2026-07-24_4e8dae2347c892bf79d1f965eaf52776_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-24_4e8dae2347c892bf79d1f965eaf52776_elex_glassworm_luca-stealer_mespinoza_njrat_remcos
Size 379KB
Sample260724-ql1vda1dnf
SHA256 da8f470f1fc4f569db3d1aef76b8cac2d74236ef11376d4498342317e510d6ab
MD5 4e8dae2347c892bf79d1f965eaf52776
SHA1 43a757fee4602fd99e15d0433dd1a4b838569d05
SHA512 168b70e9b6180db6a3af270187af90521958e0e41751153e756a2581db0a7bd0377f3831f3325a6a58edd91998a81cf26c895e7a3cb326b897c87679377ff919
SSDEEP 6144:gA+xbU3ztuDdBPuUi4OLWyRkPAaKOk9AMT7c6f9rYeVlcrF2YncC:gA+xb2zOdBP2LWyRoAbOk9AMnhYeVKFD
TLSH
T1C6847D20F880C432D5B324394EB9E6B25D7DB830076515DB73E80ABA4F745E17B3AA5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-24_4e8dae2347c892bf79d1f965eaf52776_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-07-24_4e8dae2347c892bf79d1f965eaf52776_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

.exe 379KB

2026-07-24_4e8dae2347c892bf79d1f965eaf52776_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

IMPHASH dd4c12e8613f1b6c2471e508b40f33d5
SHA256 da8f470f1fc4f569db3d1aef76b8cac2d74236ef11376d4498342317e510d6ab
MD5 4e8dae2347c892bf79d1f965eaf52776
SHA1 43a757fee4602fd99e15d0433dd1a4b838569d05
SHA512 168b70e9b6180db6a3af270187af90521958e0e41751153e756a2581db0a7bd0377f3831f3325a6a58edd91998a81cf26c895e7a3cb326b897c87679377ff919
SSDEEP 6144:gA+xbU3ztuDdBPuUi4OLWyRkPAaKOk9AMT7c6f9rYeVlcrF2YncC:gA+xb2zOdBP2LWyRoAbOk9AMnhYeVKFD
TLSH
T1C6847D20F880C432D5B324394EB9E6B25D7DB830076515DB73E80ABA4F745E17B3AA5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

80785

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\docker\Documents\workspace\build-v2\common\hrkill\bin\usysdiag-helper.pdb

kernel32

Module32Next Module32First CreateToolhelp32Snapshot GetCommandLineW WaitForSingleObject CreateThread ExitProcess SetProcessWorkingSetSize TlsSetValue HeapFree SetLastError InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus LocalAlloc GetCurrentThreadId HeapSize PostQueuedCompletionStatus GetExitCodeThread GetLastError SetEvent TlsAlloc HeapReAlloc RaiseException ResetEvent HeapAlloc DecodePointer HeapDestroy VirtualQueryEx TlsGetValue TlsFree CreateEventA CreateIoCompletionPort WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle OutputDebugStringA SetConsoleCtrlHandler SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo OpenThread TerminateThread TerminateProcess FreeLibrary GetCurrentDirectoryW CreateFileA GetCurrentDirectoryA SetFilePointer WriteFile SearchPathW ReadFile ExpandEnvironmentStringsA DeviceIoControl IsBadReadPtr SearchPathA GetSystemInfo LoadLibraryA CreateFileW GetVersion GetProcAddress GetModuleHandleA GetTickCount InterlockedIncrement WideCharToMultiByte DeleteCriticalSection LocalFree GetWindowsDirectoryW CloseHandle Sleep MultiByteToWideChar OpenProcess InitializeCriticalSection LeaveCriticalSection InterlockedDecrement GetCurrentProcess GetOEMCP IsValidCodePage FindNextFileW FindNextFileA FindFirstFileExW FindFirstFileExA FindClose EnumSystemLocalesW GetUserDefaultLCID GetLongPathNameW EnterCriticalSection VirtualAlloc VirtualFree VirtualProtect InterlockedExchange GetFileAttributesA GetProcessHeap UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent WaitForSingleObjectEx CreateEventW GetModuleHandleW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW EncodePointer LoadLibraryExW InterlockedPushEntrySList InterlockedFlushSList RtlUnwind GetCommandLineA ExitThread ResumeThread FreeLibraryAndExitThread GetModuleHandleExW GetModuleFileNameA GetModuleFileNameW GetStdHandle GetACP GetStringTypeW GetCurrentThread GetFileType GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale ReadConsoleW

user32

EnumDesktopWindows GetParent GetWindowRect UnregisterClassA OpenDesktopA EnumWindowStationsA GetWindowThreadProcessId IsWindowVisible CloseWindowStation EnumDesktopsA CloseDesktop OpenWindowStationA

advapi32

RegOpenKeyExA RegOpenKeyW ConvertSidToStringSidW OpenProcessToken RegCloseKey RegEnumKeyExA RegQueryValueExW RegSaveKeyA AdjustTokenPrivileges LookupPrivilegeValueA GetSidSubAuthorityCount GetSidSubAuthority GetUserNameW LookupAccountNameW GetSidIdentifierAuthority BuildExplicitAccessWithNameA SetSecurityDescriptorDacl SetEntriesInAclA GetSecurityDescriptorDacl RegGetKeySecurity RegDeleteKeyA RegQueryValueExA RegDeleteKeyW RegCreateKeyExA RegEnumKeyExW RegSetKeySecurity RegSetValueExW RegSetValueExA RegLoadKeyA InitializeSecurityDescriptor RegOpenKeyExW RegEnumValueA RegDeleteValueA GetTokenInformation

shell32

CommandLineToArgvW SHGetSpecialFolderPathA

ole32

CoInitialize CoUninitialize CoCreateInstance

oleaut32

SysFreeString

crypt32

CryptQueryObject CertCloseStore CryptMsgGetParam CertFindCertificateInStore CertGetNameStringW CertFreeCertificateContext CryptMsgClose

Name

.text

Size

283KB

Virtual Size

282KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

580B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-24_4e8dae2347c892bf79d1f965eaf52776_elex_glassworm_luca-stealer_mespinoza_njrat_remcos

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

generic