2026-10-08_bde5fa30adf6e1f9635439267fd0bf1d_amadey_elex_floxif_glassworm_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-08_bde5fa30adf6e1f9635439267fd0bf1d_amadey_elex_floxif_glassworm_smoke-loader
Size 6.3MB
Sample261009-fdaccaywc1
SHA256 41150c199beb8b5d77bfa0bce9efd6ba38c81f9f1e2e95fa1888874f1e15841c
MD5 bde5fa30adf6e1f9635439267fd0bf1d
SHA1 e43901b39d62710fc544ff5e4b58bd31e9352498
SHA512 d43f7d2de40ae16340b9ee28755e74b16154f0405fef7766476184dffeb2bc0b414b95aa390ae5e60ae1dfb52e28c495349e70d669daa8539c9e9bcbe690cfda
SSDEEP 49152:ZbA1AZF/SjRniITY86GwBan2qXg4KAkS+DG4EqJpTalhCADtSdM5UOWWuvks97zD:Zb4AZ0EiwB0BbhCA5SdMcH9bB
TLSH
T1F266AE0ABE6E06A2C41D173905EFB6212F3CAF9977374BCB7151B590D9323C908BBA45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-08_bde5fa30adf6e1f9635439267fd0bf1d_amadey_elex_floxif_glassworm_smoke-loader

File Explorer

2026-10-08_bde5fa30adf6e1f9635439267fd0bf1d_amadey_elex_floxif_glassworm_smoke-loader

.exe 6.3MB

2026-10-08_bde5fa30adf6e1f9635439267fd0bf1d_amadey_elex_floxif_glassworm_smoke-loader

IMPHASH 6a822419a67a170751b62c728ad3aa64
SHA256 41150c199beb8b5d77bfa0bce9efd6ba38c81f9f1e2e95fa1888874f1e15841c
MD5 bde5fa30adf6e1f9635439267fd0bf1d
SHA1 e43901b39d62710fc544ff5e4b58bd31e9352498
SHA512 d43f7d2de40ae16340b9ee28755e74b16154f0405fef7766476184dffeb2bc0b414b95aa390ae5e60ae1dfb52e28c495349e70d669daa8539c9e9bcbe690cfda
SSDEEP 49152:ZbA1AZF/SjRniITY86GwBan2qXg4KAkS+DG4EqJpTalhCADtSdM5UOWWuvks97zD:Zb4AZ0EiwB0BbhCA5SdMcH9bB
TLSH
T1F266AE0ABE6E06A2C41D173905EFB6212F3CAF9977374BCB7151B590D9323C908BBA45
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

f3:95:0b:c7:65:6f:d7:f8:3b:f7:ca:0c:17:2e:d3:c5:40:c4:23:e5

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Tally Solutions Private Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RnD,O=Tally Solutions Private Limited,L=Bangalore,ST=Karnataka,C=IN

Chains

Mar 27, 2015

CN=Tally Solutions Private Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RnD,O=Tally Solutions Private Limited,L=Bangalore,ST=Karnataka,C=IN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Tally Solutions Private Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RnD,O=Tally Solutions Private Limited,L=Bangalore,ST=Karnataka,C=IN

Serial Number

0b:dc:0e:72:b5:62:8c:50:bd:df:dd:df:d2:64:f5:78

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 29, 2012 - Feb 28, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

2137587

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\work\code.SeriesA_4.9x\tally.migtool\main\bin\release\tally72migration.pdb

kernel32

LockResource LoadResource FindResourceA SetLastError GetCurrentThreadId GetVersion GetFileType GetStdHandle GetTickCount GlobalMemoryStatus FlushConsoleInputBuffer GetSystemDirectoryA GetTimeZoneInformation GetDriveTypeA GetWindowsDirectoryA GetSystemInfo lstrlenA LocalFree HeapFree HeapAlloc GetSystemTimeAsFileTime GetModuleHandleA GetStartupInfoA GetCommandLineA SizeofResource EnterCriticalSection LeaveCriticalSection HeapReAlloc FileTimeToSystemTime FileTimeToLocalFileTime RtlUnwind SetConsoleCtrlHandler WriteFile SetConsoleMode GetConsoleMode RaiseException HeapDestroy HeapCreate VirtualFree DeleteCriticalSection VirtualAlloc IsBadWritePtr TlsAlloc TlsFree TlsSetValue TlsGetValue HeapSize UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings SetHandleCount LCMapStringA SetStdHandle GetFullPathNameA GetCurrentDirectoryA InterlockedExchange VirtualQuery VirtualProtect InitializeCriticalSection GetACP GetOEMCP CompareStringA SetEnvironmentVariableA GetStringTypeA GetLocaleInfoA IsBadReadPtr IsBadCodePtr SetEndOfFile SetFilePointer FlushFileBuffers ReadFile UnlockFile LockFile GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetVersionExA FreeLibrary GetCurrentProcessId QueryPerformanceCounter SetErrorMode GetModuleFileNameA FormatMessageA GetProfileStringA LoadLibraryA InterlockedDecrement ResetEvent OpenProcess WaitForSingleObject TerminateProcess CreateFileMappingA GetCurrentProcess DuplicateHandle CreateProcessA GetExitCodeProcess MapViewOfFile CreateEventA Beep FindNextFileA SetFileAttributesA GetLastError GetDiskFreeSpaceA CreateFileA GetFileSize CloseHandle FindFirstFileA FindClose SetUnhandledExceptionFilter DeleteFileA LocalUnlock LocalLock LocalAlloc MoveFileExA Sleep ReadConsoleInputA CreateDirectoryA ExitProcess RemoveDirectoryA

user32

SetTimer GetWindowThreadProcessId EnumWindows SendMessageA WaitForInputIdle HideCaret CreateCaret SetCaretPos ShowCaret GetDC EnumDisplaySettingsA GetKeyboardState MessageBoxA GetWindowDC DrawIcon ReleaseDC KillTimer LoadIconA LoadCursorA RegisterClassA SystemParametersInfoA GetSystemMetrics CreateWindowExA ShowWindow SetFocus GetClientRect DispatchMessageA GetQueueStatus PeekMessageA GetMessageA TranslateMessage LoadImageA GetDesktopWindow SetWindowPos EndPaint BeginPaint DefWindowProcA SetRect FrameRect FillRect CloseClipboard SetClipboardData GetKeyState ShowScrollBar OpenClipboard EmptyClipboard InvalidateRect SetScrollInfo SetScrollPos PostMessageA GetFocus GetUpdateRect PostQuitMessage RegisterClassExA GetProcessWindowStation GetUserObjectInformationW PtInRect GetCursorPos DestroyWindow UpdateWindow wsprintfA

gdi32

SetTextJustification GetDIBits SetEnhMetaFileBits GetEnhMetaFileHeader PlayEnhMetaFile CreateDCA CreateCompatibleBitmap CreateEnhMetaFileA GetTextMetricsA LineTo CreateRectRgn SetRectRgn DeleteDC GetDeviceCaps CreateCompatibleDC GetStockObject DeleteObject SelectObject CreatePen SetTextColor CreateSolidBrush SetBkColor GetRgnBox GetTextExtentPointA BitBlt FrameRgn SelectClipRgn CreateFontIndirectA StretchBlt MoveToEx PatBlt SetStretchBltMode TextOutA SetBkMode CreateBitmap SetTextAlign SetTextCharacterExtra Escape StartPage StartDocA AbortDoc EndDoc EndPage DeleteEnhMetaFile GetEnhMetaFileBits CloseEnhMetaFile PtInRegion CreateHalftonePalette CreatePalette GetDIBColorTable GetObjectA RealizePalette SelectPalette PaintRgn CombineRgn

rpcrt4

UuidFromStringA

wininet

InternetCrackUrlA InternetCanonicalizeUrlA InternetCreateUrlA InternetSetOptionA InternetCloseHandle InternetReadFile HttpSendRequestA HttpOpenRequestA InternetConnectA InternetOpenA HttpQueryInfoA InternetWriteFile HttpEndRequestA InternetQueryOptionA HttpSendRequestExA InternetQueryDataAvailable InternetAttemptConnect InternetSetFilePointer FtpOpenFileA

ole32

CoCreateGuid CoCreateInstance CLSIDFromProgID CoUninitialize CoInitialize

oleaut32

GetErrorInfo SysAllocString VariantClear SysFreeString VariantInit

winspool.drv

EndDocPrinter DeviceCapabilitiesA ClosePrinter DocumentPropertiesA OpenPrinterA StartPagePrinter StartDocPrinterA EndPagePrinter WritePrinter

wsock32

WSACleanup accept WSAAsyncSelect connect recv send WSAGetLastError gethostbyname ioctlsocket htonl ntohl inet_addr gethostbyaddr getsockname WSASetLastError ntohs socket WSAStartup closesocket shutdown htons

odbc32

ord13 ord15 ord14 ord16 ord27 ord11 ord41 ord75 ord24 ord18 ord36 ord4

advapi32

RegCloseKey RegQueryValueExA RegisterEventSourceW RegOpenKeyExA CryptReleaseContext ReportEventW DeregisterEventSource CryptAcquireContextA CryptGenRandom

rasapi32

RasHangUpA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-08_bde5fa30adf6e1f9635439267fd0bf1d_amadey_elex_floxif_glassworm_smoke-loader

PE Signature issue

kernel32

user32

gdi32

rpcrt4

wininet

ole32

oleaut32

winspool.drv

wsock32

odbc32

advapi32

rasapi32

generic