2026-10-22_b5e2eb04bf290bd038925973670bf28f_elex_glassworm_mafia_remcos_smoke-loader

General

Target
2026-10-22_b5e2eb04bf290bd038925973670bf28f_elex_glassworm_mafia_remcos_smoke-loader
Size 1.7MB
Sample261023-3lp44a1vhx
SHA256 6531940e829508d10ec830d91f8879e82040282053597fe95cbd116b48753c02
MD5 b5e2eb04bf290bd038925973670bf28f
SHA1 97f0998ec25f2eb8c7615febd487160796a012c5
SHA512 7e49e3cbbc4ba35c2521643fa452130b3edcddf171d7fa3e3a440aeb626b0cb5a0082f1183cb26c40ee0d0f1d8a1d710479329a84858928ed39adef0cb849d3c
SSDEEP 49152:C5sv2Kglnkl7Qnoyx3e+EUOv4lTxPtBejqCabNLA+tgauhwbR3P8wT8:C5sv2KglnkioM3e+tOw1BejqCaRgaPJ
TLSH
T121859C32E2D0C127F0D322F982B55170B9B09C615F3701D7D6E06E2F6A7BAD1A171B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_b5e2eb04bf290bd038925973670bf28f_elex_glassworm_mafia_remcos_smoke-loader

File Explorer

2026-10-22_b5e2eb04bf290bd038925973670bf28f_elex_glassworm_mafia_remcos_smoke-loader

.exe 1.7MB

2026-10-22_b5e2eb04bf290bd038925973670bf28f_elex_glassworm_mafia_remcos_smoke-loader

IMPHASH 5a9e4c04685811572a9c167f459b0758
SHA256 6531940e829508d10ec830d91f8879e82040282053597fe95cbd116b48753c02
MD5 b5e2eb04bf290bd038925973670bf28f
SHA1 97f0998ec25f2eb8c7615febd487160796a012c5
SHA512 7e49e3cbbc4ba35c2521643fa452130b3edcddf171d7fa3e3a440aeb626b0cb5a0082f1183cb26c40ee0d0f1d8a1d710479329a84858928ed39adef0cb849d3c
SSDEEP 49152:C5sv2Kglnkl7Qnoyx3e+EUOv4lTxPtBejqCabNLA+tgauhwbR3P8wT8:C5sv2KglnkioM3e+tOw1BejqCaRgaPJ
TLSH
T121859C32E2D0C127F0D322F982B55170B9B09C615F3701D7D6E06E2F6A7BAD1A171B6A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

295872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\dvs\p4\build\sw\rel\gpu_drv\r304\r304_00\drivers\notifius\daemon\exe\Win32\ReleaseUnicode\daemonU.pdb

psapi

GetModuleBaseNameA

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpSendRequest WinHttpQueryHeaders WinHttpReceiveResponse WinHttpReadData WinHttpAddRequestHeaders WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpSetOption WinHttpOpenRequest WinHttpOpen

kernel32

ReleaseSemaphore GetModuleHandleA SetEnvironmentVariableA GetTimeZoneInformation CompareStringW WriteConsoleW HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID SetFilePointer GetLocaleInfoW GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize HeapCreate TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage GetOEMCP GetSystemTime CreateProcessW GetCurrentProcess WaitForSingleObject OutputDebugStringW Sleep GetExitCodeProcess GetFileAttributesW GetModuleFileNameW GetTempPathW GetLastError SetConsoleCtrlHandler CloseHandle QueryPerformanceCounter QueryPerformanceFrequency FindFirstFileW HeapAlloc HeapFree GetModuleHandleW GetProcessHeap GetProcAddress FindClose FindNextFileW LocalFree SetFileAttributesW lstrlenW GetSystemTimeAsFileTime GetProcessTimes GetTickCount GetVersionExW GetFileAttributesExW CreateFileW GetCurrentThread InterlockedDecrement WideCharToMultiByte MultiByteToWideChar SetEnvironmentVariableW GetModuleHandleExW CreateDirectoryW CopyFileW GetStartupInfoW GetStdHandle SetLastError LocalAlloc RemoveDirectoryW WaitForMultipleObjects DeleteFileW GetVolumeInformationW CreateMutexW SystemTimeToFileTime SetEvent WriteFile FormatMessageW FileTimeToSystemTime ReadFile DebugBreak FlushFileBuffers ResetEvent CreateSemaphoreW CreateEventW ReleaseMutex FileTimeToLocalFileTime InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetModuleFileNameA lstrlenA SetEndOfFile SetFilePointerEx GetFileInformationByHandle GetACP GetConsoleCP ExitProcess SetHandleCount IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess LCMapStringW FreeLibrary InterlockedExchange LoadLibraryA RaiseException InterlockedIncrement InterlockedCompareExchange GetStringTypeW EncodePointer DecodePointer DeleteCriticalSection ReadConsoleInputA SetConsoleMode GetConsoleMode PeekConsoleInputA GetNumberOfConsoleInputEvents GetCommandLineA HeapSetInformation LoadLibraryW MoveFileW SetStdHandle InitializeCriticalSectionAndSpinCount GetFileType ExitThread GetCurrentThreadId CreateThread GetCPInfo RtlUnwind

ole32

CoUninitialize CoInitialize StringFromGUID2 CoCreateGuid CoCreateInstance

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_b5e2eb04bf290bd038925973670bf28f_elex_glassworm_mafia_remcos_smoke-loader

psapi

winhttp

kernel32

ole32

generic