2026-07-22_f5737ec0346e4ac813dfc6a3c237acdb_elex_glassworm_mafia_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_f5737ec0346e4ac813dfc6a3c237acdb_elex_glassworm_mafia_remcos
Size 1.1MB
Sample260722-t9cdgadj61
SHA256 1b8a405b31d9704ee6b48eef398a6feca451eaed367c4170310735896a7020e7
MD5 f5737ec0346e4ac813dfc6a3c237acdb
SHA1 6d2be768e1e9beef35a9642757a12415f796e3ca
SHA512 4bd917bd3aa422aa211e5f83fa278dd318fb052bc993357d071cce56bc0b561f38b46fb268fec3f36c359158f147959b8597344653730189eeeba2d1cca4f44e
SSDEEP 24576:Td8doNyUyDx1Xv5dFsPMTBvXpDV7rU6UXLFxZLcvDaktGy2CcYaqOCDUd:xNyUyDXXvTOPMTBXQ6ELLdcvDXtd2CcN
TLSH
T13D45F1297AF0D032D12342718D6AE31861B9F87288264487FBDD676D2F701D3DB39B96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_f5737ec0346e4ac813dfc6a3c237acdb_elex_glassworm_mafia_remcos

File Explorer

2026-07-22_f5737ec0346e4ac813dfc6a3c237acdb_elex_glassworm_mafia_remcos

.exe 1.1MB

2026-07-22_f5737ec0346e4ac813dfc6a3c237acdb_elex_glassworm_mafia_remcos

IMPHASH 4af2fc2a29e04f27edd3cf1ed4873614
SHA256 1b8a405b31d9704ee6b48eef398a6feca451eaed367c4170310735896a7020e7
MD5 f5737ec0346e4ac813dfc6a3c237acdb
SHA1 6d2be768e1e9beef35a9642757a12415f796e3ca
SHA512 4bd917bd3aa422aa211e5f83fa278dd318fb052bc993357d071cce56bc0b561f38b46fb268fec3f36c359158f147959b8597344653730189eeeba2d1cca4f44e
SSDEEP 24576:Td8doNyUyDx1Xv5dFsPMTBvXpDV7rU6UXLFxZLcvDaktGy2CcYaqOCDUd:xNyUyDXXvTOPMTBXQ6ELLdcvDXtd2CcN
TLSH
T13D45F1297AF0D032D12342718D6AE31861B9F87288264487FBDD676D2F701D3DB39B96
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

235795

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

IIDFromString StringFromGUID2 CLSIDFromString CoTaskMemAlloc CoTaskMemFree CoInitialize CoTaskMemRealloc CoUninitialize CoCreateInstance

shell32

Shell_NotifyIconA SHGetFolderPathW ShellExecuteA

wininet

InternetTimeToSystemTime InternetCrackUrlA InternetTimeFromSystemTime InternetCloseHandle HttpQueryInfoA InternetReadFile HttpOpenRequestA InternetErrorDlg HttpSendRequestA InternetOpenA InternetConnectA

user32

GetDesktopWindow CharNextA wsprintfA DispatchMessageW RegisterClassA LoadImageA GetSystemMetrics DispatchMessageA PostMessageA AppendMenuA CreatePopupMenu ShowWindow MsgWaitForMultipleObjectsEx GetCursorPos DefWindowProcA IsWindowUnicode PeekMessageA CreateWindowExA GetWindowLongA MessageBoxA DestroyWindow GetMessageA GetMessageW PostQuitMessage TrackPopupMenu SetForegroundWindow LoadStringA TranslateMessage SetWindowLongA

version

GetFileVersionInfoA VerQueryValueW GetFileVersionInfoSizeA

kernel32

RtlUnwind HeapReAlloc SetStdHandle FindFirstFileExW GetDriveTypeW FileTimeToLocalFileTime GetFullPathNameW CreateDirectoryW GetConsoleMode GetConsoleCP GetFileType GetStartupInfoW HeapSetInformation GetSystemTimeAsFileTime VirtualQuery GetSystemInfo GetModuleHandleW VirtualAlloc VirtualProtect HeapAlloc HeapFree DecodePointer EncodePointer GetStringTypeW InterlockedExchange LCMapStringW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetTimeZoneInformation HeapCreate FindResourceA lstrcmpA lstrlenA FreeLibrary LoadResource SystemTimeToTzSpecificLocalTime InterlockedIncrement InterlockedDecrement WaitForSingleObject GetCommandLineA WideCharToMultiByte InitializeCriticalSectionAndSpinCount SizeofResource CreateEventA SetDllDirectoryA IsDBCSLeadByte lstrcatA MultiByteToWideChar lstrlenW RaiseException GetLastError lstrcmpiA GetProcAddress WaitForMultipleObjects GetModuleFileNameA GetModuleHandleA CreateMutexA DeleteCriticalSection CloseHandle SetEvent ResetEvent CreateThread lstrcpyA lstrcpynA CreateFileA WriteFile Sleep ReadFile OpenEventA GetCurrentProcess GetTickCount GetVersionExA GetCurrentProcessId GetTempPathA LocalFree DeleteFileA FileTimeToSystemTime FormatMessageW GetLocalTime GetCurrentThreadId PeekNamedPipe SetHandleInformation GetExitCodeProcess CreateProcessA TerminateProcess CreatePipe ExitProcess GetLocaleInfoA GetSystemDirectoryA FindClose LoadLibraryA LockResource GetNativeSystemInfo GetModuleHandleExW GetSystemDefaultUILanguage GetThreadLocale GetUserDefaultUILanguage GetFileAttributesA GetStdHandle LoadLibraryExW OpenMutexA GetModuleHandleExA LoadLibraryW CreateFileW SetFilePointerEx InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetModuleFileNameW HeapSize TlsAlloc TlsGetValue TlsSetValue TlsFree GetLocaleInfoW SetHandleCount SetFilePointer FlushFileBuffers GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter SetEndOfFile GetProcessHeap WriteConsoleW GetCurrentDirectoryW GetFileInformationByHandle GetUserDefaultLCID EnumSystemLocalesA IsValidLocale CompareStringW SetEnvironmentVariableA LoadLibraryExA SetLastError

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumKeyA CryptHashData CryptDestroyHash CryptCreateHash CryptAcquireContextA CryptReleaseContext RegQueryValueExA CryptGetHashParam SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegNotifyChangeKeyValue RegDeleteValueA RegOpenKeyExA RegCreateKeyExA RegEnumKeyExA RegDeleteKeyA RegQueryInfoKeyW RegSetValueExA

oleaut32

VarUI4FromStr

gdi32

GetStockObject

crypt32

CryptStringToBinaryA CryptUnprotectData CryptProtectData CryptBinaryToStringA

msi

ord189 ord91 ord117 ord141 ord168 ord67 ord160 ord158 ord115 ord159 ord8 ord31 ord44 ord204 ord137

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_f5737ec0346e4ac813dfc6a3c237acdb_elex_glassworm_mafia_remcos

ole32

shell32

wininet

user32

version

kernel32

advapi32

oleaut32

gdi32

crypt32

msi

generic