2026-08-06_50461f6fa1f5f3d382b0ebbbb1ea0ba1_elex_floxif_glassworm_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-06_50461f6fa1f5f3d382b0ebbbb1ea0ba1_elex_floxif_glassworm_stop
Size 1.6MB
Sample260807-a5la2avbka
SHA256 f11e0befba85ae60756cb019b34fe1654b57994bcdedf57f245f94bf91811f9c
MD5 50461f6fa1f5f3d382b0ebbbb1ea0ba1
SHA1 08838dcda9211cd13011b525c966b6af91b7ea17
SHA512 db5d9284f52d32220689424feaa5874f8fbb53e4ab30052b87e826033eb6c95d123c6dfe6d015da8fafc88e69d63bd7a2c42b657871080c1322131510274ac63
SSDEEP 24576:OMAVKPeVptMtZz+1yckWHCmQyNqNxdn+6Mzg8nLCk4Mdq8kHUsKTLvrEH7r:2Bgc5lSykfd+xzg8Ck4MdqnmTu
TLSH
T101758D0DB780C3F9C873713635ED9295552CA01C03F091E3BA8D661BEB70AA6ED7764A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-06_50461f6fa1f5f3d382b0ebbbb1ea0ba1_elex_floxif_glassworm_stop

File Explorer

2026-08-06_50461f6fa1f5f3d382b0ebbbb1ea0ba1_elex_floxif_glassworm_stop

.exe 1.6MB

2026-08-06_50461f6fa1f5f3d382b0ebbbb1ea0ba1_elex_floxif_glassworm_stop

IMPHASH c1f9fe382b2936f64b656867eee5f474
SHA256 f11e0befba85ae60756cb019b34fe1654b57994bcdedf57f245f94bf91811f9c
MD5 50461f6fa1f5f3d382b0ebbbb1ea0ba1
SHA1 08838dcda9211cd13011b525c966b6af91b7ea17
SHA512 db5d9284f52d32220689424feaa5874f8fbb53e4ab30052b87e826033eb6c95d123c6dfe6d015da8fafc88e69d63bd7a2c42b657871080c1322131510274ac63
SSDEEP 24576:OMAVKPeVptMtZz+1yckWHCmQyNqNxdn+6Mzg8nLCk4Mdq8kHUsKTLvrEH7r:2Bgc5lSykfd+xzg8Ck4MdqnmTu
TLSH
T101758D0DB780C3F9C873713635ED9295552CA01C03F091E3BA8D661BEB70AA6ED7764A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

7a:38:30:a0:8f:73:66:42:7b:b7:94:a1:5b:62:54:f1:62:b8:36:c4

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=TrueCrypt Foundation,O=TrueCrypt Foundation,ST=Nevada,C=US,1.2.840.113549.1.9.1=#0c15636f6e74616374407472756563727970742e6f7267

Chains

Feb 7, 2012

CN=TrueCrypt Foundation,O=TrueCrypt Foundation,ST=Nevada,C=US,1.2.840.113549.1.9.1=#0c15636f6e74616374407472756563727970742e6f7267

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:08:d9:61:1c:d6

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jan 28, 1999 - Jan 27, 2014

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:08:d9:61:24:48

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jan 22, 2004 - Jan 27, 2014

Subject

CN=TrueCrypt Foundation,O=TrueCrypt Foundation,ST=Nevada,C=US,1.2.840.113549.1.9.1=#0c15636f6e74616374407472756563727970742e6f7267

Serial Number

01:00:00:00:00:01:24:da:79:a3:f3

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 9, 2009 - Nov 9, 2012

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:0b:7f:6b:00:00:00:00:00:19

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Minor OS version

Major OS version

Entry point

462015

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

ord17

setupapi

SetupOpenInfFileA SetupInstallFromInfSectionA SetupCloseInfFile SetupDiOpenClassRegKey

kernel32

GetCommandLineW DefineDosDeviceA GetCurrentProcessId FormatMessageW VirtualQuery ReleaseMutex CreateMutexA OpenMutexA GetVolumeInformationW QueryPerformanceCounter QueryPerformanceFrequency GetLogicalDrives FlushFileBuffers GetFileSize GetCurrentProcess GetProcAddress GetModuleHandleA GetVersionExA GetCurrentDirectoryA LockResource SizeofResource LoadResource FindResourceA GetFileAttributesA FindFirstFileA SetFilePointer GetModuleFileNameW SetCurrentDirectoryA QueryDosDeviceA FindNextFileA UnhandledExceptionFilter GetSystemInfo LoadLibraryA WaitForSingleObject GetCurrentThread SetUnhandledExceptionFilter SetErrorMode InterlockedExchangeAdd InterlockedExchange SetEvent ResetEvent CreateEventA FreeLibrary SetThreadPriority SetEndOfFile DeleteVolumeMountPointA SetVolumeMountPointA GetVolumeNameForVolumeMountPointA GetFileAttributesExA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetStartupInfoA GetProcessWorkingSetSize GetProcessTimes GetThreadTimes GlobalMemoryStatus GetProcessHeap InitializeCriticalSection LocalFree EnumSystemLocalesA GetUserDefaultLCID GetStringTypeA GetLocaleInfoA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA PeekNamedPipe GetFullPathNameA WriteConsoleW GetConsoleOutputCP WriteConsoleA HeapSize IsValidCodePage GetOEMCP GetACP InitializeCriticalSectionAndSpinCount SetHandleCount HeapReAlloc VirtualAlloc VirtualFree HeapCreate TlsFree TlsSetValue TlsAlloc TlsGetValue GetStdHandle GetStringTypeW GetCPInfo LCMapStringW LCMapStringA GetCommandLineA FileTimeToLocalFileTime FileTimeToSystemTime GetConsoleMode GetConsoleCP GetFileType SetStdHandle GetSystemTimeAsFileTime GetFileAttributesW SetFileAttributesA CreateThread ResumeThread ExitThread ExitProcess GetModuleHandleW RtlUnwind IsDebuggerPresent TerminateProcess HeapAlloc HeapFree RaiseException InterlockedCompareExchange FindFirstVolumeW QueryDosDeviceW FindNextVolumeW FindVolumeClose GetShortPathNameA GetDriveTypeA SetEnvironmentVariableA CreateDirectoryA GetTempPathA GetSystemDirectoryA MultiByteToWideChar DeleteFileA CopyFileA lstrlenW WideCharToMultiByte GetTickCount GetModuleFileNameA GetDiskFreeSpaceA GetVolumePathNameA GetDiskFreeSpaceExA GetFileSizeEx GetFileTime GetFileInformationByHandle SetFileTime SetThreadExecutionState FindFirstFileW CreateFileW FindNextFileW GetVolumeInformationA CreateFileA CloseHandle FindClose ReadFile WriteFile Sleep VirtualLock SetFilePointerEx GetLastError VirtualUnlock SetLastError DeviceIoControl SetProcessShutdownParameters GetCurrentThreadId InterlockedIncrement InterlockedDecrement IsValidLocale GetLocaleInfoW GetTimeZoneInformation CompareStringA CompareStringW

user32

wsprintfA SendMessageTimeoutA SystemParametersInfoW GetSystemMenu AppendMenuA AppendMenuW TrackMouseEvent CreateWindowExA GetClipboardViewer SendDlgItemMessageA GetKeyState EnumChildWindows GetDlgCtrlID GetClassNameA SendMessageW SetForegroundWindow GetClassInfoA SetDlgItemTextW SendDlgItemMessageW UnhookWindowsHookEx CallNextHookEx GetCursorPos GetCaretPos GetQueueStatus GetProcessWindowStation GetMessageTime GetOpenClipboardWindow GetMessagePos GetInputState GetFocus RegisterClassExA GetDesktopWindow PostThreadMessageA DispatchMessageA TranslateMessage GetClipboardOwner GetCapture SetWindowsHookExA SetLayeredWindowAttributes LoadCursorA SetCursor DefDlgProcA UnregisterClassA LoadIconA RegisterClassA GetUpdateRect BeginPaint DefWindowProcA GetDialogBaseUnits EndPaint LoadBitmapA SetWindowLongA CallWindowProcA GetWindowTextW GetClientRect GetSystemMetrics GetWindowInfo SetWindowPos GetDC ReleaseDC MessageBoxA GetActiveWindow KillTimer GetAsyncKeyState DestroyWindow GetWindowRect CreateDialogParamW MapDialogRect MoveWindow GetKeyboardLayout LoadKeyboardLayoutA ShowWindow SetDlgItemTextA GetWindowTextLengthA InvalidateRect GetDlgItemTextA DialogBoxParamW MessageBeep GetParent MessageBoxW SetFocus PeekMessageA SetTimer EnableWindow SendMessageA SetWindowTextW IsWindow EndDialog GetDlgItem EnumWindows GetWindowLongA GetWindowTextA PostMessageA SetWindowTextA wsprintfW GetMessageA ExitWindowsEx

gdi32

GetStockObject CreatePen MoveToEx LineTo GetCurrentObject GetObjectA CreateCompatibleBitmap CreateFontIndirectW StretchBlt DeleteObject GetTextMetricsA GetTextExtentPoint32W SelectObject GetDeviceCaps SetMapMode CreateCompatibleDC BitBlt SetStretchBltMode DeleteDC

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RegCloseKey RegDeleteValueA RegDeleteKeyA RegCreateKeyExA CryptAcquireContextA CryptGenRandom CryptReleaseContext GetTokenInformation IsWellKnownSid QueryServiceStatus ControlService StartServiceA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegQueryValueExA RegSetValueExA ChangeServiceConfigA OpenSCManagerA CreateServiceA ChangeServiceConfig2A OpenServiceA CloseServiceHandle DeleteService

shell32

DragQueryFileA DragFinish ShellExecuteW SHChangeNotify ord680 SHGetFileInfoA SHGetMalloc SHBrowseForFolderW SHGetPathFromIDListA CommandLineToArgvW SHGetFolderPathA ShellExecuteA DragAcceptFiles

ole32

CoCreateInstance StringFromGUID2 CoGetObject CoInitialize CoUninitialize CoRegisterClassObject CoRevokeClassObject

oleaut32

SysAllocStringLen SysAllocStringByteLen SysFreeString SysStringByteLen

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_50461f6fa1f5f3d382b0ebbbb1ea0ba1_elex_floxif_glassworm_stop

PE Signature issue

comctl32

setupapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic