General
- Target 2026-05-03_dc5b5316254ac4f07a3f9470341cd6f6_elex_glassworm_poet-rat_remcos_stop_tobfy
- Size 15.2MB
- Sample260503-tkfdtsgt5q
- SHA256 dd768bd069a0f67935f5bdf4e8d4701d99bda9aa0a9b8b370591c6a5f2beab8e
- MD5 dc5b5316254ac4f07a3f9470341cd6f6
- SHA1 cc39945f6d269c604baa9bba2ac81a260be89ccf
- SHA512 4a095a5171930ff79e8ca9a629852e10b2825b629fa68b5080282954319972e0f60a82f4c0d391ac987098eb7a828461de61358ed31ac03b5effeb6e8de9f30f
- SSDEEP 196608:Fi57qF0lKsoXpxK14rvRPrui8eIcEWDmrdMjcO4oTDDEDa6Fx:U5K0lhoX7w4rpXmdMYEHD+a6/
- TLSH T1ADF66A02F7C68271D89F26B048A77269A336BD4087F542F7E7943D1BE875BC26834396
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-03_dc5b5316254ac4f07a3f9470341cd6f6_elex_glassworm_poet-rat_remcos_stop_tobfy.exe
Resource
win10v2004-20260130-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-03_dc5b5316254ac4f07a3f9470341cd6f6_elex_glassworm_poet-rat_remcos_stop_tobfy.exe
Resource
win11-20260130-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-03_dc5b5316254ac4f07a3f9470341cd6f6_elex_glassworm_poet-rat_remcos_stop_tobfy
- Size 15.2MB
- SHA256 dd768bd069a0f67935f5bdf4e8d4701d99bda9aa0a9b8b370591c6a5f2beab8e
- MD5 dc5b5316254ac4f07a3f9470341cd6f6
- SHA1 cc39945f6d269c604baa9bba2ac81a260be89ccf
- SHA512 4a095a5171930ff79e8ca9a629852e10b2825b629fa68b5080282954319972e0f60a82f4c0d391ac987098eb7a828461de61358ed31ac03b5effeb6e8de9f30f
- SSDEEP 196608:Fi57qF0lKsoXpxK14rvRPrui8eIcEWDmrdMjcO4oTDDEDa6Fx:U5K0lhoX7w4rpXmdMYEHD+a6/
- TLSH T1ADF66A02F7C68271D89F26B048A77269A336BD4087F542F7E7943D1BE875BC26834396
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger