2026-08-03_0d14b47dfc33a8e39e81eb837a30f415_elex_glassworm_poet-rat_remcos_stop_tobfy_whiskeybravo

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_0d14b47dfc33a8e39e81eb837a30f415_elex_glassworm_poet-rat_remcos_stop_tobfy_whiskeybravo
Size 4.7MB
Sample260804-d1445acc69
SHA256 c9e3626442e4fe5d6783ec969a16018c07db017f223fd8e580b6a49b6af4d447
MD5 0d14b47dfc33a8e39e81eb837a30f415
SHA1 447d2a47c56c6ff83001611f4fedca9688e6a5af
SHA512 73e21a8b7218b577d6dd8503ed3078039a399350b00df3c65d5a43e4674afbe1a85b53928c67560923be8643c74cad3384be86ab4d05f0d0665bdfe71639f165
SSDEEP 49152:ZaPjBCJ6iBuh8PNpY26+AA/lLSU2veMXU:ZBNBtVWSAal5jMXU
TLSH
T1A536F603E7819A36D1AE27714CF76325B73AF8611FF283C75B582A6A5CB13C5983035A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-03_0d14b47dfc33a8e39e81eb837a30f415_elex_glassworm_poet-rat_remcos_stop_tobfy_whiskeybravo

.exe 4.7MB

2026-08-03_0d14b47dfc33a8e39e81eb837a30f415_elex_glassworm_poet-rat_remcos_stop_tobfy_whiskeybravo

IMPHASH e3ef9cc0d961fcdcadb983ea0dbcffe4
SHA256 c9e3626442e4fe5d6783ec969a16018c07db017f223fd8e580b6a49b6af4d447
MD5 0d14b47dfc33a8e39e81eb837a30f415
SHA1 447d2a47c56c6ff83001611f4fedca9688e6a5af
SHA512 73e21a8b7218b577d6dd8503ed3078039a399350b00df3c65d5a43e4674afbe1a85b53928c67560923be8643c74cad3384be86ab4d05f0d0665bdfe71639f165
SSDEEP 49152:ZaPjBCJ6iBuh8PNpY26+AA/lLSU2veMXU:ZBNBtVWSAal5jMXU
TLSH
T1A536F603E7819A36D1AE27714CF76325B73AF8611FF283C75B582A6A5CB13C5983035A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

7c:9f:e3:16:4d:01:2f:b5:86:04:cc:7a:3d:96:20:5e:41:62:ea:5a:76:16:05:6a:43:7c:cb:aa:ec:90:32:4b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=4489370,CN=NCH Software\, Inc.,O=NCH Software\, Inc.,L=Greenwood Village,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

May 31, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

05:bf:20:1b:48:6d:fc:33:84:d7:cf:f2:1c:13:80:67

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 31, 2025 - Mar 28, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1972773

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\sourcecode\scribe\release\Scribe.pdb

kernel32

FreeResource GetPrivateProfileIntW CreateMutexW GetLastError SystemTimeToTzSpecificLocalTime GetLocaleInfoW GlobalUnlock HeapFree SuspendThread GlobalAlloc GetSystemTime SetEndOfFile GetCurrentDirectoryW CreateThread RtlCaptureContext GetProcessHeap GetFileSize SetFilePointer ProcessIdToSessionId GetUserDefaultLangID PeekNamedPipe HeapAlloc GetCurrentProcessId GetDiskFreeSpaceExW GetUserDefaultUILanguage GetModuleHandleW ReadProcessMemory SetFileAttributesW GetUserDefaultLCID lstrcpyW ResumeThread GetCPInfo GetExitCodeProcess SetFileTime QueryPerformanceFrequency GlobalHandle ExitProcess GetSystemInfo GlobalSize FileTimeToLocalFileTime GetEnvironmentVariableW CreateDirectoryW GetModuleFileNameA MulDiv FindNextFileW GetProcAddress FindFirstFileW InterlockedIncrement GetVersionExW FindClose WideCharToMultiByte DeleteFileW FreeLibrary GetVersionExA GetFileAttributesW DisconnectNamedPipe CreateFileW GetFileSizeEx CloseHandle RemoveDirectoryW LeaveCriticalSection WaitForSingleObject GetCurrentThread CopyFileW LoadLibraryW EnterCriticalSection SetEvent InterlockedExchange Sleep GetCurrentThreadId ResetEvent SetErrorMode GetTickCount MoveFileW InitializeCriticalSection CreateEventW InterlockedExchangeAdd CreateProcessW VerifyVersionInfoW OpenProcess GetTimeZoneInformation GetComputerNameW MoveFileExW InterlockedDecrement VerSetConditionMask DeleteCriticalSection GetTempPathW WriteFile FlushFileBuffers CreateFileMappingW LoadLibraryExW GlobalFree lstrlenA SetUnhandledExceptionFilter OpenFileMappingW GetPrivateProfileSectionNamesW CreateToolhelp32Snapshot GetACP GetLogicalDriveStringsW GetCommandLineW GetPrivateProfileStringW LocalFree ReleaseMutex DuplicateHandle GetDriveTypeW GetStartupInfoW GetCommModemStatus LoadResource CreatePipe TerminateProcess GetEnvironmentVariableA WaitForMultipleObjects GetOverlappedResult CreateNamedPipeW UnmapViewOfFile GetCurrentProcess LocalAlloc GetStdHandle GetModuleFileNameW GlobalMemoryStatusEx QueryPerformanceCounter GetCurrentDirectoryA GlobalLock SetEnvironmentVariableW FileTimeToSystemTime SizeofResource VirtualQuery Process32FirstW CancelIo DeviceIoControl SetLastError GetShortPathNameW ConnectNamedPipe MapViewOfFile FindResourceW SetCurrentDirectoryW WaitNamedPipeW Process32NextW LockResource MultiByteToWideChar SetThreadPriority SetFilePointerEx GetFileTime GetThreadPriority ReadFile LoadLibraryA GetThreadContext GetSystemTimeAsFileTime HeapReAlloc UnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetStartupInfoA GetModuleHandleA TlsGetValue TlsAlloc CreateFileA SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode GetConsoleCP RtlUnwind GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA RaiseException GetStringTypeW GetStringTypeA GetLocaleInfoA VirtualAlloc TlsSetValue TlsFree HeapSize GetOEMCP IsValidCodePage LCMapStringA LCMapStringW HeapDestroy HeapCreate VirtualFree

advapi32

CryptEncrypt RegCloseKey RegOpenKeyExW RegDeleteKeyW CheckTokenMembership RegOpenKeyW AllocateAndInitializeSid CryptDestroyHash CryptDuplicateKey InitializeSid CryptDecrypt RegQueryInfoKeyW OpenProcessToken RegSetKeySecurity GetSidSubAuthority GetTokenInformation ConvertSidToStringSidW CryptHashData CryptAcquireContextW DuplicateTokenEx CryptDeriveKey GetAce RegSetValueExW RegDeleteValueW FreeSid SetSecurityDescriptorDacl InitializeAcl AddAccessAllowedAce InitializeSecurityDescriptor CryptCreateHash RegEnumValueW GetSidLengthRequired RegQueryValueExW GetUserNameW RegEnumKeyExW CryptDestroyKey SetFileSecurityW RegCreateKeyExW RegEnumKeyW

comctl32

InitCommonControlsEx CreatePropertySheetPageW ImageList_AddMasked CreateToolbarEx ImageList_GetIcon ImageList_Destroy ImageList_Replace ImageList_GetImageCount ImageList_Duplicate ord17 ImageList_Add ImageList_GetIconSize ImageList_DrawEx ImageList_ReplaceIcon PropertySheetW ImageList_Create _TrackMouseEvent

comdlg32

GetSaveFileNameW GetOpenFileNameW

gdi32

GetStockObject Rectangle CreateBitmap CreatePatternBrush CreateDIBitmap GetTextExtentPoint32W PatBlt SetViewportExtEx PolyTextOutW GetWindowExtEx PolyPolyline CreateDIBSection EnumFontFamiliesExW PolyDraw SetBrushOrgEx TextOutW ExtTextOutW GetDIBits ExtFloodFill StretchBlt SetWindowExtEx SetBkColor CreatePen BitBlt GetDeviceCaps LineTo DeleteObject GetCurrentObject CreateFontW DeleteDC GetTextCharset MoveToEx SelectObject CreateSolidBrush GetTextMetricsW SetTextColor CreateCompatibleDC CreateFontIndirectW SetBkMode SetDIBits CreateCompatibleBitmap GetObjectW SetStretchBltMode GetViewportExtEx CreateRoundRectRgn

msacm32

acmDriverOpen acmDriverDetailsW acmStreamPrepareHeader acmFormatTagEnumW acmDriverClose acmStreamClose acmStreamConvert acmStreamUnprepareHeader acmDriverEnum acmStreamSize acmStreamOpen

ole32

CreateStreamOnHGlobal CoResumeClassObjects CoSetProxyBlanket CoInitializeSecurity IIDFromString CoGetMalloc CoCreateInstance CoTaskMemFree CoTaskMemAlloc CoUninitialize CoRevokeClassObject CoAddRefServerProcess CoRegisterClassObject CoInitialize

oleaut32

SysAllocStringByteLen OleLoadPicturePath SysStringByteLen SysFreeString VariantClear SysAllocString VariantInit OleLoadPicture SysAllocStringLen

shell32

ShellExecuteExW ShellExecuteW SHChangeNotify Shell_NotifyIconW SHGetFolderPathW ShellExecuteA SHBrowseForFolderW DragFinish CommandLineToArgvW SHGetFileInfoW ord155 SHParseDisplayName SHCreateShellItem DragQueryFileW DragAcceptFiles DuplicateIcon SHGetPathFromIDListW ord680 SHGetDesktopFolder SHGetMalloc

shlwapi

PathCompactPathExW SHDeleteEmptyKeyW StrCmpLogicalW SHDeleteKeyW

user32

DestroyWindow CallWindowProcW RemovePropW EndPaint GetMonitorInfoW GetParent IsZoomed SetWindowTextW SetWindowLongW SetTimer UnhookWindowsHookEx IsIconic SendDlgItemMessageW SystemParametersInfoW GetClientRect EmptyClipboard SetWindowPos GetDlgItem RegisterWindowMessageW DestroyIcon RemoveMenu ModifyMenuW SetWindowPlacement FillRect EnableMenuItem KillTimer IsDlgButtonChecked DrawTextW MonitorFromRect CreatePopupMenu GetDlgItemInt EnableWindow ReleaseCapture WindowFromDC EnumChildWindows PostQuitMessage UpdateWindow InsertMenuW DispatchMessageW FlashWindowEx GetWindowDC EnumDisplayDevicesW GetWindow RegisterHotKey GetDlgItemTextW GetComboBoxInfo RegisterClipboardFormatW InflateRect GetActiveWindow GetWindowWord IsCharAlphaW MapWindowPoints FindWindowExW DrawEdge GetMenuInfo DrawStateW CreateDialogIndirectParamW GetCapture DialogBoxIndirectParamW SetMenuItemInfoW GetWindowPlacement MoveWindow SetMenuInfo GetSysColorBrush SetClassLongW GetWindowThreadProcessId GetDialogBaseUnits EnumWindows DrawMenuBar SetWindowWord CallNextHookEx DefWindowProcW DrawIconEx SetForegroundWindow SetCapture GetClassNameA GetKeyNameTextW WindowFromPoint MonitorFromPoint MapVirtualKeyW keybd_event wsprintfW GetSysColor IsClipboardFormatAvailable SetMenuItemBitmaps InsertMenuItemW GetClipboardData EndMenu GetWindowTextW GetScrollBarInfo EnumThreadWindows GetDlgCtrlID ScrollWindowEx LoadStringW GetForegroundWindow PeekMessageW GetAncestor MsgWaitForMultipleObjects GetMessageW MapDialogRect IsDialogMessageW TranslateMessage AttachThreadInput SetScrollInfo EndDialog GetSubMenu UnregisterHotKey GetMenuItemCount GetUpdateRect GetIconInfo AllowSetForegroundWindow FindWindowW DrawFocusRect DrawTextExW SetClipboardData SetWindowRgn SetPropW GetCursor RegisterClassW CloseClipboard ScreenToClient LoadImageW SetFocus SetWindowsHookExW GetCursorInfo ClientToScreen GetWindowRect CheckMenuRadioItem MonitorFromWindow GetPropW WaitForInputIdle BeginPaint SendMessageW IsWindowEnabled GetSystemMetrics DestroyMenu TrackPopupMenu IsWindowVisible DeleteMenu SetDlgItemInt GetScrollInfo ShowWindow GetAsyncKeyState IsWindow CheckDlgButton CheckMenuItem PostMessageW GetDesktopWindow SetDlgItemTextW GetWindowLongW RedrawWindow SetCursor GetWindowTextLengthW AppendMenuW SetMenuDefaultItem GetFocus MessageBoxW GetClassNameW GetDC SetActiveWindow GetKeyState LoadCursorW InvalidateRect GetMenu GetKeyboardState FrameRect ReleaseDC SetMenu OpenClipboard EnumDisplaySettingsW CreateWindowExW

winmm

waveOutReset waveOutSetVolume waveOutRestart waveInUnprepareHeader waveInClose waveOutGetPosition waveOutWrite mixerGetID mixerGetLineControlsW waveOutGetDevCapsW waveInGetNumDevs waveInStop waveOutOpen mixerGetControlDetailsW waveOutPrepareHeader mixerSetControlDetails mixerGetLineInfoW waveInOpen waveOutClose waveOutUnprepareHeader waveInPrepareHeader waveOutGetNumDevs waveInStart waveInReset waveInMessage waveInAddBuffer waveInGetDevCapsW waveOutPause

ws2_32

send socket closesocket inet_addr ioctlsocket htons select gethostbyname setsockopt recv getsockopt ntohs __WSAFDIsSet WSAStartup connect gethostbyaddr gethostname WSAGetLastError

rpcrt4

UuidCreate RpcStringFreeW UuidToStringW UuidFromStringW

netapi32

NetUserGetInfo NetApiBufferFree

gdiplus

GdipBitmapSetResolution GdipGetPathGradientPointCount GdipCreatePathGradientFromPath GdipDrawImageRectRect GdipGetImageVerticalResolution GdipGetStringFormatFlags GdipGetImageGraphicsContext GdipGetGenericFontFamilySansSerif GdipSetSolidFillColor GdipSaveImageToStream GdipSetImageAttributesColorMatrix GdipGetImageEncodersSize GdipCombineRegionPath GdipGetPointCount GdipSetClipRegion GdipGetImageHeight GdipSetLinePresetBlend GdiplusStartup GdipDeletePen GdipFillEllipse GdipMultiplyWorldTransform GdipSetPathGradientCenterColor GdipGetEmHeight GdipGetFamily GdipSetPenDashStyle GdipImageGetFrameDimensionsCount GdipGetPropertyCount GdipSetImageAttributesWrapMode GdipAddPathPath GdipCreateMatrix2 GdipCreateImageAttributes GdipSetPathGradientWrapMode GdipSetStringFormatHotkeyPrefix GdipCreateLineBrush GdipFillPath GdipSetTextRenderingHint GdipGetPathLastPoint GdipSetPathGradientPresetBlend GdipDeleteMatrix GdipGetCellAscent GdipCreateFontFromDC GdipDisposeImage GdipSetLineWrapMode GdipSetInterpolationMode GdipSetStringFormatTrimming GdipSetStringFormatAlign GdipCreatePath GdipGetImageWidth GdipGetMatrixElements GdipReleaseDC GdipAddPathEllipse GdipGetFontStyle GdipAddPathLine GdipSetPenStartCap GdipResetPath GdipGetImagePixelFormat GdipImageGetFrameDimensionsList GdipAddPathBezier GdipSetPathGradientCenterPoint GdipSetWorldTransform GdipGetImageEncoders GdipStringFormatGetGenericTypographic GdipGetImageHorizontalResolution GdipCreateMatrix GdipCreateFont GdipGetPropertyItemSize GdipDrawString GdipGraphicsClear GdipAddPathStringI GdipCloneStringFormat GdipCreatePen2 GdipDeleteStringFormat GdipDeleteFontFamily GdipAddPathArc GdipDrawPath GdipSetPenMiterLimit GdipAddPathString GdipBitmapLockBits GdipSetPenEndCap GdipDeleteFont GdipGetDC GdipSetPathGradientSurroundColorsWithCount GdipCreateFromHDC GdipClonePath GdipDisposeImageAttributes GdipStartPathFigure GdipSetPenDashCap197819 GdipImageSelectActiveFrame GdipAddPathRectangle GdipFlattenPath GdipCreateFontFamilyFromName GdipDeleteRegion GdipAddPathLine2 GdipCreateRegion GdipGetPropertyItem GdipSetPathFillMode GdipCloneImage GdipSetPathGradientTransform GdipCreateBitmapFromStream GdipResetClip GdipSetStringFormatFlags GdipImageGetFrameCount GdipGetPathPoints GdipFillRectangle GdiplusShutdown GdipClosePathFigure GdipDeleteGraphics GdipSetStringFormatLineAlign GdipTranslateWorldTransform GdipSetLineTransform GdipSetSmoothingMode GdipCreateBitmapFromScan0 GdipSetPenDashOffset GdipBitmapUnlockBits GdipGetPathWorldBounds GdipSetPenLineJoin GdipMeasureString GdipGetWorldTransform GdipGetFontSize GdipGetPropertyIdList GdipDeleteBrush GdipCloneBrush GdipSetPenDashArray GdipDeletePath GdipSetPixelOffsetMode GdipSetPageUnit GdipCreateStringFormat GdipCreateSolidFill

msimg32

AlphaBlend GradientFill

iphlpapi

GetIpAddrTable GetAdaptersAddresses

wininet

InternetAutodialHangup InternetQueryOptionA InternetGetConnectedState InternetAutodial

dnsapi

DnsRecordListFree DnsQuery_W

secur32

DeleteSecurityContext QueryContextAttributesW AcquireCredentialsHandleW ApplyControlToken InitializeSecurityContextW EncryptMessage DecryptMessage FreeContextBuffer FreeCredentialsHandle

crypt32

CertCloseStore CertFreeCertificateContext CertVerifySubjectCertificateContext CertFindCertificateInStore CryptQueryObject

wintrust

WinVerifyTrust

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

480KB

Virtual Size

480KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

667KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

132KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_0d14b47dfc33a8e39e81eb837a30f415_elex_glassworm_poet-rat_remcos_stop_tobfy_whiskeybravo

kernel32

advapi32

comctl32

comdlg32

gdi32

msacm32

ole32

oleaut32

shell32

shlwapi

user32

winmm

ws2_32

rpcrt4

netapi32

gdiplus

msimg32

iphlpapi

wininet

dnsapi

secur32

crypt32

wintrust

generic