2026-08-06_4f196624559ae65e6be4cb45ab3bb74c_elex_glassworm_hijackloader_remcos_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-06_4f196624559ae65e6be4cb45ab3bb74c_elex_glassworm_hijackloader_remcos_stop
Size 4.0MB
Sample260806-l53e4ahn2t
SHA256 b2c8c6aeea5f43ec8fe26a1b017786a2f7ee7c72daa22cbaf16bea26e18f4b2f
MD5 4f196624559ae65e6be4cb45ab3bb74c
SHA1 6812ce1cd1074557978ecd55e8973bc59e62b7f7
SHA512 a9baa45d1b59d65b0a6e9ca350adca6b768e67b7c3674976cb8ae0e164043c53fda930678ca5ebc60d86de52be1c81c5126ba88081c4183400ae00403bc876ee
SSDEEP 98304:JxwHJoLPYprf1OLfqcdb9zSDzbuR1t67h:J6o8NtQdbIWLq
TLSH
T17E16DF127E92F073D5566333CD628EFAB663AD50C7A585C332943F09BE316C19A3A274
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-06_4f196624559ae65e6be4cb45ab3bb74c_elex_glassworm_hijackloader_remcos_stop

.exe 4.0MB

2026-08-06_4f196624559ae65e6be4cb45ab3bb74c_elex_glassworm_hijackloader_remcos_stop

IMPHASH a2dbad0f3d62b6e88db5492794540a6b
SHA256 b2c8c6aeea5f43ec8fe26a1b017786a2f7ee7c72daa22cbaf16bea26e18f4b2f
MD5 4f196624559ae65e6be4cb45ab3bb74c
SHA1 6812ce1cd1074557978ecd55e8973bc59e62b7f7
SHA512 a9baa45d1b59d65b0a6e9ca350adca6b768e67b7c3674976cb8ae0e164043c53fda930678ca5ebc60d86de52be1c81c5126ba88081c4183400ae00403bc876ee
SSDEEP 98304:JxwHJoLPYprf1OLfqcdb9zSDzbuR1t67h:J6o8NtQdbIWLq
TLSH
T17E16DF127E92F073D5566333CD628EFAB663AD50C7A585C332943F09BE316C19A3A274
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

db:e8:eb:69:00:96:98:4b:9d:ff:9a:db:87:b0:0c:8d:cb:60:07:55:24:92:d3:83:f1:e2:78:f2:ec:02:a7:cf

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91110105074175815X,CN=北京科德威曼科技有限公司,O=北京科德威曼科技有限公司,ST=北京市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e9809ae5b79ee58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e58c97e4baace5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Mar 19, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

07:57:1c:12:da:d7:ca:69:eb:90:c7:e2:05:14:c5:39

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 14, 2023 - Mar 16, 2026

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

960753

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\fhsource\wineasysetting\product\win32\dbginfo\setmain.pdb

kernel32

CreateEventW GetExitCodeThread SetEndOfFile GetLocalTime OutputDebugStringW GetProcessTimes ResumeThread InterlockedCompareExchange CreateProcessW FileTimeToSystemTime GetModuleHandleA GetVersion GetFileType GetStdHandle QueryPerformanceCounter GetCurrentProcessId GlobalMemoryStatus LoadLibraryA FlushConsoleInputBuffer WriteConsoleW GetConsoleOutputCP WriteConsoleA SetEnvironmentVariableA CompareStringW CompareStringA CreateProcessA GetExitCodeProcess GetLocaleInfoW GetCurrentDirectoryA GetFullPathNameA CreateFileA SetStdHandle FlushFileBuffers GetConsoleCP GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA SetFilePointer GetStartupInfoA SetHandleCount GetTimeZoneInformation GetFileAttributesA GetStringTypeW GetStringTypeA IsValidLocale DeleteCriticalSection GetUserDefaultLCID LCMapStringW LCMapStringA SetEvent GetOEMCP GetCPInfo HeapCreate TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleFileNameA FindFirstFileA GetDriveTypeA FileTimeToLocalFileTime RtlUnwind GetConsoleMode SetConsoleMode ReadConsoleInputA SetConsoleCtrlHandler ExitProcess GetStartupInfoW ExitThread GetSystemTimeAsFileTime IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter FormatMessageA ExpandEnvironmentStringsA SleepEx GetThreadLocale GetLocaleInfoA GetACP HeapSize HeapReAlloc HeapDestroy VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap HeapFree GetVersionExA WaitForMultipleObjects GetPrivateProfileIntW DeleteFileW InitializeCriticalSection LeaveCriticalSection FreeLibrary RaiseException EnterCriticalSection FindResourceExW FreeResource CreateMutexW LoadResource OutputDebugStringA LockResource GetTickCount GetSystemDirectoryW TerminateProcess Process32NextW Module32FirstW Process32FirstW CreateToolhelp32Snapshot OpenProcess QueryDosDeviceW GetLogicalDriveStringsW WaitForSingleObject CreateThread WriteFile FindClose FindNextFileW FindFirstFileW CreateDirectoryW GetFileAttributesW LoadLibraryExW lstrlenW InterlockedDecrement InterlockedIncrement lstrcmpiW Sleep GlobalLock CloseHandle GlobalUnlock OpenMutexW GetProcAddress InterlockedExchange GetVersionExW GetCurrentThreadId GetFileSize CreateFileW GetLastError WideCharToMultiByte IsValidCodePage GetWindowsDirectoryW GlobalFree GetModuleFileNameW lstrlenA SizeofResource LoadLibraryW ReadFile GlobalAlloc GetModuleHandleW SetLastError FlushInstructionCache MultiByteToWideChar FindResourceW GetPrivateProfileStringW GetCurrentProcess EnumSystemLocalesA

user32

SetWindowPos SystemParametersInfoW MoveWindow EnableWindow MessageBoxA GetDesktopWindow GetActiveWindow GetWindowTextW GetWindowTextLengthW EnumDisplayDevicesW EnumDisplaySettingsW GetSystemMetrics BringWindowToTop UnionRect FillRect GetUserObjectInformationW LoadCursorW GetProcessWindowStation IntersectRect CallWindowProcW SetCursor DefWindowProcW GetWindow GetDC GetWindowRect LoadBitmapW LoadImageW GetWindowLongW SetActiveWindow GetClientRect ReleaseDC MapWindowPoints CopyRect SetWindowLongW CreateWindowExW DestroyWindow FindWindowW IsIconic ShowWindow GetClassInfoExW RegisterClassExW AttachThreadInput InvalidateRect IsWindow GetWindowThreadProcessId IsWindowEnabled GetForegroundWindow SendMessageW InflateRect SetForegroundWindow RegisterWindowMessageW PostMessageW GetParent ExitWindowsEx CharNextW SetTimer KillTimer GetMessageW DispatchMessageW TranslateMessage PeekMessageW PostThreadMessageW CharLowerBuffW LoadStringW GetIconInfo DrawIconEx DestroyIcon SetFocus EqualRect MonitorFromWindow DrawTextW SetWindowRgn GetMonitorInfoW GetDlgCtrlID IsRectEmpty GetNextDlgTabItem ClientToScreen SetRect OffsetRect IsWindowVisible ScreenToClient SetCapture GetFocus IsChild GetDlgItem IsDialogMessageW GetCursorPos ReleaseCapture EndPaint PtInRect BeginPaint SetRectEmpty LoadIconW UpdateLayeredWindow UnregisterClassA

gdi32

RectInRegion GetTextExtentPoint32W CombineRgn CreateRectRgnIndirect CreateRoundRectRgn GetTextColor OffsetRgn GetViewportOrgEx SetBkMode ExtSelectClipRgn GetCurrentObject RoundRect SetViewportOrgEx GetClipRgn LineTo MoveToEx TextOutW Rectangle CreateRectRgn ExtTextOutW CreateSolidBrush SetTextColor GetStretchBltMode GetStockObject SetStretchBltMode CreateFontIndirectW StretchBlt CreateBitmap SelectObject CreatePen DeleteObject SaveDC BitBlt CreateCompatibleBitmap GetDeviceCaps CreateCompatibleDC DeleteDC CreateDIBSection RestoreDC GetObjectW SelectClipRgn SetBkColor

advapi32

RegQueryInfoKeyW RegSetValueExW RegCreateKeyExW RegOpenKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegQueryValueExW RegCloseKey RegOpenKeyExW QueryServiceStatus OpenServiceW CloseServiceHandle OpenSCManagerW RegEnumKeyExW RegDeleteKeyW RegDeleteKeyExW DeregisterEventSource ReportEventA RegisterEventSourceA RegDeleteValueW

shell32

SHChangeNotify ord727 SHGetFileInfoW SHCreateDirectoryExW ShellExecuteExW ord680 ShellExecuteW SHGetFolderPathW

ole32

CoUninitialize CoTaskMemFree CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CreateStreamOnHGlobal CoInitialize

oleaut32

VarUI4FromStr SysStringLen VarBstrCmp SysAllocString SysFreeString

shlwapi

PathFileExistsW PathRemoveFileSpecW PathAppendW StrToIntW PathAddBackslashW PathIsDirectoryW StrToIntA StrStrNIW PathFindFileNameW SHDeleteKeyW

comctl32

InitCommonControlsEx _TrackMouseEvent

msimg32

AlphaBlend

ws2_32

send getsockname ntohs bind htons getsockopt getpeername setsockopt recv socket WSASetLastError freeaddrinfo getaddrinfo __WSAFDIsSet select ioctlsocket WSAStartup WSAGetLastError closesocket connect WSACleanup

gdiplus

GdipCreateFont GdipCreateLineBrushFromRectWithAngleI GdipAddPathRectangle GdipDrawPath GdipDrawString GdipSetTextRenderingHint GdipCreatePen1 GdipSetStringFormatTrimming GdipAddPathArcI GdipSetStringFormatLineAlign GdipFillRectangleI GdipAddPathRectangleI GdipSetStringFormatAlign GdipSetClipHrgn GdipFillPath GdipDeleteFont GdipResetWorldTransform GdipTranslateWorldTransform GdipSetSmoothingMode GdipRotateWorldTransform GdipSetStringFormatFlags GdipDrawImageI GdipDrawRectangleI GdipDrawLinesI GdipGetImageEncoders GdipGetImageEncodersSize GdipBitmapUnlockBits GdipBitmapLockBits GdipSetClipPath GdipAddPathEllipseI GdipCreateFontFromLogfontW GdipCreatePath GdipSetInterpolationMode GdipDisposeImageAttributes GdipLoadImageFromFile GdipSetImageAttributesColorMatrix GdipGetImageHeight GdipNewPrivateFontCollection GdipGetImageWidth GdipDeletePrivateFontCollection GdipGetImagePixelFormat GdipPrivateAddFontFile GdipGetFontCollectionFamilyCount GdipCloneBitmapArea GdipGraphicsClear GdipDrawImageRectI GdipGetFontCollectionFamilyList GdipCloneFontFamily GdipImageRotateFlip GdipCloneImage GdipFree GdipDrawImageRectRect GdipDisposeImage GdipAlloc GdipDeleteGraphics GdipCreateBitmapFromStream GdiplusShutdown GdipCreateFromHDC GdipDrawImagePointsRectI GdipCreateHBITMAPFromBitmap GdipLoadImageFromStream GdipCreateBitmapFromScan0 GdiplusStartup GdipDeleteFontFamily GdipDrawImageRectRectI GdipGetImageGraphicsContext GdipCreateImageAttributes GdipMeasureString GdipDeletePen GdipCloneBrush GdipDeleteBrush GdipSetCompositingQuality GdipSetPixelOffsetMode GdipSetPenDashStyle GdipSetPenEndCap GdipGetFamily GdipSetPenStartCap GdipScaleWorldTransform GdipSetPenMode GdipCreateStringFormat GdipFillRectangle GdipDeleteStringFormat GdipAddPathPieI GdipAddPathStringI GdipCreateSolidFill GdipClosePathFigure GdipDeletePath GdipGetFontSize GdipDrawLine

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_4f196624559ae65e6be4cb45ab3bb74c_elex_glassworm_hijackloader_remcos_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

ws2_32

gdiplus

version

generic