2026-07-09_5e30ff382bcef8c07b83fbcaa0820a8e_elex_floxif_glassworm_mafia_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_5e30ff382bcef8c07b83fbcaa0820a8e_elex_floxif_glassworm_mafia_remcos
Size 649KB
Sample260709-a2yf7aa16j
SHA256 a236a54c0504a932e65b56815ff00fd74004515d602308933dd6b25e50f4832a
MD5 5e30ff382bcef8c07b83fbcaa0820a8e
SHA1 f6d69d5327a87cdc47191d810afa11f715968753
SHA512 401d3c0936ef7232054476fd329dea3bce2bdceb563761e167ea33823df4c9432edae5fe49b55efc65eac05c3f69566b05dfc151fb1a7f1b9246a6d8ea786fac
SSDEEP 12288:iRuWNLKQhJ52nUDm81+Te/9n8Tf6ThTskMW7CzWwlKKbVg/CtlQIBjvrEH7q5:ZWNBhJ5Bn+AngiFTpMWTKbVg/Ctl3rE0
TLSH
T1A3E4AD297AF0C2B2C02381346D5ED358A5F5E476482A4483BBDD276D2F742D39B38B97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-09_5e30ff382bcef8c07b83fbcaa0820a8e_elex_floxif_glassworm_mafia_remcos

File Explorer

2026-07-09_5e30ff382bcef8c07b83fbcaa0820a8e_elex_floxif_glassworm_mafia_remcos

.exe 649KB

2026-07-09_5e30ff382bcef8c07b83fbcaa0820a8e_elex_floxif_glassworm_mafia_remcos

IMPHASH 0a9151365f013938ba6803e8d60d8034
SHA256 a236a54c0504a932e65b56815ff00fd74004515d602308933dd6b25e50f4832a
MD5 5e30ff382bcef8c07b83fbcaa0820a8e
SHA1 f6d69d5327a87cdc47191d810afa11f715968753
SHA512 401d3c0936ef7232054476fd329dea3bce2bdceb563761e167ea33823df4c9432edae5fe49b55efc65eac05c3f69566b05dfc151fb1a7f1b9246a6d8ea786fac
SSDEEP 12288:iRuWNLKQhJ52nUDm81+Te/9n8Tf6ThTskMW7CzWwlKKbVg/CtlQIBjvrEH7q5:ZWNBhJ5Bn+AngiFTpMWTKbVg/Ctl3rE0
TLSH
T1A3E4AD297AF0C2B2C02381346D5ED358A5F5E476482A4483BBDD276D2F742D39B38B97
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

b0:88:82:04:d4:f1:24:08:5f:e4:68:b6:bd:fe:4e:1b:0f:18:6c:f4

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Oracle America\, Inc.,OU=Code Signing Bureau,O=Oracle America\, Inc.,L=Redwood Shores,ST=California,C=US

Chains

Dec 13, 2016

CN=Oracle America\, Inc.,OU=Code Signing Bureau,O=Oracle America\, Inc.,L=Redwood Shores,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Oracle America\, Inc.,OU=Code Signing Bureau,O=Oracle America\, Inc.,L=Redwood Shores,ST=California,C=US

Serial Number

12:f0:27:7e:0f:23:3b:39:f9:41:9b:06:e8:cd:e3:52

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 14, 2015 - Apr 13, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

Major OS version

Entry point

235043

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

IIDFromString StringFromGUID2 CLSIDFromString CoTaskMemAlloc CoTaskMemFree CoInitialize CoTaskMemRealloc CoUninitialize CoCreateInstance

shell32

Shell_NotifyIconA SHGetFolderPathW ShellExecuteA

wininet

InternetTimeToSystemTime InternetCrackUrlA InternetTimeFromSystemTime InternetCloseHandle HttpQueryInfoA InternetReadFile HttpOpenRequestA InternetErrorDlg HttpSendRequestA InternetOpenA InternetConnectA

user32

GetDesktopWindow CharNextA wsprintfA DispatchMessageW RegisterClassA LoadImageA GetSystemMetrics DispatchMessageA PostMessageA AppendMenuA CreatePopupMenu ShowWindow MsgWaitForMultipleObjectsEx GetCursorPos DefWindowProcA IsWindowUnicode PeekMessageA CreateWindowExA GetWindowLongA MessageBoxA DestroyWindow GetMessageA GetMessageW PostQuitMessage TrackPopupMenu SetForegroundWindow LoadStringA TranslateMessage SetWindowLongA

version

GetFileVersionInfoA VerQueryValueW GetFileVersionInfoSizeA

kernel32

LCMapStringW RtlUnwind HeapReAlloc SetStdHandle FindFirstFileExW GetDriveTypeW FileTimeToLocalFileTime GetFullPathNameW CreateDirectoryW GetConsoleMode GetConsoleCP GetFileType GetStartupInfoW HeapSetInformation GetSystemTimeAsFileTime VirtualQuery GetSystemInfo GetModuleHandleW VirtualAlloc VirtualProtect HeapAlloc HeapFree DecodePointer EncodePointer GetStringTypeW InterlockedExchange GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetTimeZoneInformation HeapCreate FindResourceA lstrcmpA lstrlenA FreeLibrary LoadResource SystemTimeToTzSpecificLocalTime InterlockedIncrement InterlockedDecrement WaitForSingleObject GetCommandLineA WideCharToMultiByte InitializeCriticalSectionAndSpinCount SizeofResource CreateEventA SetDllDirectoryA IsDBCSLeadByte lstrcatA MultiByteToWideChar lstrlenW RaiseException GetLastError lstrcmpiA GetProcAddress WaitForMultipleObjects GetModuleFileNameA LoadLibraryExA CreateMutexA DeleteCriticalSection CloseHandle SetEvent ResetEvent CreateThread lstrcpyA lstrcpynA CreateFileA WriteFile Sleep ReadFile OpenEventA GetCurrentProcess GetTickCount GetVersionExA GetCurrentProcessId GetTempPathA LocalFree DeleteFileA FileTimeToSystemTime FormatMessageW GetLocalTime GetCurrentThreadId PeekNamedPipe SetHandleInformation GetExitCodeProcess CreateProcessA TerminateProcess CreatePipe ExitProcess GetLocaleInfoA GetSystemDirectoryA FindClose LoadLibraryA LockResource GetNativeSystemInfo GetSystemDefaultUILanguage GetThreadLocale GetUserDefaultUILanguage GetFileAttributesA GetStdHandle LoadLibraryExW GetModuleHandleExA GetModuleHandleExW LoadLibraryW CreateFileW SetFilePointerEx InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetModuleFileNameW HeapSize TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetLocaleInfoW SetHandleCount SetFilePointer FlushFileBuffers GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter SetEndOfFile GetProcessHeap WriteConsoleW GetCurrentDirectoryW GetFileInformationByHandle GetUserDefaultLCID EnumSystemLocalesA IsValidLocale CompareStringW SetEnvironmentVariableA GetModuleHandleA

advapi32

RegSetValueExA ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumKeyA CryptHashData CryptDestroyHash CryptCreateHash CryptAcquireContextA CryptReleaseContext RegQueryValueExA CryptGetHashParam SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegNotifyChangeKeyValue RegDeleteValueA RegOpenKeyExA RegCreateKeyExA RegEnumKeyExA RegDeleteKeyA RegQueryInfoKeyW

oleaut32

VarUI4FromStr

gdi32

GetStockObject

crypt32

CryptStringToBinaryA CryptUnprotectData CryptProtectData CryptBinaryToStringA

msi

ord189 ord91 ord117 ord141 ord168 ord67 ord160 ord158 ord115 ord159 ord8 ord44 ord31 ord204 ord137

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_5e30ff382bcef8c07b83fbcaa0820a8e_elex_floxif_glassworm_mafia_remcos

PE Signature issue

ole32

shell32

wininet

user32

version

kernel32

advapi32

oleaut32

gdi32

crypt32

msi

generic