f1c7e83c5d37fadfb5d54f454833da246dd363bcdb56b87be807a4339a2f84b7

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-04_7e31eea7f9f00f28b04fab73ae32ef18_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee
Size 3.2MB
Sample260704-exdnfafs2n
SHA256 f1c7e83c5d37fadfb5d54f454833da246dd363bcdb56b87be807a4339a2f84b7
MD5 7e31eea7f9f00f28b04fab73ae32ef18
SHA1 ec216313594b5a26e4b41437315235f9c5f27586
SHA512 966003d6915183a36cf1f76eb6c4921c60460998f2e646f62e05a298eabd9a152cfbcee565f137b299b91f8a61a34e935a2975cdcc2d456c2b71bd03196b1f19
SSDEEP 49152:l8YhzuzntVxF6b8UzsobQrhRR+mibhv0DmT6I6Dfl:WGzU53gsobQrhj9JIEl
TLSH
T1B7F57C03B7E48513F0F3DE3059B59975563ABD9E5A3582CF728C710E9F72A80DA21B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-07-04_7e31eea7f9f00f28b04fab73ae32ef18_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee
- Size 3.2MB
- SHA256 f1c7e83c5d37fadfb5d54f454833da246dd363bcdb56b87be807a4339a2f84b7
- MD5 7e31eea7f9f00f28b04fab73ae32ef18
- SHA1 ec216313594b5a26e4b41437315235f9c5f27586
- SHA512 966003d6915183a36cf1f76eb6c4921c60460998f2e646f62e05a298eabd9a152cfbcee565f137b299b91f8a61a34e935a2975cdcc2d456c2b71bd03196b1f19
- SSDEEP 49152:l8YhzuzntVxF6b8UzsobQrhRR+mibhv0DmT6I6Dfl:WGzU53gsobQrhj9JIEl
- TLSH
  T1B7F57C03B7E48513F0F3DE3059B59975563ABD9E5A3582CF728C710E9F72A80DA21B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence adware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  .rsrc/1028/HTML/CHANGE_FOLDER.HTML
- Size 3KB
- SHA256 b9e1c109c3330bf9a5e03e433369247e00a894b52211f7b883614aa8cbfde94d
- MD5 5495299efffc88856d2229b775e6c9da
- SHA1 7ae279182033288c897c0906de44069548b0c309
- SHA512 7a92b1ad5fa12c377fd757ca544c5d06ce95fadd433c4623e7da31fc93eccc2770cf38d37668b1f767ee632d0db1abb94b71effcee3d40998ce633a63fb0ecd4
- TLSH
  T18D817706E8E6856184D6D0E6E4A7FD5F7059C406C3494E143DEC15EA8FCAFDC181B8A9
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  .rsrc/1028/HTML/COMPLETE.HTML
- Size 3KB
- SHA256 e114072d621e32802d42e61c60feb119ae78a2df233aac36d46ca807ce982f6e
- MD5 6fb1d7bf010a43e11007846e64547d99
- SHA1 ca810f560febbcf8566d6fbd0ee80731ea07a610
- SHA512 1651c1b734801cec6f48095e454871270ecfff5733ecaffc5cf3452901be98b1671b36ea4ac2998e1b31701957608b88cfb7c3bd3c1264d173a46f131844b50e
- TLSH
  T1C47174096CEDA150C4A5C0B1E5A6FE1F7098C51F838A4E4479EC44F69FC1AE8C85B99C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  .rsrc/1028/HTML/COMPLETENOJAVAS.HTML
- Size 2KB
- SHA256 fe2a37704f647ea597a2b1f06a79fc1171d4092c24a1c07e1da13fc9a2edbbd3
- MD5 f05e591157a6a62aadbacd49740b196f
- SHA1 c8784c8cc9c4882801cb09fd25f87fc5bc97861d
- SHA512 e5d67dec8975b86e25d9d21d10370a9cdc1b9893306851ec81bf1b03fc7f0f21800fe88de547577a649dcfa255de37bc013ecead6553636cb04ac6158ab72e91
- TLSH
  T1EA413109ACEAEA11C0A094F1F1F2FD9FA4C1C216C3865D54B9DD84BB9F89ADDC817614
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  .rsrc/1028/HTML/ERROR.HTML
- Size 2KB
- SHA256 07bf1bc2e33ac02e533f0eb28b33a32ef807e55b499729bba445cffd16dd5093
- MD5 4e6bd6fdff6e7be100858f1c7de547bd
- SHA1 87071a9413ff46a4703e95cbc0ee6070d98dcd6e
- SHA512 0231f356639cb4ae778c3102f5e575de0994e2e1f5dcb21fc9091b779efd4f491e861a92c675c82d66fd3bfd2f6ad5d07cba9973cd2b3422690172f813b6bfcf
- TLSH
  T121514409ACE9A9128460D0E4F9B2ED5F74D5E119C3954E447AFC84BB8FC5ED8CC07664
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral10 behavioral9
- Target
  .rsrc/1028/HTML/FILESINUSESIMPLE.HTML
- Size 2KB
- SHA256 0d442ebf9d28e4131f8de2e40c4337336470989ecad282a3c27f0b5d38a96234
- MD5 7cfe905584ececd9772c8a471895a22b
- SHA1 030899d1cf209212bc762ed1dbfd862d4aa8179e
- SHA512 95d8292a2b8589393e2190b876dd0260c1961ee3701f0074739e6fe1d0a3a7eb97dc88623584c2a25a61b037cb083213dc2e1d6ea20a777e8cfb4367f1b20ff0
- TLSH
  T111414E0AACE9E911C060C4E1F1F2FD9F94C1C216C3865C54B9EC84BB9FCAAD9CC17664
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  .rsrc/1028/HTML/HOST.JS
- Size 1KB
- SHA256 1e67043252582aea0e042f5a7be4a849b7cd01b133a489c3b2e67c10ade086f3
- MD5 a752a4469ac0d91dd2cb1b766ba157de
- SHA1 724ae6b6d6063306cc53b6ad07be6f88eaffbab3
- SHA512 abc2899705a23f15862acf3d407b700bb91c545722c02c7429745ab7f722507285c62614dcb87ea846f88fc0779345cb2e22dc3ad5f8113f6907821505be2c02
- TLSH
  T10A21CBAC1AE8B2809AA375B5882F110E7539C147700E6D507C4CA3D48F2147C61ABD7C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  .rsrc/1028/HTML/JAVASCRUB_COMPLETE.HTML
- Size 2KB
- SHA256 4c6ea363bdca21fb180bb164a588de6a92949d03d642b9e72eebcc9ffb599a60
- MD5 7722977b385e8d49c1a468133f85ce08
- SHA1 5e720426d5fa9b0006d2a48459439b8e33b5c2d6
- SHA512 1bd88191d16c3c4bd47145f0596856a061c6d03c51d6d61694115b42827bbd0cd3311297fc1a3f34d8abaef27e4a5f82e53dae777a36bdac94f3293bc348d2e4
- TLSH
  T17C5162091CEA992180A190FAF9B6EE6FA5C5D217C346CD1036ED54AB8FC1FD8C847554
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  .rsrc/1028/HTML/JAVASCRUB_COMPLETEREMOVE.HTML
- Size 2KB
- SHA256 9434d20c079f80551606d5439414d89fb209e69985bb742a62c24e15e26bd7c6
- MD5 d1106241d3f26389826ca87e7de22ef8
- SHA1 e930a6eeab648219d6f9c74debcbe9033807f626
- SHA512 2e62dd44aafbe8e001c7eb60055d5f2eec8849fb873e803b896c6c9807da93fc57a6de9adbe85af56535876e99d5704b4e53182efaa87bbc3a9f035c20550b3c
- TLSH
  T1345163091CEA9921C0A190FAF9F6EE6FA5C4D217C346CD1036ED54AB8FC1FD8C847654
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral17 behavioral18
- Target
  .rsrc/1028/HTML/JAVASCRUB_DEPLOYCACHE.HTML
- Size 2KB
- SHA256 2e60bcf5314076003535b6a7764e58a5070875351ef2827dfc3ffb6371f45169
- MD5 7d03f2f2f0cb1196116b9fb04475fe3e
- SHA1 4c8a8a6d5aa8229cc69b7dcb68e73d57aa12d9b8
- SHA512 3e9832f42016cb4b4fe1b58b15be809582b3fa303d0bef3a4d8297bacadc3054ab80668a1fff8695410ebc617f674f8cc5a3dd1880c0513c293a269f9f07c906
- TLSH
  T1B8515F096CE99A118060D4E0F1B2FD9FA091C32AC3CB5C1079DD80AB8F85EE98C47698
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral19 behavioral20
- Target
  .rsrc/1028/HTML/JAVASCRUB_DRS.HTML
- Size 2KB
- SHA256 49b38a040cf0b50bdc9b0e2a3db7447943c76158a95ff272cc1cb624e7c9445e
- MD5 801f86e1bac1d0e5bd416572eaf3e684
- SHA1 e5eb0cb6d09085e67d902f6983955f3985ff8276
- SHA512 5ba2dbcc7e4ddc66faf8cf8f10ea38d0f93dcb1ecc0409ec6661ceeec0ca9548dd0a20feab3a79c284701b1cc36b5c30f9a677f9d1b92acc30471d9c3cb0b16b
- TLSH
  T17451400A6CE6A921C16094E5F5B2FDAFA5C0C217C3869C0079EC94AFCFC5FD9C817644
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  .rsrc/1028/HTML/JAVASCRUB_DRSREMOVE.HTML
- Size 2KB
- SHA256 49b38a040cf0b50bdc9b0e2a3db7447943c76158a95ff272cc1cb624e7c9445e
- MD5 801f86e1bac1d0e5bd416572eaf3e684
- SHA1 e5eb0cb6d09085e67d902f6983955f3985ff8276
- SHA512 5ba2dbcc7e4ddc66faf8cf8f10ea38d0f93dcb1ecc0409ec6661ceeec0ca9548dd0a20feab3a79c284701b1cc36b5c30f9a677f9d1b92acc30471d9c3cb0b16b
- TLSH
  T17451400A6CE6A921C16094E5F5B2FDAFA5C0C217C3869C0079EC94AFCFC5FD9C817644
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral23 behavioral24
- Target
  .rsrc/1028/HTML/JAVASCRUB_PROGRESS.HTML
- Size 3KB
- SHA256 b3819c84352df320b70f9e3c394ba7e7c2010a3b43a8a886b0a0cd24d3fbcb1c
- MD5 5065e4484c2b85916f8b452e8e7d96e7
- SHA1 c91c76afd488686c7791a9e3e03d2dab6052f310
- SHA512 78a4580867f93f9e7df1648fafca616f4ccd9b2c277133114bf26a19640b131dbd01c85fdf2937407421e909cfb8959f4d6938df25c38dbb61a2f8771a430119
- TLSH
  T1A371740A9DE5DE50C860D0E1F9E7EE4AADC091068346CE50BDEC54AB8FC69C988137DD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral25 behavioral26
- Target
  .rsrc/1028/HTML/JAVASCRUB_VERSIONS.HTML
- Size 4KB
- SHA256 3e4c08dfbe34c7eaa87786b974fde941efd7a7cfc397840640bb8287cf48f790
- MD5 8ab482b7009ee7c71da01da780d40bd0
- SHA1 5d82ded2325da68364686d0a9d523ccfbbbb92c7
- SHA512 157180ee2cf0af82d41e47416293a34686f92cae99b5a425bf02345d4b2f01974618d450e991ef8a7240fe2dd1ae0b63a5028221ad07f0350221e89ce911806d
- SSDEEP 96:1AEoKZq94MYXNqGI7V7/slKVZEfsRagKKwpJ7:SEoKZq6MY9qzhaKVZKMw/
- TLSH
  T1149185062CE6491194714099F6B6BD6EB4E0C217C346DC10BAEC95AA8FC0EDC846B74C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral27 behavioral28
- Target
  .rsrc/1028/HTML/JDKWELCOME.HTML
- Size 3KB
- SHA256 5abcf48412ed3dca2a0ddce01365c0eed2406e9d40ed9a9cb7e7018a14a9555f
- MD5 87fef3f01d6d0c139ce70dd5ab7119d5
- SHA1 4cbd95f6ed034643f608e57bcc456ec08dc13ece
- SHA512 4737e6cfeae37848c7830a1629ab605c8e353cf6736a0ec635010d39a88eed3c7ca457442f28e9dcc37b66b7247522ea0236782028ab47d04d73be788f0b2bfb
- TLSH
  T10A6196099CF9E55184A0C0E1F4F2ED8FB290D21BC3858D00B5EC84A78FD6AD9CC47668
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral29 behavioral30
- Target
  .rsrc/1028/HTML/JDKWELCOMEMOS.HTML
- Size 2KB
- SHA256 ba4cd7c8fdacb614a80f71b5bb06624d3c58429b95bf0c569dd5631c64c6c353
- MD5 2e161b886befe69b4623799cf227d1a4
- SHA1 d76062bbe1f37f0e6851b45e4339dc334cfa2b2c
- SHA512 4ce2233fac252eca7fc418cb7025f19b10196a45a131e6aba07a8af83409150aae575bc36f0807697e6e15eba31323053cc5a7394b10c1fe1530786e3a3ce96e
- TLSH
  T18051520DACE5E922C4A191E1F5F2EC9F6581D217C3864D40B5ED84E78FC2AEDCC8B658
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral31 behavioral32