2026-05-28_cde2eb76f6f1af5239d1f6b8e8145340_elex_floxif_glassworm_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-28_cde2eb76f6f1af5239d1f6b8e8145340_elex_floxif_glassworm_stop
Size 6.4MB
Sample260528-sa8rysds91
SHA256 99cf8ebce4806ff05a5c9e5e7ca6eb54d6664be8e8a01ab462c2ce1703a7c64a
MD5 cde2eb76f6f1af5239d1f6b8e8145340
SHA1 9a61b09db89e57fb23d00bdf3d337e9d908c02ee
SHA512 4182770e91c87ea0d06b61a26c10e8f6a7e4ca781f98785214259b3939d372ef15253ec7b8b3f3a9ba0509e994a4581dfa6b98bca42f7a753d00582bd2ab4c36
SSDEEP 196608:q81Sglm9RLslS+dmPC4IiXWrBfpMXOfCG0lGN:THlCL3jqYX6FJCFGN
TLSH
T1E16633223EE0D6B1E07165F07AAAC77595B2FC390825948F53E84B192F386538F2D736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-05-28_cde2eb76f6f1af5239d1f6b8e8145340_elex_floxif_glassworm_stop

File Explorer

2026-05-28_cde2eb76f6f1af5239d1f6b8e8145340_elex_floxif_glassworm_stop

.exe 6.4MB

2026-05-28_cde2eb76f6f1af5239d1f6b8e8145340_elex_floxif_glassworm_stop

IMPHASH 586694de0c822e86829bf1e2c856646f
SHA256 99cf8ebce4806ff05a5c9e5e7ca6eb54d6664be8e8a01ab462c2ce1703a7c64a
MD5 cde2eb76f6f1af5239d1f6b8e8145340
SHA1 9a61b09db89e57fb23d00bdf3d337e9d908c02ee
SHA512 4182770e91c87ea0d06b61a26c10e8f6a7e4ca781f98785214259b3939d372ef15253ec7b8b3f3a9ba0509e994a4581dfa6b98bca42f7a753d00582bd2ab4c36
SSDEEP 196608:q81Sglm9RLslS+dmPC4IiXWrBfpMXOfCG0lGN:THlCL3jqYX6FJCFGN
TLSH
T1E16633223EE0D6B1E07165F07AAAC77595B2FC390825948F53E84B192F386538F2D736
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

fb:cf:f4:bf:eb:18:b7:c3:c8:27:99:c9:f1:7e:a3:28:3d:1f:8b:47:f1:4b:81:9a:87:ab:75:af:3b:55:01:71

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Bandisoft,O=Bandisoft,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Chains

Jan 4, 2022

CN=Bandisoft,O=Bandisoft,L=Yeongdeungpo-gu,ST=Seoul,C=KR

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

dd:ba:e5:e0:af:aa:04:f0:c5:c6:e8:5b:3b:92:98:20:b7:4b:6f:5b

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Bandisoft,O=Bandisoft,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Chains

Jan 4, 2022

CN=Bandisoft,O=Bandisoft,L=Yeongdeungpo-gu,ST=Seoul,C=KR

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Bandisoft,O=Bandisoft,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Serial Number

1f:f4:a4:9d:4c:ac:03:27:a3:fe:9c:d7:1e:31:cb:4a

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 29, 2020 - Mar 26, 2023

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2020 - Jan 22, 2032

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

311213

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\devel\inst\bin.2008\xstub.pdb

kernel32

InterlockedIncrement InterlockedDecrement lstrcmpiW LeaveCriticalSection RaiseException EnterCriticalSection MultiByteToWideChar InitializeCriticalSection DeleteCriticalSection SetErrorMode FlushInstructionCache SetCurrentDirectoryW MulDiv CopyFileW GetCurrentThreadId SetLastError CreateMutexW MoveFileW GetUserDefaultUILanguage GetVersion GetCurrentThread GlobalAlloc CreateThread SetUnhandledExceptionFilter GetCurrentProcessId WideCharToMultiByte InterlockedExchange lstrlenA GetSystemInfo ReadFile SetFilePointer SetFilePointerEx SetFileTime WriteFile IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetModuleFileNameA GetStdHandle LCMapStringW GetEnvironmentStringsW FreeEnvironmentStringsW LoadLibraryExW IsValidCodePage GetOEMCP GetACP GetCPInfo HeapCreate TlsFree TlsSetValue TlsAlloc TlsGetValue GetStartupInfoW SetConsoleCtrlHandler IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime ExitThread VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetStringTypeW SetHandleCount GetFileType GetStartupInfoA RtlUnwind GetCommandLineW QueryPerformanceCounter InitializeCriticalSectionAndSpinCount LCMapStringA GetConsoleCP GetConsoleMode CompareStringW SetEnvironmentVariableA SetEnvironmentVariableW GetLocaleInfoW GetModuleHandleA SetStdHandle FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA CompareStringA Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalMemoryStatusEx GetFileSizeEx CreateFileW GetFileSize GetWindowsDirectoryW GetTempFileNameW GetTempPathW RemoveDirectoryW FindClose FindNextFileW SetFileAttributesW DeleteFileW FindFirstFileW GetExitCodeProcess GetStringTypeA CreateProcessW GetCurrentProcess GetProcAddress GetModuleHandleW lstrcpyW GetLastError GetFileAttributesW GetModuleFileNameW GlobalFree CreateDirectoryW GetSystemDirectoryW FreeLibrary LoadLibraryW lstrlenW ExitProcess FindResourceExW FindResourceW LoadResource LockResource SizeofResource TerminateThread GetTickCount Sleep CloseHandle GetExitCodeThread GetTimeZoneInformation WaitForSingleObject

user32

ReleaseCapture SetCapture TrackPopupMenuEx TrackMouseEvent UpdateWindow UnionRect SetWindowRgn GetPropW RegisterClassW RemovePropW SetPropW GetDesktopWindow GetWindowPlacement ClientToScreen InflateRect InvalidateRect SetRect GetWindowDC IsWindowEnabled SetScrollRange ScreenToClient SetScrollPos EnableWindow IsWindowVisible EndPaint BeginPaint DestroyWindow SetCursor SetRectEmpty DrawTextW GetSysColor ReleaseDC GetDC GetDlgItem GetFocus GetWindowTextLengthW GetWindowTextW SubtractRect IsRectEmpty SetScrollInfo AdjustWindowRectEx IntersectRect RegisterWindowMessageW SetTimer GetCursorPos AppendMenuW CreatePopupMenu SendMessageTimeoutW GetKeyState ShowWindow CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW KillTimer GetSystemMenu EnableMenuItem GetWindow MonitorFromWindow SetWindowPos SetWindowTextW LoadIconW PostQuitMessage PostMessageW CallWindowProcW DefWindowProcW GetWindowLongW SetWindowLongW MapWindowPoints GetClientRect TranslateAcceleratorW IsDialogMessageW GetNextDlgTabItem GetMessageW LoadAcceleratorsW CharNextW SetFocus GetParent MoveWindow EqualRect GetWindowRect OffsetRect MonitorFromPoint CopyRect GetSystemMetrics SystemParametersInfoW GetMonitorInfoW MonitorFromRect IsCharAlphaW SendMessageW FindWindowW MessageBoxW IsWindow DispatchMessageW TranslateMessage PeekMessageW PtInRect UnregisterClassA

gdi32

MoveToEx LineTo CreateRectRgn ExtTextOutW OffsetRgn CreateSolidBrush GetDeviceCaps SetBkColor ExcludeClipRect GetTextMetricsW SetBkMode GetStockObject SetWindowOrgEx CreateCompatibleBitmap SetTextColor CreateFontW BitBlt DeleteDC SelectObject CreateCompatibleDC CreateDIBSection DeleteObject GetObjectW

advapi32

EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken OpenThreadToken RegDeleteValueW RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyW RegCloseKey RegQueryValueExW RegOpenKeyExW FreeSid

shell32

SHGetPathFromIDListW ShellExecuteW SHBrowseForFolderW ord190 ord155 SHAppBarMessage ShellExecuteExW SHGetFolderPathW

ole32

CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoUninitialize

oleaut32

SysFreeString VariantInit SysAllocString VarUI4FromStr VariantClear

shlwapi

PathCanonicalizeW PathIsDirectoryW ord176

wininet

InternetReadFile InternetQueryDataAvailable InternetQueryOptionW HttpOpenRequestA HttpEndRequestW InternetWriteFile HttpSendRequestExW HttpSendRequestW InternetErrorDlg HttpQueryInfoW HttpAddRequestHeadersW InternetConnectA InternetSetOptionW InternetOpenW InternetCrackUrlA InternetCloseHandle

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-28_cde2eb76f6f1af5239d1f6b8e8145340_elex_floxif_glassworm_stop

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

generic