2026-08-17_c3a8572a1aabadfa4aecccf56c7230d2_elex_glassworm_remcos_smoke-loader_stop_wapomi

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-17_c3a8572a1aabadfa4aecccf56c7230d2_elex_glassworm_remcos_smoke-loader_stop_wapomi
Size 3.8MB
Sample260817-shr46sshjg
SHA256 5e91777ffb828dd7d4ae36ad53229fb3d51b0195778dd10c5dba1719b965f043
MD5 c3a8572a1aabadfa4aecccf56c7230d2
SHA1 aea97896cdfd74933cb2bd54f6aaaeb9689198af
SHA512 aa681efdfb01f13234b28bd94039d183dd7fded94d490af0e6df27a2e123f64d039ba9ad0bd2fee009e96507945c8ab4d8f7b624feb978f78f3715ccccd7bfa1
SSDEEP 49152:Belxi+ePLypOS4t3qYBDd25d0FFTG3vNz7:CSzNS4taYpd25dwI
TLSH
T1F9068D41BBA3C0F6E5A6233840E15B974D39BF550B289ED3BBC4391E5A216D37C3B249
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-17_c3a8572a1aabadfa4aecccf56c7230d2_elex_glassworm_remcos_smoke-loader_stop_wapomi

File Explorer

2026-08-17_c3a8572a1aabadfa4aecccf56c7230d2_elex_glassworm_remcos_smoke-loader_stop_wapomi

.exe 3.8MB

2026-08-17_c3a8572a1aabadfa4aecccf56c7230d2_elex_glassworm_remcos_smoke-loader_stop_wapomi

IMPHASH 35cfc45b258fc0c112e3358721c6abf0
SHA256 5e91777ffb828dd7d4ae36ad53229fb3d51b0195778dd10c5dba1719b965f043
MD5 c3a8572a1aabadfa4aecccf56c7230d2
SHA1 aea97896cdfd74933cb2bd54f6aaaeb9689198af
SHA512 aa681efdfb01f13234b28bd94039d183dd7fded94d490af0e6df27a2e123f64d039ba9ad0bd2fee009e96507945c8ab4d8f7b624feb978f78f3715ccccd7bfa1
SSDEEP 49152:Belxi+ePLypOS4t3qYBDd25d0FFTG3vNz7:CSzNS4taYpd25dwI
TLSH
T1F9068D41BBA3C0F6E5A6233840E15B974D39BF550B289ED3BBC4391E5A216D37C3B249
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

62717952

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\trunk\desmume\src\windows\__bins\DeSmuME_VS2008_release.pdb

dinput8

DirectInput8Create

ddraw

DirectDrawCreateEx

dsound

ord11

avifil32

AVISaveOptions AVIStreamRelease AVIStreamSetFormat AVIMakeCompressedStream AVIFileRelease AVIStreamWrite AVIFileOpenA AVIFileInit AVIFileCreateStreamA

winmm

timeSetEvent timeEndPeriod waveInClose waveInPrepareHeader waveInOpen waveInAddBuffer waveInReset waveInStart timeGetDevCaps timeKillEvent timeGetTime timeBeginPeriod

opengl32

glClearDepth glDeleteTextures glEnd glFinish glBindTexture glVertex4fv glTexImage2D glGetError glDisable glGetString glBegin glDepthMask glTexParameteri glAlphaFunc glClearStencil glDepthFunc glClear glClearColor glTexParameterf glColorMask wglMakeCurrent wglCreateContext glLoadIdentity glGenTextures glTexCoord2fv wglGetProcAddress glEnable glStencilOp glColor4fv glTexImage1D glViewport glTexEnvi glMatrixMode glScalef glCullFace glBlendFunc glPolygonMode glStencilFunc glReadPixels glPixelStorei

ws2_32

closesocket WSACleanup WSAStartup recvfrom htonl select htons ntohs setsockopt sendto bind socket

user32

GetDlgCtrlID MessageBoxA GetAsyncKeyState GetWindowTextA GetKeyboardState GetKeyState ScreenToClient SetDlgItemTextA SetDlgItemTextW GetDlgItemTextW CharPrevExA CharToOemA CharLowerW CharUpperW CharLowerA CharUpperA CharNextA GetParent CreateMenu LoadAcceleratorsA RemoveMenu FrameRect GetScrollInfo GetScrollPos PostQuitMessage GetDlgItemInt SetScrollRange SetScrollPos SendInput DrawMenuBar SetMenuItemInfoA CreateWindowExW DialogBoxParamA ClientToScreen CloseClipboard TrackPopupMenu SetCapture IsZoomed GetSubMenu SetForegroundWindow DeleteMenu LoadMenuA GetMenuStringW GetMenuItemInfoW IsDialogMessageA SetDlgItemInt GetMenu OffsetRect SetPropA PeekMessageA EnableMenuItem EmptyClipboard TranslateAcceleratorA GetMenuItemInfoA GetMenuItemCount CheckRadioButton OpenClipboard ReleaseCapture InsertMenuA SetClipboardData DestroyMenu GetDlgItemTextA SetMenuItemInfoW ModifyMenuA MoveWindow SetActiveWindow GetFocus GetWindowTextLengthA RedrawWindow GetActiveWindow IsWindowEnabled GetForegroundWindow SetWindowTextW LoadStringW PostMessageA EndDialog SendDlgItemMessageA GetMessageA GetWindowRect CreateDialogParamA InsertMenuItemA KillTimer SetTimer EnableWindow SetWindowTextA DrawTextA GetMenuBarInfo LoadBitmapA LoadIconA GetDC TranslateMessage SetRect UnregisterClassA ReleaseDC GetSysColor SetWindowPos ShowWindow SetMenu DispatchMessageA AdjustWindowRectEx SystemParametersInfoA GetSystemMetrics UpdateWindow AdjustWindowRect CheckMenuItem EndPaint RegisterClassExA FillRect GetClientRect BeginPaint InvalidateRect GetWindowLongA CreateWindowExA DefWindowProcA GetSysColorBrush LoadCursorA DestroyWindow DialogBoxParamW wsprintfA SetFocus SendMessageA SetWindowLongA GetDlgItem CheckDlgButton IsDlgButtonChecked CreateDialogParamW CallWindowProcA GetCursorPos

gdi32

StretchBlt MoveToEx LineTo CreatePen BitBlt SetBkMode GetPixelFormat DescribePixelFormat ChoosePixelFormat SetPixelFormat SetDIBitsToDevice CreateFontA CreateCompatibleBitmap TextOutA SetTextColor SetBkColor GetStockObject ExtTextOutA GetTextExtentPoint32A DeleteDC GetDIBits SelectObject CreateCompatibleDC SetDIBits GetObjectA DeleteObject CreateSolidBrush

shell32

DragAcceptFiles ShellExecuteA DragFinish SHBrowseForFolderA SHGetPathFromIDListA SHGetMalloc DragQueryFileA

comdlg32

GetSaveFileNameA GetOpenFileNameA

shlwapi

PathCompactPathA

kernel32

GetLocaleInfoW SetFileAttributesA CopyFileA GetFileAttributesA CloseHandle CreateEventA Sleep SetEvent WaitForSingleObject CreateThread GetModuleFileNameA lstrlenA FindNextFileA FindClose GetLastError FindFirstFileA GetModuleHandleA AllocConsole FreeLibrary SetConsoleScreenBufferSize FreeConsole SetEnvironmentVariableA FlushFileBuffers CreatePipe GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID CompareStringW CompareStringA GetEnvironmentStrings FreeEnvironmentStringsA InitializeCriticalSectionAndSpinCount WriteConsoleW GetConsoleOutputCP CreateFileA GetCurrentDirectoryA GetTimeZoneInformation GetOEMCP SetHandleCount HeapCreate HeapSize SetLastError TlsFree LCMapStringW LCMapStringA RaiseException GetCPInfo GetProcessHeap SetEndOfFile ExitThread CreateProcessA MoveFileA RtlUnwind HeapReAlloc GetStartupInfoA GetCommandLineA DeleteFileA GetFileType SetStdHandle ExitProcess GetConsoleMode GetConsoleCP WriteFile SetFilePointer ReadFile GetDriveTypeA FileTimeToLocalFileTime FileTimeToSystemTime GetDateFormatA GetTimeFormatA HeapAlloc HeapFree SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess InterlockedExchange InterlockedDecrement InterlockedIncrement SetConsoleCP GetACP SetConsoleTitleA GetStdHandle GetProcAddress LoadLibraryA WaitForMultipleObjects GetCurrentProcessId GetCurrentThreadId GetSystemTime SystemTimeToFileTime FileTimeToDosDateTime DosDateTimeToFileTime VirtualFree VirtualAlloc LocalFileTimeToFileTime CompareFileTime GetVersion GetModuleHandleW FormatMessageW LocalFree GetThreadLocale GetLocaleInfoA InterlockedExchangeAdd IsValidCodePage GetCPInfoExA WideCharToMultiByte IsDBCSLeadByteEx GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentVariableW ExpandEnvironmentStringsW GetModuleFileNameW TlsAlloc GetCurrentThread DuplicateHandle SetThreadPriority TlsGetValue TlsSetValue ReleaseMutex CreateMutexA DeleteCriticalSection CreateSemaphoreA GetExitCodeProcess ReleaseSemaphore GetSystemTimeAsFileTime IsDebuggerPresent FormatMessageA SetCurrentDirectoryA SwitchToThread GetTickCount GetFullPathNameA GetTempPathA QueryPerformanceFrequency GetSystemInfo ResetEvent GetPrivateProfileStringA EnterCriticalSection SetThreadLocale LeaveCriticalSection InitializeCriticalSection SignalObjectAndWait QueryPerformanceCounter GetCurrentProcess GlobalAddAtomA SetProcessAffinityMask WriteConsoleA GetConsoleScreenBufferInfo SetConsoleOutputCP SetConsoleWindowInfo WritePrivateProfileStringA GetPrivateProfileIntA FindCloseChangeNotification GetFileAttributesExA TerminateThread FindFirstChangeNotificationA ResumeThread MultiByteToWideChar

oleaut32

SysFreeString SysAllocString VariantCopy SysAllocStringByteLen VariantClear

generic

count=11, id=150, version=20413,

count=69, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=78, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=250, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=26, id=123, productName=VS2005 build 50727, version=50727,

count=1, id=15, productName=VS2003 (.NET) build 3077, version=3077,

count=1, id=18, version=8444,

count=126, id=110, productName=VS2005 build 50727, version=50727,

count=84, id=109, productName=VS2005 build 50727, version=50727,

count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=442, id=1, productName=Unmarked objects,

count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=2, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=109, id=138, version=30729,

count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,