2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader
Size 1.5MB
Sample260809-rqvplazbqa
SHA256 0168060126d273f2e1de51808f2fc46e2adaaebd2bb55e2f03d36e865855a305
MD5 56f902c83498a049ab259b5c54a7cfb1
SHA1 139435f73b4fb469a7378b80e89a57a1e5b3c2d0
SHA512 e6ae3a806828667e6476a040cb8041155a91c7ab3d04b9824baa330ac6ef12d06695d8cb9099dfe1b9bcc6ff75396893fcb4bf5fa812a26e42d26831cbfaa806
SSDEEP 49152:n0uf9TZeabI+DKmIBe5H/CEY/zkUevWCId:nXPeabDDyBe5H/CVk7vWCI
TLSH
T128756C58F5C1B37AF0DA62FD93A51C7478B68990EB7500C7C0C1BF1E22A9AC3B178656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader

File Explorer

2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader

.exe 1.5MB

2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader

IMPHASH 9818596dc98250f6abb966dcdeae8975
SHA256 0168060126d273f2e1de51808f2fc46e2adaaebd2bb55e2f03d36e865855a305
MD5 56f902c83498a049ab259b5c54a7cfb1
SHA1 139435f73b4fb469a7378b80e89a57a1e5b3c2d0
SHA512 e6ae3a806828667e6476a040cb8041155a91c7ab3d04b9824baa330ac6ef12d06695d8cb9099dfe1b9bcc6ff75396893fcb4bf5fa812a26e42d26831cbfaa806
SSDEEP 49152:n0uf9TZeabI+DKmIBe5H/CEY/zkUevWCId:nXPeabDDyBe5H/CVk7vWCI
TLSH
T128756C58F5C1B37AF0DA62FD93A51C7478B68990EB7500C7C0C1BF1E22A9AC3B178656
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

555660

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\dvs\p4\build\sw\rel\gfclient\rel\backend\build\bin\Win32\Release\nvtmru.pdb

shell32

SHGetFolderPathW CommandLineToArgvW

ws2_32

WSACleanup recv bind socket setsockopt send listen accept getsockname htons __WSAFDIsSet select WSAStartup connect gethostbyname WSAGetLastError inet_addr ioctlsocket WSAWaitForMultipleEvents WSAResetEvent WSACreateEvent WSAEventSelect WSAEnumNetworkEvents htonl closesocket WSACloseEvent

kernel32

LeaveCriticalSection EnterCriticalSection ResetEvent DeleteCriticalSection WideCharToMultiByte MultiByteToWideChar GetNativeSystemInfo SystemTimeToFileTime GetTickCount GetSystemTimeAsFileTime WriteFile FormatMessageW GetVersionExW FileTimeToSystemTime ReadFile CreateFileW InitializeCriticalSection FlushFileBuffers FileTimeToLocalFileTime GetModuleFileNameW FreeLibrary GetProcAddress LoadLibraryA GetModuleHandleA SetEvent GetCurrentProcess ResumeThread GetCurrentThreadId SetThreadPriority GetLastError LocalFree CloseHandle OpenSemaphoreW OpenEventW CreateEventW CreateSemaphoreW ReleaseSemaphore Sleep WaitForSingleObject GetCommandLineW ExitProcess GetFileType QueryPerformanceCounter InitializeCriticalSectionAndSpinCount GetProcessHeap SetEndOfFile SetStdHandle WriteConsoleW LoadLibraryW HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID SetFilePointer GetLocaleInfoW GetConsoleMode GetConsoleCP InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer HeapFree GetCommandLineA HeapSetInformation GetStartupInfoW ExitThread CreateThread GetCPInfo RaiseException RtlUnwind HeapAlloc LCMapStringW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapCreate TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetACP GetOEMCP IsValidCodePage HeapSize GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetCurrentProcessId

user32

CreateWindowExW SetWindowLongW GetWindowLongW RegisterClassW GetMessageW SetTimer DestroyWindow PostQuitMessage DispatchMessageW DefWindowProcW

advapi32

RegCloseKey ConvertSidToStringSidW GetTokenInformation OpenProcessToken RegSetValueExW RegOpenKeyExW RegQueryValueExW RegCreateKeyExW SetSecurityDescriptorDacl InitializeSecurityDescriptor

ole32

CoCreateGuid

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader

shell32

ws2_32

kernel32

user32

advapi32

ole32

generic