2026-08-08_5fdf509584144b3fa5ae6ed79eb32cfe_elex_floxif_glassworm_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_5fdf509584144b3fa5ae6ed79eb32cfe_elex_floxif_glassworm_stop
Size 3.9MB
Sample260808-wexf9swtbw
SHA256 92c957a099c6ff2a2004247a52f5103a4a6d8e0607065fade6a087c9bb7389e2
MD5 5fdf509584144b3fa5ae6ed79eb32cfe
SHA1 af57b9541738e7301af7661fd6d99813221135dc
SHA512 ff4e5cc047139ab74052c584d854f850804102ad99e3acefd24e47a40624c9d6cd467bf2b6970dc05726ed979cf86f4189a257ea12f3ea6da3137909fb20ae78
SSDEEP 49152:5yXCP7X3uQ3YlZfbM3DacNHHO0DZyL8x+2wmyrS5uDOzQazX7kfHWRHiaHSiBehl:wcKNZf8mGHVD5x+2wTRA4fHgCP
TLSH
T15516AF213FC1C43ED2630272D84DA35893F2D1B06E768557AAA9135D2F35EA3DE21E72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-08_5fdf509584144b3fa5ae6ed79eb32cfe_elex_floxif_glassworm_stop

File Explorer

2026-08-08_5fdf509584144b3fa5ae6ed79eb32cfe_elex_floxif_glassworm_stop

.exe 3.9MB

2026-08-08_5fdf509584144b3fa5ae6ed79eb32cfe_elex_floxif_glassworm_stop

IMPHASH b82f622dcc69314b5e2125af74e90858
SHA256 92c957a099c6ff2a2004247a52f5103a4a6d8e0607065fade6a087c9bb7389e2
MD5 5fdf509584144b3fa5ae6ed79eb32cfe
SHA1 af57b9541738e7301af7661fd6d99813221135dc
SHA512 ff4e5cc047139ab74052c584d854f850804102ad99e3acefd24e47a40624c9d6cd467bf2b6970dc05726ed979cf86f4189a257ea12f3ea6da3137909fb20ae78
SSDEEP 49152:5yXCP7X3uQ3YlZfbM3DacNHHO0DZyL8x+2wmyrS5uDOzQazX7kfHWRHiaHSiBehl:wcKNZf8mGHVD5x+2wTRA4fHgCP
TLSH
T15516AF213FC1C43ED2630272D84DA35893F2D1B06E768557AAA9135D2F35EA3DE21E72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c2:51:47:0e:3f:f2:30:1f:fa:e9:fc:01:24:e0:9e:94:be:ce:76:97

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Chains

Dec 24, 2009

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Serial Number

75:8f:5e:e8:26:3b:66:94:71:9d:84:34:eb:99:86:08

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 31, 2007 - Nov 24, 2010

Minor OS version

Major OS version

Entry point

2411733

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

r:\depot_cont\ghost\gsstrunk\ghost\ghost\src\core\vs2005\win32\release\Ghost32.pdb

ws2_32

recvfrom WSASetLastError gethostname gethostbyname inet_ntoa WSACloseEvent WSACleanup WSAStartup WSACreateEvent WSASend WSAWaitForMultipleEvents WSAEnumNetworkEvents htonl listen htons inet_addr closesocket WSAEventSelect WSAGetLastError ioctlsocket shutdown setsockopt recv accept WSAAddressToStringA WSASocketA getsockopt getsockname send ntohl WSASendTo WSARecvFrom WSARecv WSAIoctl socket connect bind sendto

imm32

ImmDisableIME

imagehlp

ImageGetCertificateHeader ImageRemoveCertificate

kernel32

CreateFileA CloseHandle GetLocaleInfoA GetModuleFileNameA FreeLibrary GetProcAddress LoadLibraryA GetModuleHandleA GetLastError GetVersionExA IsValidCodePage IsDBCSLeadByteEx MultiByteToWideChar WideCharToMultiByte GetOEMCP GetConsoleCP GetConsoleOutputCP GetACP SystemTimeToFileTime FileTimeToSystemTime FileTimeToLocalFileTime LocalFileTimeToFileTime GetSystemTimeAsFileTime DebugBreak InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection IsDebuggerPresent DeleteCriticalSection InterlockedIncrement InterlockedDecrement OutputDebugStringA WriteFile SetFilePointer SetEndOfFile ReadFile GetStdHandle VirtualFree VirtualAlloc GetSystemInfo GetThreadContext VirtualQuery GetModuleHandleW FindResourceW LoadResource LoadLibraryW Sleep SizeofResource CreateFileW LockResource GetCurrentThreadId DeleteFileW ResumeThread CreateThread WaitForSingleObject SetEvent CreateEventW FindNextFileA GetFileAttributesW GetFileAttributesExA GetCurrentProcess GetVersionExW VirtualProtectEx GetLocalTime GetSystemTime GetStringTypeA GetLocaleInfoW GetFileAttributesA GetDiskFreeSpaceA CreateDirectoryA DeleteFileA RemoveDirectoryA MoveFileA GetBinaryTypeA GetFileInformationByHandle GetVolumeInformationA GetTickCount GetFullPathNameA GetCurrentDirectoryA GetDiskFreeSpaceW FindFirstFileA SetFileTime SetFileAttributesA LocalFree LocalAlloc BackupSeek BackupRead QueryPerformanceCounter QueryPerformanceFrequency CreateEventA ResetEvent InitializeCriticalSection DefineDosDeviceW GetCurrentThread IsBadWritePtr FormatMessageA GetCurrentProcessId RaiseException SetUnhandledExceptionFilter GlobalMemoryStatus FreeConsole DeviceIoControl HeapFree HeapAlloc GetProcessHeap FindClose VirtualLock SetProcessWorkingSetSize GetProcessWorkingSetSize VirtualUnlock SetErrorMode GetLogicalDriveStringsA SetLastError GetFileSize GetOverlappedResult InterlockedExchange InterlockedCompareExchange TerminateProcess UnhandledExceptionFilter RtlUnwind ExitProcess GetTimeFormatA GetDateFormatA SetConsoleCtrlHandler GetCommandLineA ExitThread LCMapStringA LCMapStringW GetCPInfo GetStringTypeW GetTimeZoneInformation TlsGetValue TlsAlloc TlsSetValue TlsFree SetHandleCount GetFileType GetStartupInfoA GetConsoleMode FlushFileBuffers FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetUserDefaultLCID EnumSystemLocalesA IsValidLocale SetStdHandle WriteConsoleA WriteConsoleW CompareStringA CompareStringW SetEnvironmentVariableA GetLogicalDrives GetDriveTypeA SetConsoleMode ReadConsoleInputA GetVolumePathNameW GetVolumeNameForVolumeMountPointW GetEnvironmentVariableW ReadProcessMemory GetDriveTypeW

rpcrt4

UuidCreate

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

user32

UnregisterClassA RegisterDeviceNotificationA KillTimer SetTimer ExitWindowsEx GetFocus SetFocus LoadCursorA FindWindowExW GetKeyboardState ToAscii PeekMessageA TranslateMessage DispatchMessageA ShowWindow GetKeyState ReleaseDC DestroyWindow GetCursorPos ScreenToClient SetWindowTextW RegisterClassA CreateWindowExA GetDC GetDesktopWindow GetWindowRect SetWindowPos AdjustWindowRect GetUpdateRect ValidateRect DefWindowProcA SetCursor

gdi32

SelectObject CreateSolidBrush GetPixel StretchDIBits CreatePalette SelectPalette RealizePalette DeleteObject

advapi32

RegUnLoadKeyW RegEnumValueW RegLoadKeyA RegUnLoadKeyA RegOpenKeyExA RegCreateKeyExA RegDeleteKeyA RegQueryValueExA RegLoadKeyW StartServiceW CreateServiceA ControlService StartServiceA OpenSCManagerA OpenServiceA DeleteService CloseServiceHandle LookupPrivilegeValueW OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyA SetFileSecurityW GetFileSecurityW RegCloseKey RegEnumKeyExW RegOpenKeyExW QueryServiceStatus OpenSCManagerW OpenServiceW RegCreateKeyExW RegDeleteKeyW RegSetValueExA RegQueryValueExW RegSetValueExW RegDeleteValueW RegQueryInfoKeyW RegGetKeySecurity RegSetKeySecurity RegEnumValueA RegEnumKeyExA RegQueryInfoKeyA RegDeleteValueA

ole32

CoSetProxyBlanket CoCreateInstance OleRun CoInitializeEx CoUninitialize CoInitialize CoInitializeSecurity CoTaskMemFree

oleaut32

SysAllocString SysFreeString SafeArrayDestroy SafeArrayAccessData

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_5fdf509584144b3fa5ae6ed79eb32cfe_elex_floxif_glassworm_stop

PE Signature issue

ws2_32

imm32

imagehlp

kernel32

rpcrt4

version

user32

gdi32

advapi32

ole32

oleaut32

generic