2026-09-22_039d8c9f4ccd8107162f2a8bd8ead1ee_amadey_elex_floxif_glassworm_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-22_039d8c9f4ccd8107162f2a8bd8ead1ee_amadey_elex_floxif_glassworm_smoke-loader
Size 6.3MB
Sample260922-2s34vstdph
SHA256 f3128a4d516ecce36e56b2b50d4196c4f6d7f6ccb30c6b426aea9a4b3ce3c9c7
MD5 039d8c9f4ccd8107162f2a8bd8ead1ee
SHA1 7a1eaa09f6db1a70230fbfd96e70859cf791d699
SHA512 5fdf2a3ff4bff04b72698700fb3e076de599f00d4db3a4e1f82a5d175dd5ce6230df026f63776fe1d2689aaaa639fbbcf0c17b0186eceec0b1ffa11d4cfbbb1f
SSDEEP 49152:ZbAcAZFlSjRniITY86GwBan2qXg4KGkS+DG4EqJpTalhCADtSdM5UOWWuvks97zp:Zb5AZmEiwB0B5hCA5SdMcH9bn
TLSH
T10866AE0ABE6E06A2C41D173905EFB6212F3CAF9977374BCB7151B590D9323C908BBA45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-22_039d8c9f4ccd8107162f2a8bd8ead1ee_amadey_elex_floxif_glassworm_smoke-loader

File Explorer

2026-09-22_039d8c9f4ccd8107162f2a8bd8ead1ee_amadey_elex_floxif_glassworm_smoke-loader

.exe 6.3MB

2026-09-22_039d8c9f4ccd8107162f2a8bd8ead1ee_amadey_elex_floxif_glassworm_smoke-loader

IMPHASH 6a822419a67a170751b62c728ad3aa64
SHA256 f3128a4d516ecce36e56b2b50d4196c4f6d7f6ccb30c6b426aea9a4b3ce3c9c7
MD5 039d8c9f4ccd8107162f2a8bd8ead1ee
SHA1 7a1eaa09f6db1a70230fbfd96e70859cf791d699
SHA512 5fdf2a3ff4bff04b72698700fb3e076de599f00d4db3a4e1f82a5d175dd5ce6230df026f63776fe1d2689aaaa639fbbcf0c17b0186eceec0b1ffa11d4cfbbb1f
SSDEEP 49152:ZbAcAZFlSjRniITY86GwBan2qXg4KGkS+DG4EqJpTalhCADtSdM5UOWWuvks97zp:Zb5AZmEiwB0B5hCA5SdMcH9bn
TLSH
T10866AE0ABE6E06A2C41D173905EFB6212F3CAF9977374BCB7151B590D9323C908BBA45
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

37:ab:2f:83:09:0b:cd:51:82:fe:e7:1e:5a:07:fe:d9:55:43:45:05

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Tally Solutions Private Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RnD,O=Tally Solutions Private Limited,L=Bangalore,ST=Karnataka,C=IN

Chains

Mar 27, 2015

CN=Tally Solutions Private Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RnD,O=Tally Solutions Private Limited,L=Bangalore,ST=Karnataka,C=IN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Tally Solutions Private Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RnD,O=Tally Solutions Private Limited,L=Bangalore,ST=Karnataka,C=IN

Serial Number

0b:dc:0e:72:b5:62:8c:50:bd:df:dd:df:d2:64:f5:78

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 29, 2012 - Feb 28, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

2137587

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\work\code.SeriesA_4.9x\tally.migtool\main\bin\release\tally72migration.pdb

kernel32

LockResource LoadResource FindResourceA SetLastError GetCurrentThreadId GetVersion GetFileType GetStdHandle GetTickCount GlobalMemoryStatus FlushConsoleInputBuffer GetSystemDirectoryA GetTimeZoneInformation GetDriveTypeA GetWindowsDirectoryA GetSystemInfo lstrlenA LocalFree HeapFree HeapAlloc GetSystemTimeAsFileTime GetModuleHandleA GetStartupInfoA GetCommandLineA SizeofResource EnterCriticalSection LeaveCriticalSection HeapReAlloc FileTimeToSystemTime FileTimeToLocalFileTime RtlUnwind SetConsoleCtrlHandler WriteFile SetConsoleMode GetConsoleMode RaiseException HeapDestroy HeapCreate VirtualFree DeleteCriticalSection VirtualAlloc IsBadWritePtr TlsAlloc TlsFree TlsSetValue TlsGetValue HeapSize UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings SetHandleCount LCMapStringA SetStdHandle GetFullPathNameA GetCurrentDirectoryA InterlockedExchange VirtualQuery VirtualProtect InitializeCriticalSection GetACP GetOEMCP CompareStringA SetEnvironmentVariableA GetStringTypeA GetLocaleInfoA IsBadReadPtr IsBadCodePtr SetEndOfFile SetFilePointer FlushFileBuffers ReadFile UnlockFile LockFile GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetVersionExA FreeLibrary GetCurrentProcessId QueryPerformanceCounter SetErrorMode GetModuleFileNameA FormatMessageA GetProfileStringA LoadLibraryA InterlockedDecrement ResetEvent OpenProcess WaitForSingleObject TerminateProcess CreateFileMappingA GetCurrentProcess DuplicateHandle CreateProcessA GetExitCodeProcess MapViewOfFile CreateEventA Beep FindNextFileA SetFileAttributesA GetLastError GetDiskFreeSpaceA CreateFileA GetFileSize CloseHandle FindFirstFileA FindClose SetUnhandledExceptionFilter DeleteFileA LocalUnlock LocalLock LocalAlloc MoveFileExA Sleep ReadConsoleInputA CreateDirectoryA ExitProcess RemoveDirectoryA

user32

SetTimer GetWindowThreadProcessId EnumWindows SendMessageA WaitForInputIdle HideCaret CreateCaret SetCaretPos ShowCaret GetDC EnumDisplaySettingsA GetKeyboardState MessageBoxA GetWindowDC DrawIcon ReleaseDC KillTimer LoadIconA LoadCursorA RegisterClassA SystemParametersInfoA GetSystemMetrics CreateWindowExA ShowWindow SetFocus GetClientRect DispatchMessageA GetQueueStatus PeekMessageA GetMessageA TranslateMessage LoadImageA GetDesktopWindow SetWindowPos EndPaint BeginPaint DefWindowProcA SetRect FrameRect FillRect CloseClipboard SetClipboardData GetKeyState ShowScrollBar OpenClipboard EmptyClipboard InvalidateRect SetScrollInfo SetScrollPos PostMessageA GetFocus GetUpdateRect PostQuitMessage RegisterClassExA GetProcessWindowStation GetUserObjectInformationW PtInRect GetCursorPos DestroyWindow UpdateWindow wsprintfA

gdi32

SetTextJustification GetDIBits SetEnhMetaFileBits GetEnhMetaFileHeader PlayEnhMetaFile CreateDCA CreateCompatibleBitmap CreateEnhMetaFileA GetTextMetricsA LineTo CreateRectRgn SetRectRgn DeleteDC GetDeviceCaps CreateCompatibleDC GetStockObject DeleteObject SelectObject CreatePen SetTextColor CreateSolidBrush SetBkColor GetRgnBox GetTextExtentPointA BitBlt FrameRgn SelectClipRgn CreateFontIndirectA StretchBlt MoveToEx PatBlt SetStretchBltMode TextOutA SetBkMode CreateBitmap SetTextAlign SetTextCharacterExtra Escape StartPage StartDocA AbortDoc EndDoc EndPage DeleteEnhMetaFile GetEnhMetaFileBits CloseEnhMetaFile PtInRegion CreateHalftonePalette CreatePalette GetDIBColorTable GetObjectA RealizePalette SelectPalette PaintRgn CombineRgn

rpcrt4

UuidFromStringA

wininet

InternetCrackUrlA InternetCanonicalizeUrlA InternetCreateUrlA InternetSetOptionA InternetCloseHandle InternetReadFile HttpSendRequestA HttpOpenRequestA InternetConnectA InternetOpenA HttpQueryInfoA InternetWriteFile HttpEndRequestA InternetQueryOptionA HttpSendRequestExA InternetQueryDataAvailable InternetAttemptConnect InternetSetFilePointer FtpOpenFileA

ole32

CoCreateGuid CoCreateInstance CLSIDFromProgID CoUninitialize CoInitialize

oleaut32

GetErrorInfo SysAllocString VariantClear SysFreeString VariantInit

winspool.drv

EndDocPrinter DeviceCapabilitiesA ClosePrinter DocumentPropertiesA OpenPrinterA StartPagePrinter StartDocPrinterA EndPagePrinter WritePrinter

wsock32

WSACleanup accept WSAAsyncSelect connect recv send WSAGetLastError gethostbyname ioctlsocket htonl ntohl inet_addr gethostbyaddr getsockname WSASetLastError ntohs socket WSAStartup closesocket shutdown htons

odbc32

ord13 ord15 ord14 ord16 ord27 ord11 ord41 ord75 ord24 ord18 ord36 ord4

advapi32

RegCloseKey RegQueryValueExA RegisterEventSourceW RegOpenKeyExA CryptReleaseContext ReportEventW DeregisterEventSource CryptAcquireContextA CryptGenRandom

rasapi32

RasHangUpA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-22_039d8c9f4ccd8107162f2a8bd8ead1ee_amadey_elex_floxif_glassworm_smoke-loader

PE Signature issue

kernel32

user32

gdi32

rpcrt4

wininet

ole32

oleaut32

winspool.drv

wsock32

odbc32

advapi32

rasapi32

generic