General
- Target 2026-08-19_8fa66d1ea36979352c562a36fd4d84f1_amadey_elex_glassworm_remcos_smoke-loader_stop
- Size 3.3MB
- Sample260819-serdgacr4y
- SHA256 68cccef5bec90a14d4a2d07049ec86fc477d110e58342d9e489894cde2b5738a
- MD5 8fa66d1ea36979352c562a36fd4d84f1
- SHA1 f6007c9d5ce7febc42fcda77f39276ecf78f1fed
- SHA512 e0a5f0df7cc92413e3a9ef3ed016c287501f0c5f8bf388b597f2a384f6ca68c0ca344d551991b45910e763729e028a309add0193baebfd0cdce69ae83009e0ce
- SSDEEP 12288:y4CWKKCrZTGF/k8uMxtxPvvz+z3a8JqjddNddfIemJpgrzhXB:yJbKkKF/eMNPjuzmFB
- TLSH T1F3F5C513B39A9635C1AD87308CEB038E1739FD12CB228B4B95547B1D7D72B48AE79D48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-19_8fa66d1ea36979352c562a36fd4d84f1_amadey_elex_glassworm_remcos_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_8fa66d1ea36979352c562a36fd4d84f1_amadey_elex_glassworm_remcos_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_8fa66d1ea36979352c562a36fd4d84f1_amadey_elex_glassworm_remcos_smoke-loader_stop
- Size 3.3MB
- SHA256 68cccef5bec90a14d4a2d07049ec86fc477d110e58342d9e489894cde2b5738a
- MD5 8fa66d1ea36979352c562a36fd4d84f1
- SHA1 f6007c9d5ce7febc42fcda77f39276ecf78f1fed
- SHA512 e0a5f0df7cc92413e3a9ef3ed016c287501f0c5f8bf388b597f2a384f6ca68c0ca344d551991b45910e763729e028a309add0193baebfd0cdce69ae83009e0ce
- SSDEEP 12288:y4CWKKCrZTGF/k8uMxtxPvvz+z3a8JqjddNddfIemJpgrzhXB:yJbKkKF/eMNPjuzmFB
- TLSH T1F3F5C513B39A9635C1AD87308CEB038E1739FD12CB228B4B95547B1D7D72B48AE79D48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.