Nov 24, 2007

Minor OS version

Major OS version

Entry point

453829

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\depot\Ghost\GSS2.0\ghost\Gdisk\vs2005\Win32\Release\Gdisk32.pdb

kernel32

CloseHandle GetLastError GetCurrentProcess FreeConsole FormatMessageA GetModuleHandleA SetUnhandledExceptionFilter WaitForSingleObject CreateThread GetCurrentProcessId GetCurrentThreadId CreateFileA FreeLibrary IsBadWritePtr GetCurrentThread GetThreadContext GetModuleFileNameA VirtualQuery GetLogicalDrives GetDriveTypeA Sleep IsValidCodePage MultiByteToWideChar WideCharToMultiByte IsDBCSLeadByteEx GetOEMCP GetConsoleCP GetConsoleOutputCP GetACP InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree TerminateProcess UnhandledExceptionFilter IsDebuggerPresent RtlUnwind RaiseException GetCommandLineA HeapAlloc GetProcessHeap GetSystemTimeAsFileTime ExitProcess LCMapStringA LCMapStringW GetCPInfo GetStringTypeA GetStringTypeW HeapDestroy HeapCreate LoadLibraryA FatalAppExitA VirtualAlloc HeapReAlloc WriteFile GetStdHandle TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError SetHandleCount GetFileType GetStartupInfoA GetConsoleMode FlushFileBuffers SetFilePointer HeapSize FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount ReadFile GetTimeZoneInformation SetConsoleCtrlHandler GetLocaleInfoA GetTimeFormatA GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetLocaleInfoW WriteConsoleA WriteConsoleW SetStdHandle CompareStringA CompareStringW SetEnvironmentVariableA CreateFileW SetEndOfFile LocalAlloc ReadProcessMemory GetProcAddress GetVersionExA FindFirstFileA FindClose DeleteFileA GetFileAttributesA DefineDosDeviceW CreateEventA ResetEvent GetEnvironmentVariableW SystemTimeToFileTime FileTimeToSystemTime FileTimeToLocalFileTime LocalFileTimeToFileTime ReadConsoleInputA SetConsoleMode PeekConsoleInputA GetNumberOfConsoleInputEvents VirtualFree SetFileAttributesA GlobalMemoryStatus GetOverlappedResult SetErrorMode GetLogicalDriveStringsA DeviceIoControl GetFileSize LocalFree

user32

ExitWindowsEx

advapi32

RegOpenKeyA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExW RegQueryValueExW RegCloseKey RegQueryValueExA

rpcrt4

UuidCreate

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_293d64b611ab2946808f24e344924306_amadey_elex_floxif_glassworm_remcos_smoke-loader_stop

PE Signature issue

kernel32

user32

advapi32

rpcrt4

version

generic