2026-08-03_08073ef157cb1c4120af861ce9f34d68_elex_glassworm_hijackloader_remcos_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_08073ef157cb1c4120af861ce9f34d68_elex_glassworm_hijackloader_remcos_stop
Size 1.6MB
Sample260804-qe17ka1eqa
SHA256 dd1db526b769525bc47fcc40547cb9fe75beae3d993875089ccf81907f41e2f7
MD5 08073ef157cb1c4120af861ce9f34d68
SHA1 8afca24a79144e5c5072e644a86ec13556441ac0
SHA512 ffd2b66f68a51d1adcbb28f5ee8b9d96bb80bfff6b006105397e9746d8737e5808989abf6372653552cd98ae8d7bdb80ecdcdccd5037586b9f46bf8ff244bdae
SSDEEP 24576:RI35RllEON8jxdD7WwlSVNVreY8jkxPHzmKXWoD:RI3T3BydflSVeDjYPHzmKXvD
TLSH
T12D7537427E90F4B3C1920373DDA64EF5B627AD14CBA685C357907F087E31AD19A3A2B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-03_08073ef157cb1c4120af861ce9f34d68_elex_glassworm_hijackloader_remcos_stop

.exe 1.6MB

2026-08-03_08073ef157cb1c4120af861ce9f34d68_elex_glassworm_hijackloader_remcos_stop

IMPHASH 90ccb212dfa607e679b14b82eb85b0b7
SHA256 dd1db526b769525bc47fcc40547cb9fe75beae3d993875089ccf81907f41e2f7
MD5 08073ef157cb1c4120af861ce9f34d68
SHA1 8afca24a79144e5c5072e644a86ec13556441ac0
SHA512 ffd2b66f68a51d1adcbb28f5ee8b9d96bb80bfff6b006105397e9746d8737e5808989abf6372653552cd98ae8d7bdb80ecdcdccd5037586b9f46bf8ff244bdae
SSDEEP 24576:RI35RllEON8jxdD7WwlSVNVreY8jkxPHzmKXWoD:RI3T3BydflSVeDjYPHzmKXvD
TLSH
T12D7537427E90F4B3C1920373DDA64EF5B627AD14CBA685C357907F087E31AD19A3A2B4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

c9:20:ce:4e:dc:45:7d:ed:f2:d3:07:33:c7:bc:97:31:18:26:be:ae:59:45:17:b7:1d:65:20:51:c3:75:6c:db

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91110105074175815X,CN=北京科德威曼科技有限公司,O=北京科德威曼科技有限公司,ST=北京市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e9809ae5b79ee58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e58c97e4baace5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Dec 21, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

07:57:1c:12:da:d7:ca:69:eb:90:c7:e2:05:14:c5:39

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 14, 2023 - Mar 16, 2026

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

782107

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\fhsource\wineasysetting\product\win32\dbginfo\uninstall.pdb

kernel32

CreateFileA GetWindowsDirectoryW CreateProcessW GetExitCodeProcess GetCommandLineW GetExitCodeThread CreateEventW SetEvent WaitForMultipleObjects GetPrivateProfileIntW lstrcmpW InterlockedExchange FreeResource InterlockedDecrement OutputDebugStringA InterlockedIncrement FlushInstructionCache GetCurrentThreadId GetPrivateProfileStringW RaiseException OutputDebugStringW GlobalLock GlobalAlloc GlobalFree GlobalUnlock lstrcmpiW MapViewOfFileEx LoadLibraryExW GetModuleHandleA GetVersion GetFileType GetStdHandle QueryPerformanceCounter GlobalMemoryStatus LoadLibraryA FlushConsoleInputBuffer FindFirstFileA ExpandEnvironmentStringsA FormatMessageA GetSystemDirectoryA SleepEx SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetFullPathNameA GetDriveTypeA GetCurrentDirectoryA GetLocalTime GetStringTypeW GetStringTypeA GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetConsoleCP GetTimeZoneInformation GetModuleFileNameA HeapCreate GetStartupInfoA SetHandleCount TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP RtlUnwind GetCPInfo LCMapStringW LCMapStringA GetConsoleMode SetConsoleMode ReadConsoleInputA SetConsoleCtrlHandler ExitProcess GetStartupInfoW ExitThread SetStdHandle IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter VirtualAlloc VirtualFree IsProcessorFeaturePresent GetThreadLocale GetLocaleInfoA GetACP GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetVersionExA lstrlenA SetFilePointer FileTimeToLocalFileTime GetSystemTimeAsFileTime FileTimeToSystemTime SetEndOfFile FlushFileBuffers GetLongPathNameW CreateFileMappingW UnmapViewOfFile WriteFile GetTickCount CopyFileW GetTempPathW MoveFileExW SetLastError InterlockedCompareExchange InitializeCriticalSectionAndSpinCount LocalFree LocalAlloc GetFileSize CreateFileW WideCharToMultiByte lstrlenW ReadFile MultiByteToWideChar GetVersionExW GetSystemDirectoryW CreateThread TerminateThread GetModuleHandleW LeaveCriticalSection ExpandEnvironmentStringsW EnterCriticalSection GetCurrentProcess InitializeCriticalSection FreeLibrary GetProcAddress LoadLibraryW CreateToolhelp32Snapshot QueryDosDeviceW DeleteCriticalSection GetLogicalDriveStringsW Sleep WaitForSingleObject SetFileAttributesW GetModuleFileNameW RemoveDirectoryW FindClose FindNextFileW DeleteFileW FindFirstFileW GetLastError CreateDirectoryW GetFileAttributesW FindResourceExW LoadResource LockResource SizeofResource FindResourceW Process32NextW TerminateProcess OpenProcess GetCurrentProcessId CloseHandle Process32FirstW VirtualQuery

user32

SetTimer LoadBitmapW SetWindowTextW CharNextW RegisterClassExW GetMonitorInfoW PtInRect CopyRect CreateWindowExW ScreenToClient InvalidateRect DefWindowProcW CharLowerBuffW UnregisterClassA LoadStringW DrawIconEx SetActiveWindow FindWindowW MonitorFromWindow SetWindowRgn SetCapture KillTimer PostThreadMessageW PeekMessageW GetUserObjectInformationW ReleaseCapture DrawFrameControl IsWindow GetCursorPos GetDlgCtrlID GetMessageW MoveWindow InflateRect LoadIconW DestroyWindow IntersectRect TranslateMessage CallWindowProcW SendMessageW OffsetRect DispatchMessageW DestroyIcon ClientToScreen GetParent UpdateLayeredWindow GetWindow GetWindowRect GetActiveWindow GetWindowLongW DrawTextW GetDesktopWindow GetClientRect IsWindowEnabled MapWindowPoints IsWindowVisible EnableWindow GetFocus SetCursor GetDC IsChild EqualRect LoadCursorW ReleaseDC GetWindowThreadProcessId SetRectEmpty GetForegroundWindow SetFocus IsRectEmpty IsDialogMessageW BeginPaint SystemParametersInfoW RegisterWindowMessageW AttachThreadInput SetWindowLongW GetDlgItem SetWindowPos IsIconic EndPaint SetRect GetClassInfoExW SetForegroundWindow ShowWindow PostMessageW GetNextDlgTabItem GetProcessWindowStation MessageBoxA LoadImageW

gdi32

RectInRegion SelectClipRgn SetBkMode CreateRectRgnIndirect TextOutW ExtTextOutW CreatePen GetDeviceCaps CombineRgn BitBlt CreateRoundRectRgn MoveToEx DeleteObject SetViewportOrgEx CreateCompatibleDC GetTextExtentPoint32W LineTo SelectObject RoundRect DeleteDC GetClipRgn RestoreDC SaveDC CreateFontIndirectW SetTextColor SetBkColor CreateDIBSection Rectangle CreateRectRgn GetStockObject GetObjectW ExtSelectClipRgn GetCurrentObject OffsetRgn GetTextColor GetStretchBltMode CreateBitmap CreateCompatibleBitmap StretchBlt SetStretchBltMode GetViewportOrgEx

advapi32

RegQueryInfoKeyW CreateProcessAsUserW RegEnumKeyExW RegDeleteKeyExW RegDeleteKeyW SetTokenInformation DuplicateTokenEx FreeSid EqualSid AllocateAndInitializeSid GetTokenInformation RegSetValueExW RegOpenKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegQueryValueExW RegCloseKey RegOpenKeyExW RegCreateKeyExW OpenSCManagerW CreateServiceW RegisterEventSourceA ReportEventA DeregisterEventSource ControlService StartServiceW QueryServiceStatus DeleteService ChangeServiceConfig2W ChangeServiceConfigW OpenServiceW CloseServiceHandle RegDeleteValueW

shell32

SHGetFolderPathW SHGetSpecialFolderPathW ShellExecuteW ShellExecuteExW ord680

ole32

CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CreateStreamOnHGlobal CoUninitialize CoCreateInstance CoInitialize

oleaut32

SysStringLen SysFreeString SysAllocString VarUI4FromStr VarBstrCmp

shlwapi

PathIsDirectoryW StrToIntA StrToIntW PathAddBackslashW PathAppendW PathRemoveFileSpecW PathFileExistsW PathFindFileNameW

comctl32

InitCommonControlsEx _TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdipGetFontSize GdipCreatePen1 GdipDrawImagePointsRectI GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromStream GdipImageRotateFlip GdiplusShutdown GdipGetImagePixelFormat GdipLoadImageFromStream GdipGraphicsClear GdipCreateImageAttributes GdipSetStringFormatLineAlign GdipDisposeImageAttributes GdipCreateFontFromLogfontW GdipSetTextRenderingHint GdipTranslateWorldTransform GdipNewPrivateFontCollection GdipDrawImageI GdipCloneBitmapArea GdipFillRectangle GdipCloneBrush GdipSetStringFormatFlags GdipSetClipPath GdipRotateWorldTransform GdipDeletePrivateFontCollection GdipSetStringFormatTrimming GdipScaleWorldTransform GdipDeleteBrush GdipSetPenDashStyle GdipSetImageAttributesColorMatrix GdipPrivateAddFontFile GdipResetWorldTransform GdipDisposeImage GdipDrawPath GdipGetFontCollectionFamilyCount GdipSetCompositingQuality GdipAddPathRectangleI GdipCloneImage GdipClosePathFigure GdipAlloc GdipAddPathArcI GdipDeletePath GdipGetFontCollectionFamilyList GdipDeleteFont GdipFillRectangleI GdipCloneFontFamily GdipCreatePath GdipFree GdipGetImageWidth GdipDrawRectangleI GdipCreateLineBrushFromRectWithAngleI GdipDeleteFontFamily GdipGetImageHeight GdipDrawString GdipCreateBitmapFromScan0 GdipDrawImageRectRectI GdipDrawLine GdipGetImageGraphicsContext GdipSetClipHrgn GdipSetSmoothingMode GdipLoadImageFromFile GdipAddPathRectangle GdipCreateStringFormat GdipSetPixelOffsetMode GdipSetPenMode GdipCreateSolidFill GdipFillPath GdipDeleteStringFormat GdipGetFamily GdipSetInterpolationMode GdipSetPenStartCap GdipDeleteGraphics GdipDrawLinesI GdipSetPenEndCap GdipCreateFromHDC GdipSetStringFormatAlign GdipDrawImageRectI GdipCreateFont GdipAddPathPieI GdipDrawImageRectRect GdipDeletePen GdipAddPathStringI GdipMeasureString GdiplusStartup

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_08073ef157cb1c4120af861ce9f34d68_elex_glassworm_hijackloader_remcos_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

version

wtsapi32

generic