General
- Target 2026-07-03_01eeff73a6a83d0bc2ce5b42823672f8_elex_glassworm_hijackloader_poet-rat_remcos_stop
- Size 7.6MB
- Sample260703-a9vehad17n
- SHA256 95e874571955c7b39e0a2b18dbd9247fc8670f12b798cb6dabb3c7d4055f764c
- MD5 01eeff73a6a83d0bc2ce5b42823672f8
- SHA1 d3c20243b6ac952b9f597a78d05a6c205d162bcb
- SHA512 97a67e7bae45fb31bf594bfaf884fbbf230b79b71946aa8286f36c642ad2ba7eef8951ddda5db7523690f29cfe7585674c1b52ae772e05f003090da9506ec429
- SSDEEP 98304:yRMgLcrZmg0r0XZyFojPEasbNC70fLomfuMNLzv:yR1L2wuaojHsbNYypfpNLzv
- TLSH T127868D02B7C6C5B4E9AE1770DCBB6365A735BD45977486CB63A03E1EAC313C068743A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-03_01eeff73a6a83d0bc2ce5b42823672f8_elex_glassworm_hijackloader_poet-rat_remcos_stop.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_01eeff73a6a83d0bc2ce5b42823672f8_elex_glassworm_hijackloader_poet-rat_remcos_stop.exe
Resource
win11ltsc2024-20260629-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-03_01eeff73a6a83d0bc2ce5b42823672f8_elex_glassworm_hijackloader_poet-rat_remcos_stop
- Size 7.6MB
- SHA256 95e874571955c7b39e0a2b18dbd9247fc8670f12b798cb6dabb3c7d4055f764c
- MD5 01eeff73a6a83d0bc2ce5b42823672f8
- SHA1 d3c20243b6ac952b9f597a78d05a6c205d162bcb
- SHA512 97a67e7bae45fb31bf594bfaf884fbbf230b79b71946aa8286f36c642ad2ba7eef8951ddda5db7523690f29cfe7585674c1b52ae772e05f003090da9506ec429
- SSDEEP 98304:yRMgLcrZmg0r0XZyFojPEasbNC70fLomfuMNLzv:yR1L2wuaojHsbNYypfpNLzv
- TLSH T127868D02B7C6C5B4E9AE1770DCBB6365A735BD45977486CB63A03E1EAC313C068743A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.