2026-07-24_68d8e6636c8d05f08809df0784513a83_elex_floxif_glassworm_hijackloader_remcos_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-24_68d8e6636c8d05f08809df0784513a83_elex_floxif_glassworm_hijackloader_remcos_stop
Size 3.1MB
Sample260724-wsdajstyhs
SHA256 7112e6f6e8a601ab228dabb0476b87b35d235f1311ea8cc6d0e88e75e14646db
MD5 68d8e6636c8d05f08809df0784513a83
SHA1 ef08dbdae5a887369c4dfa03a938f1e249fd6034
SHA512 934784cd5fddbe3e319ba9bf6227684359c7a601b21ab3d41f7fd111ef3e0e9be21818baf4189658475d8e6a52c3e95dfc18fcd16366ab13a47d457397fad8bb
SSDEEP 24576:xJwyrtWZANi3S8JYHYoDWLq8XsEbbjZtvFyEBQlQsSp/PlUhv+8+c+TC3OEJPrgB:TeFYHlCPbEEq+LTmOOyjEVq2uuza
TLSH
T1CDE5AF12F3E681A4E4F32AB0683F62259935BD199734C2CFA6503D0FAD317D1A934B97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-24_68d8e6636c8d05f08809df0784513a83_elex_floxif_glassworm_hijackloader_remcos_stop

File Explorer

2026-07-24_68d8e6636c8d05f08809df0784513a83_elex_floxif_glassworm_hijackloader_remcos_stop

.exe 3.1MB

2026-07-24_68d8e6636c8d05f08809df0784513a83_elex_floxif_glassworm_hijackloader_remcos_stop

IMPHASH 4ea0670159e07337e9f53e39435af3db
SHA256 7112e6f6e8a601ab228dabb0476b87b35d235f1311ea8cc6d0e88e75e14646db
MD5 68d8e6636c8d05f08809df0784513a83
SHA1 ef08dbdae5a887369c4dfa03a938f1e249fd6034
SHA512 934784cd5fddbe3e319ba9bf6227684359c7a601b21ab3d41f7fd111ef3e0e9be21818baf4189658475d8e6a52c3e95dfc18fcd16366ab13a47d457397fad8bb
SSDEEP 24576:xJwyrtWZANi3S8JYHYoDWLq8XsEbbjZtvFyEBQlQsSp/PlUhv+8+c+TC3OEJPrgB:TeFYHlCPbEEq+LTmOOyjEVq2uuza
TLSH
T1CDE5AF12F3E681A4E4F32AB0683F62259935BD199734C2CFA6503D0FAD317D1A934B97
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

40:4e:c8:f5:c6:87:da:45:67:36:04:e8:04:a4:90:56:62:bd:ee:d9:8d:53:23:ee:0d:4a:91:bd:85:e5:25:30

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=4489370,CN=NCH Software\, Inc.,O=NCH Software\, Inc.,L=Greenwood Village,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 13, 2023

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

ca:1c:13:b5:a6:b8:05:2e:58:22:e6:58:5b:fc:7e:b2:05:00:91:3f

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

Jan 13, 2023

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

Serial Number

07:ef:f6:93:7e:47:22:71:e7:22:f7:e0:62:48:a3:f1

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 18, 2022 - Apr 2, 2025

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 4, 2022 - Jan 1, 2029

Minor OS version

Major OS version

Entry point

1824310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\sourcecode\voxal\release\Voxal.pdb

kernel32

ExitProcess TerminateProcess GetTickCount SetFileTime GlobalMemoryStatusEx RemoveDirectoryW GetModuleFileNameA GetPrivateProfileIntW SetEnvironmentVariableW GetFileSize GetPrivateProfileSectionNamesW LocalAlloc GetCurrentDirectoryW GetDiskFreeSpaceExW GetUserDefaultUILanguage SetEndOfFile LoadLibraryExW GetUserDefaultLCID SetUnhandledExceptionFilter GetVersionExA GetLastError PeekNamedPipe GetCurrentProcess RtlCaptureContext LocalFree SetCurrentDirectoryW CreateNamedPipeW GetStdHandle GetTimeZoneInformation GetSystemInfo SetFilePointer LoadResource GetLocaleInfoW GlobalLock GetFileSizeEx GetProcAddress QueryPerformanceCounter GetExitCodeProcess ResetEvent MoveFileExW DeleteCriticalSection VerSetConditionMask InterlockedExchange InterlockedExchangeAdd CopyFileW GetCurrentProcessId QueryPerformanceFrequency CreateDirectoryW FreeLibrary GetVersionExW WideCharToMultiByte FindFirstFileW Sleep VerifyVersionInfoW GetThreadPriority GetTempPathW LeaveCriticalSection FlushFileBuffers SetThreadPriority InterlockedIncrement DeleteFileW GlobalSize ReadFile GetFileTime LoadLibraryA CreateFileW SetEvent CloseHandle InterlockedDecrement FindClose MoveFileW LoadLibraryW WaitForSingleObject EnterCriticalSection SetFilePointerEx DisconnectNamedPipe InitializeCriticalSection WriteFile CreateProcessW OpenProcess GlobalUnlock FindResourceW GetDriveTypeW GetACP lstrlenA ProcessIdToSessionId CreateFileMappingW SizeofResource UnmapViewOfFile CreateMutexW FileTimeToSystemTime IsBadWritePtr Process32FirstW ReadProcessMemory DuplicateHandle CreateToolhelp32Snapshot GetModuleFileNameW GlobalAlloc GetComputerNameW ConnectNamedPipe SetLastError GetFileAttributesA HeapFree CreateThread SetFileAttributesW CreatePipe GetEnvironmentVariableA HeapAlloc GetEnvironmentVariableW ResumeThread ReleaseMutex LockResource GlobalFree WaitForMultipleObjects GlobalHandle GetOverlappedResult GetProcessHeap GetThreadContext GetStartupInfoW MapViewOfFile GetCommandLineW GetModuleHandleW CancelIo GetCurrentDirectoryA Process32NextW VirtualQuery GetCurrentThreadId GetLogicalDriveStringsW FileTimeToLocalFileTime GetShortPathNameW SuspendThread GetPrivateProfileStringW FreeResource GetWindowsDirectoryW WaitNamedPipeW GetFileAttributesW GetUserDefaultLangID FindNextFileW GetCurrentThread MulDiv MultiByteToWideChar CreateEventW DeviceIoControl GetSystemTimeAsFileTime UnhandledExceptionFilter IsDebuggerPresent RtlUnwind GetCommandLineA GetStartupInfoA GetModuleHandleA TlsGetValue TlsAlloc SetEnvironmentVariableA CompareStringW CompareStringA CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode GetConsoleCP GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStringTypeW GetStringTypeA TlsSetValue TlsFree HeapSize GetCPInfo GetOEMCP IsValidCodePage LCMapStringA LCMapStringW HeapReAlloc RaiseException GetLocaleInfoA HeapCreate HeapDestroy VirtualAlloc VirtualFree

advapi32

CryptDestroyKey RegCloseKey RegDeleteKeyW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegDeleteValueW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetKeySecurity CheckTokenMembership CryptDeriveKey RegOpenKeyW GetUserNameW OpenProcessToken CryptEncrypt CryptDuplicateKey AddAccessAllowedAce CryptDestroyHash CryptCreateHash CryptReleaseContext GetSidLengthRequired RegQueryInfoKeyW CryptSetKeyParam CryptDecrypt RegEnumKeyW InitializeAcl AdjustTokenPrivileges LookupPrivilegeValueW RegEnumValueW CryptImportKey SetFileSecurityW DuplicateTokenEx CryptHashData CryptAcquireContextW AllocateAndInitializeSid InitializeSid RegEnumKeyExW FreeSid GetAce GetSidSubAuthority CryptGetKeyParam GetLengthSid RegSetValueExW

comctl32

ImageList_ReplaceIcon CreatePropertySheetPageW InitCommonControlsEx ImageList_Destroy ImageList_Create ImageList_DragShowNolock ImageList_Merge ImageList_GetImageInfo ImageList_DragEnter ImageList_DragLeave PropertySheetW ImageList_GetIcon ImageList_BeginDrag ImageList_DrawEx ImageList_EndDrag ImageList_DragMove ImageList_GetIconSize ord17 ImageList_AddMasked _TrackMouseEvent

comdlg32

GetOpenFileNameW GetSaveFileNameW

gdi32

GetTextExtentPoint32W GetClipBox GetObjectA ExtFloodFill PolyPolyline CreateRoundRectRgn SetWindowExtEx TextOutW ExtTextOutW BitBlt StretchBlt Polyline SetStretchBltMode SetDCBrushColor CreateBitmap Polygon CreateDIBitmap GetViewportExtEx GetWindowExtEx CreateBrushIndirect SetViewportExtEx SetDIBits GetDIBits CreateDIBSection SetTextAlign CreateRectRgn SetPixel SetBkColor SetTextColor SelectObject SetBrushOrgEx CreateCompatibleDC CreatePatternBrush GetStockObject CreateCompatibleBitmap CreateFontIndirectW GetObjectW GetTextMetricsW SetBkMode CreatePen CreateFontW LineTo GetDeviceCaps DeleteObject MoveToEx CreateSolidBrush CreateRectRgnIndirect GetCurrentObject DeleteDC GetTextMetricsA EnumFontFamiliesExW

msacm32

acmStreamClose acmStreamSize acmFormatChooseW acmStreamOpen acmStreamUnprepareHeader acmStreamConvert acmStreamPrepareHeader

ole32

CreateStreamOnHGlobal CoSetProxyBlanket CoInitialize CoTaskMemFree CoTaskMemAlloc CoUninitialize CoInitializeSecurity CoCreateInstance

oleaut32

OleLoadPicture VariantInit SysStringByteLen SysFreeString SysAllocString VariantClear SysAllocStringByteLen SysAllocStringLen OleLoadPicturePath

shell32

SHGetFolderPathW ShellExecuteExW DragQueryFileW ord155 SHGetPathFromIDListW SHFileOperationW SHChangeNotify SHParseDisplayName SHGetMalloc SHGetDesktopFolder ShellExecuteA ord680 DragFinish SHCreateShellItem SHBrowseForFolderW ShellExecuteW DragAcceptFiles CommandLineToArgvW

shlwapi

StrCmpLogicalW SHDeleteEmptyKeyW SHDeleteKeyW PathCompactPathExW

user32

GetScrollBarInfo DialogBoxParamW KillTimer SetScrollInfo UpdateWindow GetDC ModifyMenuW ShowWindow DrawTextW SetTimer GetDlgItem EnableMenuItem WaitForInputIdle CreateWindowExW GetMenu MapWindowPoints IsDlgButtonChecked GetWindowTextW GetClipboardData GetMenuItemInfoW SetPropW GetFocus GetSysColor IsWindowVisible SendDlgItemMessageW ReleaseDC CopyImage GetDlgItemInt CheckMenuItem UnregisterHotKey GetSystemMetrics GetClassNameW IsIconic SetDlgItemInt DeleteMenu LoadImageW ClientToScreen FrameRect DefWindowProcW GetMessageW DrawFocusRect CreateDialogParamW keybd_event SetMenuInfo EndDialog RemoveMenu wsprintfW SetActiveWindow OffsetRect GetNextDlgGroupItem InvalidateRgn CharUpperW PostQuitMessage DrawIconEx FlashWindowEx EnableWindow GetMenuInfo SetWindowRgn InflateRect SetWindowPlacement GetAncestor MonitorFromWindow GetCapture InvalidateRect GetWindowWord MsgWaitForMultipleObjects RegisterDeviceNotificationW FindWindowW LoadStringW WindowFromDC GetKeyNameTextW GetKeyboardState MapVirtualKeyW GetDlgItemTextW SystemParametersInfoW AllowSetForegroundWindow GetSubMenu ExitWindowsEx EqualRect SetCapture CreateDialogIndirectParamW ValidateRect ReleaseCapture SetWindowsHookExW GetClassNameA DrawEdge EnumChildWindows SetDlgItemTextW MonitorFromRect MonitorFromPoint GetSysColorBrush GetComboBoxInfo SetWindowWord GetUpdateRect GetMenuStringW GetIconInfo InsertMenuW DestroyCursor GetAsyncKeyState MapDialogRect UnhookWindowsHookEx PtInRect TranslateMessage CallNextHookEx AttachThreadInput CallWindowProcW RegisterClassW GetMonitorInfoW EndMenu DispatchMessageW IsCharAlphaW IsDialogMessageW EnumWindows DialogBoxIndirectParamW GetWindowTextLengthW UnregisterDeviceNotification FindWindowExW DrawStateW InsertMenuItemW CloseClipboard EmptyClipboard GetWindowThreadProcessId GetClientRect RemovePropW BeginPaint SetClassLongW LoadIconW SetWindowPos GetWindow GetWindowPlacement IsZoomed DestroyMenu CreatePopupMenu LoadCursorW GetDlgCtrlID SetMenuItemInfoW IsWindow ScrollWindowEx CheckDlgButton RegisterHotKey SetForegroundWindow IsClipboardFormatAvailable GetDesktopWindow GetCursor SendInput MessageBoxW EndPaint PeekMessageW DestroyWindow SetFocus FillRect GetParent RedrawWindow GetPropW DestroyIcon ShowScrollBar GetKeyState GetWindowDC ScreenToClient GetScrollInfo SetWindowLongW GetCursorInfo SetWindowTextW GetWindowRect OpenClipboard MoveWindow GetActiveWindow GetForegroundWindow TrackPopupMenu PostMessageW SendMessageW SetMenu SetCursor SetMenuItemBitmaps AppendMenuW GetWindowLongW IsWindowEnabled

winmm

waveInStart waveInUnprepareHeader waveOutPrepareHeader waveInClose waveOutClose waveInPrepareHeader waveInStop waveOutPause waveOutUnprepareHeader waveInGetDevCapsW waveOutWrite waveOutOpen waveOutSetVolume waveInOpen waveInAddBuffer waveInReset waveOutReset waveInGetNumDevs waveOutRestart

ws2_32

ioctlsocket closesocket socket __WSAFDIsSet ntohs send inet_addr htons WSAStartup setsockopt gethostbyname recv gethostbyaddr connect WSAGetLastError gethostname select

netapi32

NetUserGetInfo NetApiBufferFree

gdiplus

GdipCreateBitmapFromHBITMAP GdiplusShutdown GdipCloneImage GdipSetPenDashArray GdipDeleteRegion GdipCreateFontFromDC GdipGetPropertyItem GdipCreateFromHDC GdipSetStringFormatFlags GdipCreateBitmapFromStream GdipDisposeImageAttributes GdipGetImageVerticalResolution GdiplusStartup GdipDrawLine GdipBitmapSetResolution GdipGetImageEncodersSize GdipGetImageGraphicsContext GdipFillEllipse GdipDrawImageRectRect GdipSetPenDashStyle GdipImageGetFrameDimensionsCount GdipSaveImageToStream GdipSetStringFormatLineAlign GdipSetStringFormatHotkeyPrefix GdipGetImageHeight GdipFillPath GdipCreateImageAttributes GdipCreateStringFormat GdipDeletePen GdipDeleteMatrix GdipSetImageAttributesWrapMode GdipDrawRectangle GdipSetInterpolationMode GdipSetStringFormatTrimming GdipGetPropertyCount GdipScaleWorldTransform GdipCreateLineBrush GdipGetImageWidth GdipCreateBitmapFromHICON GdipSetLineWrapMode GdipReleaseDC GdipSetTextRenderingHint GdipDisposeImage GdipSetPenStartCap GdipSetStringFormatAlign GdipFillRectangle GdipClosePathFigure GdipDeleteGraphics GdipCreateSolidFill GdipDeleteFont GdipGraphicsClear GdipAddPathLine GdipCloneBrush GdipCreatePath GdipImageGetFrameCount GdipSetPageUnit GdipImageSelectActiveFrame GdipSetPenDashCap197819 GdipCreateBitmapFromScan0 GdipSetSmoothingMode GdipMeasureString GdipGetPropertyIdList GdipRotateWorldTransform GdipTranslateWorldTransform GdipBitmapUnlockBits GdipAddPathArc GdipCreateFontFromLogfontA GdipSetPenDashOffset GdipGetDC GdipSetPenEndCap GdipSetPenLineJoin GdipSetPenMiterLimit GdipGetImageHorizontalResolution GdipCreatePen2 GdipBitmapLockBits GdipGetImagePixelFormat GdipDrawEllipse GdipImageGetFrameDimensionsList GdipDrawString GdipDeleteStringFormat GdipGetPropertyItemSize GdipGetImageEncoders GdipStartPathFigure GdipDeleteBrush GdipSetImageAttributesColorMatrix GdipDeletePath GdipSetSolidFillColor

msimg32

AlphaBlend GradientFill

secur32

DeleteSecurityContext FreeContextBuffer DecryptMessage ApplyControlToken AcquireCredentialsHandleW QueryContextAttributesW FreeCredentialsHandle InitializeSecurityContextW EncryptMessage

iphlpapi

GetIpAddrTable GetAdaptersAddresses

wininet

InternetAutodial InternetAutodialHangup InternetGetConnectedState InternetQueryOptionA

dnsapi

DnsRecordListFree DnsQuery_W

crypt32

CertCloseStore CertFreeCertificateContext CryptQueryObject CertFindCertificateInStore CertVerifySubjectCertificateContext

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-24_68d8e6636c8d05f08809df0784513a83_elex_floxif_glassworm_hijackloader_remcos_stop

PE Signature issue

PE Signature issue

kernel32

advapi32

comctl32

comdlg32

gdi32

msacm32

ole32

oleaut32

shell32

shlwapi

user32

winmm

ws2_32

netapi32

gdiplus

msimg32

secur32

iphlpapi

wininet

dnsapi

crypt32

wintrust

generic