2026-09-23_2ee9fdac049f655894e5ab35edfe24d5_amadey_elex_floxif_glassworm_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-23_2ee9fdac049f655894e5ab35edfe24d5_amadey_elex_floxif_glassworm_smoke-loader
Size 6.7MB
Sample260924-nn8a5acf27
SHA256 6650c9f5475692aea82334749e60991c0f7855ab93f889c90c82c112321a3744
MD5 2ee9fdac049f655894e5ab35edfe24d5
SHA1 f66f08ad4075e69232d29df3b89874264902e656
SHA512 4d456c43b71c482cc6013bca957cc6a7fabae795b9d0c84a2ff09afbc020b0f53ab444b257ef5c8f432f752437010fe5b858362c801a75a903371c55b88578d0
SSDEEP 49152:D3QVGCKKb8bbZzOIniBJy0BK7JHCRrdfOzsOaR0IxEgkUAm/gRE3RhgJIC9weS6s:D3QwCKwgN1qBkJajAyj64/gZ85XH9jt
TLSH
T1EE66AF06FE9F42B1C86A037005AF22266B345FCE773647DB5294BC94E9333DA057A768
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-23_2ee9fdac049f655894e5ab35edfe24d5_amadey_elex_floxif_glassworm_smoke-loader

File Explorer

2026-09-23_2ee9fdac049f655894e5ab35edfe24d5_amadey_elex_floxif_glassworm_smoke-loader

.exe 6.7MB

2026-09-23_2ee9fdac049f655894e5ab35edfe24d5_amadey_elex_floxif_glassworm_smoke-loader

IMPHASH e39d31926c2a9a61bce453bce5997787
SHA256 6650c9f5475692aea82334749e60991c0f7855ab93f889c90c82c112321a3744
MD5 2ee9fdac049f655894e5ab35edfe24d5
SHA1 f66f08ad4075e69232d29df3b89874264902e656
SHA512 4d456c43b71c482cc6013bca957cc6a7fabae795b9d0c84a2ff09afbc020b0f53ab444b257ef5c8f432f752437010fe5b858362c801a75a903371c55b88578d0
SSDEEP 49152:D3QVGCKKb8bbZzOIniBJy0BK7JHCRrdfOzsOaR0IxEgkUAm/gRE3RhgJIC9weS6s:D3QwCKwgN1qBkJajAyj64/gZ85XH9jt
TLSH
T1EE66AF06FE9F42B1C86A037005AF22266B345FCE773647DB5294BC94E9333DA057A768
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2713993

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentDirectoryA GetFullPathNameA GetConsoleMode SetConsoleMode ReadConsoleInputA FileTimeToLocalFileTime FileTimeToSystemTime IsBadCodePtr IsBadReadPtr SetConsoleCtrlHandler RaiseException FlushConsoleInputBuffer lstrlenA GetLocaleInfoA VirtualProtect SetStdHandle SetEnvironmentVariableA GetOEMCP GetACP CompareStringW GetCPInfo CompareStringA VirtualQuery InterlockedExchange GetStringTypeW LCMapStringW LCMapStringA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetStdHandle HeapSize IsBadWritePtr VirtualAlloc VirtualFree HeapCreate HeapDestroy RtlUnwind HeapReAlloc ExitProcess GetCommandLineA GetStartupInfoA GetSystemTimeAsFileTime HeapAlloc HeapFree SetLastError GetModuleHandleA MoveFileExA LocalAlloc LocalLock LocalUnlock LocalFree GetSystemInfo GlobalMemoryStatus GetWindowsDirectoryA GetDriveTypeA GetVolumeInformationA GetTimeZoneInformation GetSystemDefaultLangID GetSystemDefaultLCID GetComputerNameA GetCurrentThreadId GetTickCount GetVersion GetSystemDirectoryA SetEndOfFile FlushFileBuffers WriteFile UnlockFile LockFile ReadFile SetFilePointer FindResourceA LoadResource LockResource SizeofResource GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetVersionExA FreeLibrary GetCurrentProcessId QueryPerformanceCounter GetModuleFileNameA SetErrorMode LoadLibraryA GetProcAddress GetProfileStringA InterlockedDecrement CreateProcessA RemoveDirectoryA GetExitCodeProcess OpenProcess TerminateProcess CreateEventA ResetEvent CreateFileMappingA MapViewOfFile WaitForSingleObject GetCurrentProcess DuplicateHandle Beep CreateFileA GetFileSize CloseHandle GetDiskFreeSpaceA FindFirstFileA FindNextFileA FindClose GetLastError SetFileAttributesA MultiByteToWideChar WideCharToMultiByte SetUnhandledExceptionFilter DeleteFileA Sleep CreateDirectoryA GetStringTypeA

user32

PeekMessageA GetQueueStatus GetMessageA DestroyWindow GetClientRect SetFocus ShowWindow CreateWindowExA GetSystemMetrics SystemParametersInfoA RegisterClassA LoadCursorA LoadIconA wsprintfA ReleaseDC DrawIcon GetWindowDC TranslateMessage GetWindowLongA SetWindowLongA EndPaint BeginPaint DefWindowProcA FillRect SetRect MessageBoxA GetKeyboardState GetDC EnumDisplaySettingsA ShowCaret SetCaretPos CreateCaret HideCaret EnumWindows SendMessageA InvalidateRect DispatchMessageA SetWindowPos PtInRect GetWindowThreadProcessId PostMessageA WaitForInputIdle KillTimer LoadImageA SetTimer FrameRect CloseClipboard SetClipboardData EmptyClipboard OpenClipboard GetClipboardData GetKeyState SetScrollPos GetFocus GetUpdateRect PostQuitMessage GetCursorPos RegisterClassExA SetScrollInfo ShowScrollBar UpdateWindow GetDesktopWindow

winspool.drv

ClosePrinter EndDocPrinter StartDocPrinterA WritePrinter StartPagePrinter EndPagePrinter OpenPrinterA DocumentPropertiesA DeviceCapabilitiesA

gdi32

LineTo PaintRgn GetObjectA CreateHalftonePalette GetDIBColorTable CreatePalette SelectPalette RealizePalette PtInRegion EndDoc AbortDoc StartDocA GetEnhMetaFileBits DeleteEnhMetaFile EndPage StartPage Escape SetTextCharacterExtra PatBlt MoveToEx GetTextMetricsA StretchBlt SetStretchBltMode GetTextExtentPointA SetTextAlign CreateBitmap SetBkMode GetRgnBox SelectClipRgn FrameRgn BitBlt CreateFontIndirectA SetTextColor CreatePen SetBkColor CreateSolidBrush SelectObject DeleteObject GetStockObject CreateCompatibleDC GetDeviceCaps DeleteDC CreateRectRgn SetRectRgn CombineRgn CreateEnhMetaFileA CreateCompatibleBitmap CreateDCA PlayEnhMetaFile SetEnhMetaFileBits GetEnhMetaFileHeader GetDIBits SetTextJustification TextOutA CloseEnhMetaFile

wininet

HttpSendRequestA HttpOpenRequestA InternetConnectA InternetOpenA InternetQueryDataAvailable HttpQueryInfoA HttpEndRequestA InternetAttemptConnect InternetWriteFile HttpSendRequestExA InternetQueryOptionA InternetCrackUrlA InternetCanonicalizeUrlA InternetCreateUrlA InternetSetOptionA InternetCloseHandle FtpOpenFileA InternetSetFilePointer InternetReadFile

wsock32

gethostbyname ioctlsocket ntohs htonl closesocket connect recv send WSAGetLastError htons shutdown WSASetLastError accept WSAAsyncSelect WSACleanup WSAStartup socket inet_addr gethostbyaddr getsockname ntohl

odbc32

ord75 ord41 ord11 ord36 ord18 ord16 ord14 ord15 ord13 ord4 ord27 ord24

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA CryptReleaseContext CryptGenRandom RegEnumValueA RegEnumKeyExA InitializeSecurityDescriptor SetSecurityDescriptorDacl RegSetKeySecurity RegSetValueExA RegDeleteKeyA RegCreateKeyExA CryptAcquireContextA

rpcrt4

UuidFromStringA

rasapi32

RasHangUpA

ole32

CoInitialize CoCreateGuid CoCreateInstance CLSIDFromProgID CoUninitialize

oleaut32

SysAllocString VariantClear GetErrorInfo VariantInit SysFreeString

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

192KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

88KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

144KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=3, id=15, productName=VS2003 (.NET) build 3077, version=3077,

count=5, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=2, id=95, version=2179,

count=13, id=28, productName=VS2002 (.NET) build 9466, version=9466,

count=1, id=14, version=7299,

count=5, id=105, version=2067,

count=243, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=1, id=96, version=2179,

count=2, id=28, version=9177,

count=2, id=25, version=9111,

count=2, id=93, version=2067,

count=23, id=93, version=2179,

count=343, id=1, productName=Unmarked objects,

count=157, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=34, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=372, productName=Unmarked objects (old),

count=408, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,

count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,