2026-07-17_2f747566a8e0f3134cd991b5bc4e31eb_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos

General

Target
2026-07-17_2f747566a8e0f3134cd991b5bc4e31eb_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos
Size 5.0MB
Sample260717-vs799act5w
SHA256 dd3fb41c2a0f47867b96ee5f3ccdf694777644ab70d799e47d9274cf28662284
MD5 2f747566a8e0f3134cd991b5bc4e31eb
SHA1 7e481007074fce68b7b5a8d33790f7010fdd4799
SHA512 a13c9789510054d73210a07591e3ed9c2ef1b704d362b9dfec979ac555695e1a9212327b85d608a5bfe3c554a4b19d7f392f4b50e4ca24fd9704c807015bcdd6
SSDEEP 98304:RPACog/64fmj0HEpCVO5Ct0V60pgqsnfPkjWYCr1ZkYBAbFTRUVnDaa1vO:pLo14+jLMUgjn3kj7eBAbbUVDaa1vO
TLSH
T1E836D020B601C03FE9E301F189BE42BE59ACAA31176424D7A3CC1E5E5BB49D27E36D57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-17_2f747566a8e0f3134cd991b5bc4e31eb_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos

File Explorer

2026-07-17_2f747566a8e0f3134cd991b5bc4e31eb_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos

.exe 5.0MB

2026-07-17_2f747566a8e0f3134cd991b5bc4e31eb_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos

IMPHASH 7c1ef9b94f6f6c2d04d749ec2de1571c
SHA256 dd3fb41c2a0f47867b96ee5f3ccdf694777644ab70d799e47d9274cf28662284
MD5 2f747566a8e0f3134cd991b5bc4e31eb
SHA1 7e481007074fce68b7b5a8d33790f7010fdd4799
SHA512 a13c9789510054d73210a07591e3ed9c2ef1b704d362b9dfec979ac555695e1a9212327b85d608a5bfe3c554a4b19d7f392f4b50e4ca24fd9704c807015bcdd6
SSDEEP 98304:RPACog/64fmj0HEpCVO5Ct0V60pgqsnfPkjWYCr1ZkYBAbFTRUVnDaa1vO:pLo14+jLMUgjn3kj7eBAbbUVDaa1vO
TLSH
T1E836D020B601C03FE9E301F189BE42BE59ACAA31176424D7A3CC1E5E5BB49D27E36D57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

1622219

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

crypt32

CertCreateCertificateContext CertFreeCertificateContext CertAddCertificateContextToStore CertCloseStore CertFindCertificateInStore CertOpenStore

winhttp

WinHttpGetIEProxyConfigForCurrentUser

iphlpapi

GetAdaptersInfo

kernel32

QueryDepthSList UnregisterWaitEx AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile InterlockedCompareExchange GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId GetVersionExW UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA DeleteFileW HeapReAlloc CloseHandle GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress CreateFileMappingA LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers InterlockedExchange InterlockedDecrement PostQueuedCompletionStatus TlsAlloc InterlockedExchangeAdd InterlockedIncrement TlsFree QueryDosDeviceW FindFirstFileW FindNextFileW FindClose OpenProcess GetVersion GetCurrentProcess CreateDirectoryW RemoveDirectoryW GetModuleFileNameW GetSystemDirectoryW GetWindowsDirectoryW MoveFileExW CancelIo InitializeCriticalSectionAndSpinCount GetModuleHandleA TlsGetValue CreateIoCompletionPort SetWaitableTimer TlsSetValue SetLastError WaitForMultipleObjects GetQueuedCompletionStatus CreateToolhelp32Snapshot TerminateThread QueueUserAPC VerSetConditionMask GetComputerNameW CopyFileW VerifyVersionInfoW SizeofResource FreeResource LockResource LoadResource FindResourceW GetProcessId SetFileAttributesW Process32NextW Process32FirstW SetProcessShutdownParameters ExitProcess SetThreadExecutionState TerminateProcess DuplicateHandle GetCurrentThread CreateProcessW GetModuleHandleW VerifyVersionInfoA SleepEx GetSystemDirectoryA ExpandEnvironmentStringsA RaiseException VirtualProtect VirtualQuery LoadLibraryExA UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent SetEvent ResetEvent CreateEventW IsDebuggerPresent GetStartupInfoW InitializeSListHead GetStringTypeW GetExitCodeThread GetNativeSystemInfo QueryPerformanceFrequency EncodePointer DecodePointer RtlCaptureStackBackTrace QueueUserWorkItem GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW GetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW GetDiskFreeSpaceExW GetFileInformationByHandle GetFileTime SetFilePointerEx SetFileTime DeviceIoControl CreateDirectoryExW InterlockedPushEntrySList InterlockedFlushSList LoadLibraryExW RtlUnwind CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetModuleHandleExW SetConsoleCtrlHandler GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameA GetStdHandle GetACP GetConsoleMode ReadConsoleW GetConsoleCP GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation SetStdHandle FindFirstFileExA FindFirstFileExW FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW WriteConsoleW CreateTimerQueue SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes VirtualAlloc VirtualFree SetProcessAffinityMask ReleaseSemaphore InterlockedPopEntrySList WaitForMultipleObjectsEx

generic

count=23, id=241, version=40116,

count=177, id=243, version=40116,

count=31, id=242, version=40116,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=6, id=261, productName=VS2015 UPD2 build 23918, version=23918,

count=6, id=199, version=41118,

count=27, id=259, version=24123,

count=38, id=260, version=24123,

count=32, id=260, productName=VS2015 [14.0] build 23026, version=23026,

count=6, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=130, id=261, version=24123,

count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=391, id=1, productName=Unmarked objects,

count=109, id=264, version=24213,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3 build 24213, version=24213,

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-17_2f747566a8e0f3134cd991b5bc4e31eb_elex_glassworm_luca-stealer_magniber_mespinoza_njrat_remcos

crypt32

winhttp

iphlpapi

kernel32

generic