2026-07-16_760e40da5917b7ac4fba1f5860a47238_elex_glassworm_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-16_760e40da5917b7ac4fba1f5860a47238_elex_glassworm_stop
Size 11.0MB
Sample260716-2cerbsfs7j
SHA256 932b5844ad3cb880fc329a7f5a001399d541737a0759d820712b91c264127d94
MD5 760e40da5917b7ac4fba1f5860a47238
SHA1 d4fb0ad59e72de14569d8d47b862e874c5b03e7c
SHA512 ea9a77662b2d5086ee4cd541bf03f57b533f1bbcfb15f7b25510f5173277f3e9115ab96b07967a2747a179d26aaeda5f3c937db7b9db3739b74a59ca5947c9d7
SSDEEP 196608:uHqh8WyH9z6xXS2jnq2x3qoT76al5UKwguH9AnuiPxRDEQQJKVshwt:iHF6BjnqU3iG5V7VSxhwt
TLSH
T11EC633033DF0E03AD07736B0379BC77D95E3F6A01825AA4B63E14A1D6F386629729761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-16_760e40da5917b7ac4fba1f5860a47238_elex_glassworm_stop

.exe 11.0MB

2026-07-16_760e40da5917b7ac4fba1f5860a47238_elex_glassworm_stop

IMPHASH b1a586c098f67922fdf0073aa1b447f9
SHA256 932b5844ad3cb880fc329a7f5a001399d541737a0759d820712b91c264127d94
MD5 760e40da5917b7ac4fba1f5860a47238
SHA1 d4fb0ad59e72de14569d8d47b862e874c5b03e7c
SHA512 ea9a77662b2d5086ee4cd541bf03f57b533f1bbcfb15f7b25510f5173277f3e9115ab96b07967a2747a179d26aaeda5f3c937db7b9db3739b74a59ca5947c9d7
SSDEEP 196608:uHqh8WyH9z6xXS2jnq2x3qoT76al5UKwguH9AnuiPxRDEQQJKVshwt:iHF6BjnqU3iG5V7VSxhwt
TLSH
T11EC633033DF0E03AD07736B0379BC77D95E3F6A01825AA4B63E14A1D6F386629729761
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

2b:83:a0:db:0e:c1:13:09:f2:24:a8:4d:72:cd:4f:34:15:79:42:fe:68:ff:c0:fc:c2:47:5d:3f:94:7c:b4:0e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=683-88-02252,CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Jun 9, 2026

SERIALNUMBER=683-88-02252,CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=683-88-02252,CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

c4:7a:50:c5:49:65:2c:15:80:94:a2:7b:a8:5d:f1:b7:44:c3:22:d7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=683-88-02252,CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Jun 9, 2026

SERIALNUMBER=683-88-02252,CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=683-88-02252,CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

SERIALNUMBER=683-88-02252,CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Serial Number

2b:6b:ea:ca:b9:c9:55:77:6c:52:c4:bb:e1:61:9f:3f

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 18, 2026 - Mar 18, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

314290

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\devel\inst\bin.2008\xstub.pdb

kernel32

GetUserDefaultLCID InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection lstrlenA WideCharToMultiByte InterlockedIncrement InterlockedDecrement lstrcmpiW RaiseException MultiByteToWideChar SetErrorMode FlushInstructionCache SetCurrentDirectoryW MulDiv CopyFileW GetCurrentThreadId SetLastError CreateMutexW WritePrivateProfileStringW MoveFileW GetUserDefaultUILanguage GetVersion GetCurrentThread GlobalAlloc CreateThread SetUnhandledExceptionFilter GetCurrentProcessId InterlockedExchange GetSystemInfo ReadFile SetFilePointer SetFilePointerEx SetFileTime WriteFile GetConsoleMode GetConsoleCP RtlUnwind GetDateFormatA GetTimeFormatA GetModuleFileNameA GetStdHandle LCMapStringW GetEnvironmentStringsW FreeEnvironmentStringsW LoadLibraryExW IsValidCodePage GetOEMCP GetACP GetCPInfo HeapCreate TlsFree TlsSetValue TlsAlloc TlsGetValue GetStartupInfoW SetConsoleCtrlHandler IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime ExitThread VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW SetHandleCount GetFileType GetStartupInfoA GetCommandLineW QueryPerformanceCounter InitializeCriticalSectionAndSpinCount LCMapStringA CompareStringW SetEnvironmentVariableA SetEnvironmentVariableW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle FlushFileBuffers GetLocaleInfoW GetModuleHandleA SetEndOfFile CreateFileA CompareStringA Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalMemoryStatusEx GetFileSizeEx CreateFileW GetFileSize GetWindowsDirectoryW GetTempFileNameW GetTempPathW RemoveDirectoryW FindClose FindNextFileW SetFileAttributesW DeleteFileW FindFirstFileW GetLocaleInfoA GetExitCodeProcess CreateProcessW GetCurrentProcess GetProcAddress GetModuleHandleW lstrcpyW GetLastError GetFileAttributesW GetModuleFileNameW GlobalFree CreateDirectoryW GetSystemDirectoryW FreeLibrary LoadLibraryW lstrlenW ExitProcess FindResourceExW FindResourceW LoadResource LockResource SizeofResource TerminateThread GetTickCount Sleep CloseHandle GetExitCodeThread GetTimeZoneInformation WaitForSingleObject

user32

ReleaseCapture SetCapture TrackPopupMenuEx TrackMouseEvent UpdateWindow UnionRect SetWindowRgn GetPropW RegisterClassW RemovePropW SetPropW GetDesktopWindow GetWindowPlacement ClientToScreen InflateRect InvalidateRect PtInRect SetRect IsWindowEnabled SetScrollRange ScreenToClient SetScrollPos EnableWindow IsWindowVisible EndPaint BeginPaint DestroyWindow SetCursor SetRectEmpty DrawTextW GetSysColor ReleaseDC GetDC GetDlgItem GetFocus GetWindowTextLengthW GetWindowTextW SubtractRect IsRectEmpty IntersectRect AdjustWindowRectEx SetScrollInfo RegisterWindowMessageW SetTimer GetCursorPos AppendMenuW CreatePopupMenu SendMessageTimeoutW GetKeyState ShowWindow CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW KillTimer GetSystemMenu EnableMenuItem GetWindow MonitorFromWindow SetWindowPos SetWindowTextW LoadIconW PostQuitMessage PostMessageW CallWindowProcW DefWindowProcW GetWindowLongW SetWindowLongW MapWindowPoints GetClientRect TranslateAcceleratorW IsDialogMessageW GetNextDlgTabItem GetMessageW LoadAcceleratorsW CharNextW SetFocus GetParent MoveWindow EqualRect GetWindowRect OffsetRect MonitorFromPoint CopyRect GetSystemMetrics SystemParametersInfoW GetMonitorInfoW MonitorFromRect IsCharAlphaW SendMessageW FindWindowW MessageBoxW IsWindow DispatchMessageW TranslateMessage PeekMessageW GetWindowDC UnregisterClassA

gdi32

MoveToEx LineTo CreateRectRgn ExtTextOutW OffsetRgn CreateSolidBrush GetDeviceCaps SetBkColor ExcludeClipRect GetTextMetricsW SetBkMode GetStockObject SetWindowOrgEx CreateCompatibleBitmap SetTextColor CreateFontW BitBlt DeleteDC SelectObject CreateCompatibleDC CreateDIBSection DeleteObject GetObjectW

advapi32

EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken OpenThreadToken RegDeleteValueW RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyW RegCloseKey RegQueryValueExW RegOpenKeyExW FreeSid

shell32

SHGetPathFromIDListW ShellExecuteW SHBrowseForFolderW ord190 ord155 SHAppBarMessage ShellExecuteExW SHGetFolderPathW

ole32

CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoUninitialize

oleaut32

SysFreeString VariantInit SysAllocString VarUI4FromStr VariantClear

shlwapi

PathCanonicalizeW PathIsDirectoryW ord176

wininet

InternetReadFile InternetQueryDataAvailable InternetQueryOptionW HttpOpenRequestA HttpEndRequestW InternetWriteFile HttpSendRequestExW HttpSendRequestW InternetErrorDlg HttpQueryInfoW HttpAddRequestHeadersW InternetConnectA InternetSetOptionW InternetOpenW InternetCrackUrlA InternetCloseHandle

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-16_760e40da5917b7ac4fba1f5860a47238_elex_glassworm_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

generic