2026-11-09_25befb26dc16159916493bab763ec79f_amadey_elex_floxif_glassworm_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_25befb26dc16159916493bab763ec79f_amadey_elex_floxif_glassworm_smoke-loader
Size 6.1MB
Sample261111-a5sp4sda37
SHA256 01e77d4d284492ac514828ece1578f239a2ab42c016de171c2080eb74ca13844
MD5 25befb26dc16159916493bab763ec79f
SHA1 66f57a558533f7c78b96e722ee19acf0abe8e674
SHA512 9d965bc73ab0668d3464307a8e9bcc71b512d737428611023fa052ef83d20e1f5f3551b796a4af5df924151e862a3fb1f0b0e5d4284e3f80396534529d85cfc9
SSDEEP 49152:3haPxK/ewRMF46KEGzUUwu0KM+s8YS+DG4EqJtCAza9j+D5NUOWWuvks97zPokaC:3ha5K/tRvXBwu0dZ7CAza9s5YH9L
TLSH
T170568D06BE6E0666C8D9073905E7A6212F3C5F89F7364BCB725DF590D8323C948BEA44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_25befb26dc16159916493bab763ec79f_amadey_elex_floxif_glassworm_smoke-loader

File Explorer

2026-11-09_25befb26dc16159916493bab763ec79f_amadey_elex_floxif_glassworm_smoke-loader

.exe 6.1MB

2026-11-09_25befb26dc16159916493bab763ec79f_amadey_elex_floxif_glassworm_smoke-loader

IMPHASH cd1a841d765be5a514d85e4c4c68c09b
SHA256 01e77d4d284492ac514828ece1578f239a2ab42c016de171c2080eb74ca13844
MD5 25befb26dc16159916493bab763ec79f
SHA1 66f57a558533f7c78b96e722ee19acf0abe8e674
SHA512 9d965bc73ab0668d3464307a8e9bcc71b512d737428611023fa052ef83d20e1f5f3551b796a4af5df924151e862a3fb1f0b0e5d4284e3f80396534529d85cfc9
SSDEEP 49152:3haPxK/ewRMF46KEGzUUwu0KM+s8YS+DG4EqJtCAza9j+D5NUOWWuvks97zPokaC:3ha5K/tRvXBwu0dZ7CAza9s5YH9L
TLSH
T170568D06BE6E0666C8D9073905E7A6212F3C5F89F7364BCB725DF590D8323C948BEA44
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1992835

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\work\prod.tally9-erp9a.STABLE\tally.migtool\main\bin\release\tally72migration.pdb

kernel32

GlobalLock GlobalAlloc LockFile UnlockFile ReadFile FlushFileBuffers SetFilePointer SetEndOfFile WriteFile SizeofResource LockResource LoadResource FindResourceA SetLastError GetCurrentThreadId GlobalMemoryStatus GetTickCount FlushConsoleInputBuffer GetStdHandle GetSystemDirectoryA GetTimeZoneInformation GetDriveTypeA GetWindowsDirectoryA GetSystemInfo lstrlenA LocalFree HeapFree HeapAlloc GlobalUnlock GetModuleHandleA GetStartupInfoA GetCommandLineA ExitProcess EnterCriticalSection LeaveCriticalSection HeapReAlloc RtlUnwind SetConsoleCtrlHandler RaiseException HeapDestroy HeapCreate VirtualFree DeleteCriticalSection VirtualAlloc IsBadWritePtr TlsAlloc TlsFree TlsSetValue TlsGetValue HeapSize UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings SetHandleCount GetFileType LCMapStringA GetStringTypeA SetStdHandle InterlockedExchange VirtualQuery VirtualProtect InitializeCriticalSection GetACP GetOEMCP CompareStringA SetEnvironmentVariableA GetLocaleInfoA IsBadReadPtr IsBadCodePtr GlobalFree GetVersionExA FreeLibrary GetCurrentProcessId QueryPerformanceCounter SetErrorMode GetModuleFileNameA FormatMessageA GetProfileStringA LoadLibraryA InterlockedDecrement ResetEvent OpenProcess WaitForSingleObject TerminateProcess CreateFileMappingA GetCurrentProcess DuplicateHandle CreateProcessA GetExitCodeProcess MapViewOfFile CreateEventA Beep FindNextFileA SetFileAttributesA GetLastError GetDiskFreeSpaceA CreateFileA GetFileSize CloseHandle FindFirstFileA FindClose SetUnhandledExceptionFilter DeleteFileA Sleep FileTimeToLocalFileTime ReadConsoleInputA SetConsoleMode GetConsoleMode GetCurrentDirectoryA GetSystemTimeAsFileTime GetFullPathNameA CreateDirectoryA RemoveDirectoryA LocalUnlock LocalLock LocalAlloc MoveFileExA FileTimeToSystemTime

user32

SetTimer GetWindowThreadProcessId EnumWindows SendMessageA WaitForInputIdle HideCaret CreateCaret SetCaretPos ShowCaret GetDC EnumDisplaySettingsA GetKeyboardState MessageBoxA GetWindowDC DrawIcon OpenClipboard DestroyWindow LoadIconA GetDesktopWindow RegisterClassA KillTimer GetSystemMetrics CreateWindowExA ShowWindow SetFocus GetClientRect DispatchMessageA GetQueueStatus PeekMessageA GetMessageA TranslateMessage SetWindowPos EndPaint BeginPaint DefWindowProcA SetRect FrameRect FillRect CloseClipboard GetKeyState ShowScrollBar SetClipboardData SystemParametersInfoA LoadImageA InvalidateRect SetScrollInfo SetScrollPos PostMessageA LoadCursorA EmptyClipboard GetFocus GetUpdateRect PostQuitMessage RegisterClassExA UpdateWindow PtInRect ReleaseDC GetCursorPos wsprintfA

gdi32

CreateRectRgn DeleteDC GetDeviceCaps CreateCompatibleDC GetStockObject DeleteObject SelectObject CreatePen SetTextColor CreateSolidBrush CombineRgn SetTextJustification GetDIBits SetEnhMetaFileBits GetEnhMetaFileHeader PlayEnhMetaFile CreateDCA CreateCompatibleBitmap SetBkColor GetRgnBox GetTextExtentPointA BitBlt FrameRgn SelectClipRgn CreateFontIndirectA StretchBlt MoveToEx PatBlt SetStretchBltMode TextOutA SetBkMode CreateBitmap SetTextAlign SetTextCharacterExtra Escape StartPage StartDocA AbortDoc EndDoc EndPage DeleteEnhMetaFile GetEnhMetaFileBits CloseEnhMetaFile PtInRegion CreateHalftonePalette CreatePalette GetDIBColorTable GetObjectA RealizePalette SelectPalette PaintRgn LineTo GetTextMetricsA CreateEnhMetaFileA SetRectRgn

rpcrt4

UuidFromStringA

wininet

InternetCrackUrlA InternetCanonicalizeUrlA InternetCreateUrlA InternetSetOptionA InternetCloseHandle InternetReadFile HttpSendRequestA HttpOpenRequestA InternetConnectA InternetOpenA HttpQueryInfoA InternetWriteFile HttpEndRequestA InternetQueryOptionA HttpSendRequestExA InternetQueryDataAvailable InternetAttemptConnect InternetSetFilePointer FtpOpenFileA

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext RegOpenKeyExA RegCloseKey RegQueryValueExA

ole32

CoCreateGuid CoCreateInstance CLSIDFromProgID CoUninitialize CoInitialize

oleaut32

VariantInit SysAllocString VariantClear SysFreeString GetErrorInfo

winspool.drv

EndDocPrinter DeviceCapabilitiesA ClosePrinter DocumentPropertiesA OpenPrinterA StartPagePrinter StartDocPrinterA EndPagePrinter WritePrinter

wsock32

connect WSACleanup accept gethostbyname ntohs recv send ioctlsocket ntohl htonl inet_addr gethostbyaddr getsockname WSASetLastError htons WSAAsyncSelect WSAStartup closesocket shutdown WSAGetLastError socket

odbc32

ord13 ord15 ord14 ord16 ord27 ord11 ord41 ord75 ord24 ord18 ord36 ord4

rasapi32

RasHangUpA

generic

count=5, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=13, id=28, productName=VS2002 (.NET) build 9466, version=9466,

count=1, id=14, version=7299,

count=2, id=19, version=8034,

count=243, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=197, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=38, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=1, id=96, version=2179,

count=2, id=28, version=9177,

count=2, id=25, version=9111,

count=2, id=93, version=2067,

count=21, id=93, version=2179,

count=344, id=1, productName=Unmarked objects,

count=19, id=105, version=2067,

count=19, id=95, version=2179,

count=749, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,

count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,