0ae0744de0dfa99967438fe04552d066ea1ef6294f2928ec230a191b120ccd7c

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-04_6e4c736d2e1100b3640afafce3683d24_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee
Size 842KB
Sample260704-w7pbcsby6s
SHA256 0ae0744de0dfa99967438fe04552d066ea1ef6294f2928ec230a191b120ccd7c
MD5 6e4c736d2e1100b3640afafce3683d24
SHA1 919aece9be678875fac264c9bb2c24d1c4bad90b
SHA512 b8617db72b2c9d005303f0ca9543b22ff71741634fea2524433747b1da1991b61226e13435a542c1185780e26bdfac20623a386f525fc9f514b5e2b4163da8e1
SSDEEP 12288:/wKfOVRo9yRY9gEH0qUjD5yTx5KEZrE3KD:/xWVeyRY9HyKD
TLSH
T1BC055B06B6D4D031D5A356344EBBC3E45B25BC136F348B8B7A8C774EBF31691992232A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-07-04_6e4c736d2e1100b3640afafce3683d24_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee
- Size 842KB
- SHA256 0ae0744de0dfa99967438fe04552d066ea1ef6294f2928ec230a191b120ccd7c
- MD5 6e4c736d2e1100b3640afafce3683d24
- SHA1 919aece9be678875fac264c9bb2c24d1c4bad90b
- SHA512 b8617db72b2c9d005303f0ca9543b22ff71741634fea2524433747b1da1991b61226e13435a542c1185780e26bdfac20623a386f525fc9f514b5e2b4163da8e1
- SSDEEP 12288:/wKfOVRo9yRY9gEH0qUjD5yTx5KEZrE3KD:/xWVeyRY9HyKD
- TLSH
  T1BC055B06B6D4D031D5A356344EBBC3E45B25BC136F348B8B7A8C774EBF31691992232A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  .rsrc/1033/HTML/AULICENSECHANGE.HTML
- Size 2KB
- SHA256 cded4eb1ba52eac01ab6ac71e658e8673b1622396ad71079bd897cb8c3226f02
- MD5 f99657ea33f67face5470ff4a5771007
- SHA1 2e960cb9b8a62af44a11354820a2d5be64c1e49c
- SHA512 2b0b590c66dc140d58e310a927bd5a33b7bff688b61ba0323224b5c2a0c74dd1e732586d65d9d4e766c54c54a5392c4db1ce3c588a9344414cf550633bda1a0d
- TLSH
  T10941310DACE9D9128150D0E1F4F2FD9FA081D21AC38A5D54B5EC44AB9FC6BDDCC17654
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  .rsrc/1033/HTML/AUWELCOME.HTML
- Size 3KB
- SHA256 f264387739979a9e8683682ced5b539211b051f3d8d6b3b5fa6912efbb8591a4
- MD5 b7cda1f5ab4cd32381f522d8680897f9
- SHA1 e20623be30c92f0c483520c589fa9d617d7a0fea
- SHA512 e71fe1d527d9306322db91ac600d83c59e9e8fedefb9a43d474c31bf5eb11ab440d8e47f74af0aa416f35311144fb9412af2be91140af962576da6c39dcf9918
- TLSH
  T17C815529A8FAD43184D5CA95F6BAEE0F7041E21AC3849D047AFC40A74FD5FDDC8476A8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  .rsrc/1033/HTML/HOST.JS
- Size 1KB
- SHA256 1e67043252582aea0e042f5a7be4a849b7cd01b133a489c3b2e67c10ade086f3
- MD5 a752a4469ac0d91dd2cb1b766ba157de
- SHA1 724ae6b6d6063306cc53b6ad07be6f88eaffbab3
- SHA512 abc2899705a23f15862acf3d407b700bb91c545722c02c7429745ab7f722507285c62614dcb87ea846f88fc0779345cb2e22dc3ad5f8113f6907821505be2c02
- TLSH
  T10A21CBAC1AE8B2809AA375B5882F110E7539C147700E6D507C4CA3D48F2147C61ABD7C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  .rsrc/1033/HTML/L10N.JS
- Size 4KB
- SHA256 85bbec802e8624e7081abeae4f30bd98d9a9df6574bd01fe5251047e8fdaf59f
- MD5 1fd5111b757493a27e697d57b351bb56
- SHA1 9ca81a74fa5c960f4e8b3ad8a0e1ec9f55237711
- SHA512 80f532e4671d685fa8360ef47a09efcb3342bcfcf929170275465f9800bfbfffc35728a1ba496d4c04a1fdefb2776af02262c3774f83fea289585a5296d560b0
- SSDEEP 96:4t/V3qoC44l4idyrsftEHNa2AmgERLJvQJqi3qKeVvEEik6mYh34HvTviDGQP:gCbl4idyrsftPBEnvPsqzdEEik6PhGv4
- TLSH
  T13DA1511C26E924727B8730798DDF6008717685472819DC217C8D9398EFA1638A6ADFFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  .rsrc/1033/HTML/LAYOUT.JS
- Size 2KB
- SHA256 fab91ced243da62ec1d938503fa989462374df470be38707fbf59f73715af058
- MD5 cc86b13a186fa96dfc6480a8024d2275
- SHA1 d892a7f06dc12a0f2996cc094e0730fe14caf51a
- SHA512 0e3e4c9755aa8377e00fc9998faab0cd839dfa9f88ce4f4a46d8b5aaf7a33e59e26dbf55e9e7d1f8ef325d43302c68c44216adb565913d30818c159a182120fc
- TLSH
  T11141EA6E74D999B12EAF313A9A1F601C743250035008EC82BC0DE2C08F71D7112D7AFD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  .rsrc/1033/HTML/RTUTILS.JS
- Size 244B
- SHA256 7da9aa32aa10b69f34b9d3602a3b8a15eb7c03957512714392f12458726ac5f1
- MD5 c0a4cebb2c15be8262bf11de37606e07
- SHA1 cafc2ccb797df31eecd3ae7abd396567de8e736d
- SHA512 cc68f4bc22601430a77258c1d7e18d6366b6bf8f707d31933698b2008092ba5348c33fa8b03e18c4c707abf20ce3cbcb755226dc6489d2b19833809c98a11c74
- TLSH
  T154D097BFA2F5F9220A9DB3336126CC4CFA2E2082342520436D88C0D8FC238A09005C20
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  .rsrc/1033/HTML/RUNTIME.JS
- Size 42KB
- SHA256 93a647b1f2cadcbdb0fe9c46b82b2b4baf7685167de05933811549145c584ee0
- MD5 5d4657b90d2e41960ebe061c1fd494b8
- SHA1 71eca85088ccbd042cb861c98bccb4c7dec9d09d
- SHA512 237738c0a6cb25efe29effc9c3637245e3e2397207ed51e67bae5a1b54749f88e090de524f7868d964debbb29a920a68205ccbd2dfceed4a1f3cd72d08b16fa3
- SSDEEP 768:RZuji9eRoULoh8QDOsuAQo+6K2cZLh4QTMtr7N:2nbBQDruAQo+6i4QG
- TLSH
  T1A61360586DF670529A17F2B8495FA109F2B4D497910D8940BC8CB3E06FA147843BEFED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16