General
- Target 2026-06-29_fc8778a7c332816c43a7fa6825159fa6_elex_glassworm_smoke-loader_stealc_stop_tofsee
- Size 890KB
- Sample260630-a94ceact2n
- SHA256 d6095946ec05e1dd7553353c1694990e59a5d4e8c5e2f9aa62249c34534ba4a4
- MD5 fc8778a7c332816c43a7fa6825159fa6
- SHA1 6834e545ebd34d9558bd2b4f26d31a82118861c7
- SHA512 20b5eb513c3bb255c7c79e0478032a0a0720bcb37bdffc9c080711fec7274526eb62aabd2ea698b1f5456be2507769d82ee0e8171f7f1a72c56b69a035112044
- SSDEEP 12288:YwKfOVRo9yRY8NIGLUh7Wk/LpTx5KEZMqs:YxWVeyRY8NIG8BTzBs
- TLSH T12B156C42F284D436D4630E3248F38A70EA767C7957B14A57728C773A6FB33C2547AA1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-06-29_fc8778a7c332816c43a7fa6825159fa6_elex_glassworm_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-06-29_fc8778a7c332816c43a7fa6825159fa6_elex_glassworm_smoke-loader_stealc_stop_tofsee.exe
Resource
win11ltsc2024-20260629-en
Malware Config
Targets
-
- Target 2026-06-29_fc8778a7c332816c43a7fa6825159fa6_elex_glassworm_smoke-loader_stealc_stop_tofsee
- Size 890KB
- SHA256 d6095946ec05e1dd7553353c1694990e59a5d4e8c5e2f9aa62249c34534ba4a4
- MD5 fc8778a7c332816c43a7fa6825159fa6
- SHA1 6834e545ebd34d9558bd2b4f26d31a82118861c7
- SHA512 20b5eb513c3bb255c7c79e0478032a0a0720bcb37bdffc9c080711fec7274526eb62aabd2ea698b1f5456be2507769d82ee0e8171f7f1a72c56b69a035112044
- SSDEEP 12288:YwKfOVRo9yRY8NIGLUh7Wk/LpTx5KEZMqs:YxWVeyRY8NIG8BTzBs
- TLSH T12B156C42F284D436D4630E3248F38A70EA767C7957B14A57728C773A6FB33C2547AA1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1