2026-08-09_d0c96b60d145b2e3dce1dac4821e58db_elex_floxif_glassworm_mafia_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_d0c96b60d145b2e3dce1dac4821e58db_elex_floxif_glassworm_mafia_remcos
Size 708KB
Sample260809-elyjgahj5x
SHA256 2e9438120f0774900930187b96a75e2b58eff1814ba993c0a60fcfee33030b1b
MD5 d0c96b60d145b2e3dce1dac4821e58db
SHA1 14093e3bbb65d341b2cd62c3f0ece43bf2f4f079
SHA512 f252e022bdb2f8db03b900ed560721c83fc782527a6ac4a55f6a64db528faacdd33d34d6629ae9fe727dbe6a72ca39eabee124982638b19a759eead69acea48a
SSDEEP 12288:uvN7t3cAhpLJt9LACJpBQidO72sZTsWbVKFFf3FRcow6JVBjvrEH7B:uNtMMtLnpFVsZTnbVy9FRcVKbrEH7B
TLSH
T1D4F4AE1E7AF0C272C1231230AE6ED35861F5A4B648264847BBDC635D1FB45D38B3AB67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_d0c96b60d145b2e3dce1dac4821e58db_elex_floxif_glassworm_mafia_remcos

File Explorer

2026-08-09_d0c96b60d145b2e3dce1dac4821e58db_elex_floxif_glassworm_mafia_remcos

.exe 708KB

2026-08-09_d0c96b60d145b2e3dce1dac4821e58db_elex_floxif_glassworm_mafia_remcos

IMPHASH 786d492994809809a8824667c8485518
SHA256 2e9438120f0774900930187b96a75e2b58eff1814ba993c0a60fcfee33030b1b
MD5 d0c96b60d145b2e3dce1dac4821e58db
SHA1 14093e3bbb65d341b2cd62c3f0ece43bf2f4f079
SHA512 f252e022bdb2f8db03b900ed560721c83fc782527a6ac4a55f6a64db528faacdd33d34d6629ae9fe727dbe6a72ca39eabee124982638b19a759eead69acea48a
SSDEEP 12288:uvN7t3cAhpLJt9LACJpBQidO72sZTsWbVKFFf3FRcow6JVBjvrEH7B:uNtMMtLnpFVsZTnbVy9FRcVKbrEH7B
TLSH
T1D4F4AE1E7AF0C272C1231230AE6ED35861F5A4B648264847BBDC635D1FB45D38B3AB67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

76:3b:16:36:b7:4c:e0:ea:13:f1:fc:77:74:02:80:b2:bf:20:62:c8:ff:37:a0:04:02:17:5c:09:29:72:3a:43

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US,1.2.840.113549.1.9.1=#0c14706b6961646d5f7573406f7261636c652e636f6d

Chains

Mar 12, 2020

CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US,1.2.840.113549.1.9.1=#0c14706b6961646d5f7573406f7261636c652e636f6d

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US,1.2.840.113549.1.9.1=#0c14706b6961646d5f7573406f7261636c652e636f6d

Serial Number

09:10:58:84:eb:95:9d:3b:c8:b9:94:f9:18:a7:b6:ee

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 7, 2020 - Jan 11, 2022

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

257875

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

IIDFromString StringFromGUID2 OleRun CLSIDFromString CoTaskMemAlloc CoTaskMemFree CoInitialize CoTaskMemRealloc CoUninitialize CoCreateInstance

shell32

Shell_NotifyIconA ShellExecuteA SHGetFolderPathW

wininet

InternetTimeFromSystemTime InternetTimeToSystemTime InternetCrackUrlA HttpQueryInfoA InternetConnectA InternetReadFile HttpOpenRequestA InternetErrorDlg HttpSendRequestA InternetOpenA InternetCloseHandle

user32

GetDesktopWindow SetWindowLongA CreateWindowExA PeekMessageA GetWindowLongA CharNextA wsprintfA DispatchMessageW RegisterClassA LoadImageA GetSystemMetrics DispatchMessageA PostMessageA AppendMenuA CreatePopupMenu ShowWindow MsgWaitForMultipleObjectsEx GetCursorPos DefWindowProcA MessageBoxA DestroyWindow GetMessageA GetMessageW PostQuitMessage TrackPopupMenu SetForegroundWindow LoadStringA TranslateMessage IsWindowUnicode

version

VerQueryValueW GetFileVersionInfoA GetFileVersionInfoSizeA

kernel32

FindFirstFileExW GetDriveTypeW FileTimeToLocalFileTime GetFullPathNameW CreateDirectoryW GetConsoleMode GetConsoleCP GetFileType GetStartupInfoW HeapSetInformation VirtualQuery GetSystemInfo GetModuleHandleW VirtualAlloc VirtualProtect HeapAlloc HeapFree DecodePointer EncodePointer GetStringTypeW InterlockedExchange SetStdHandle HeapReAlloc RtlUnwind LCMapStringW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime IsProcessorFeaturePresent GetTimeZoneInformation HeapCreate FindResourceA lstrcmpA lstrlenA FreeLibrary LoadResource SystemTimeToTzSpecificLocalTime InterlockedIncrement InterlockedDecrement WaitForSingleObject GetCommandLineA WideCharToMultiByte InitializeCriticalSectionAndSpinCount SizeofResource CreateEventA SetDllDirectoryA IsDBCSLeadByte lstrcatA MultiByteToWideChar lstrlenW RaiseException GetLastError lstrcmpiA GetProcAddress WaitForMultipleObjects GetModuleFileNameA GetStdHandle LoadLibraryExA CreateMutexA DeleteCriticalSection CloseHandle SetEvent ResetEvent CreateThread lstrcpyA lstrcpynA CreateFileA WriteFile Sleep OpenEventA GetCurrentProcess GetVersionExA GetTempPathA LocalFree DeleteFileA ReadFile FileTimeToSystemTime FormatMessageW GetLocalTime GetCurrentThreadId GetCurrentProcessId PeekNamedPipe SetHandleInformation GetExitCodeProcess CreateProcessA TerminateProcess CreatePipe ExitProcess GetLocaleInfoA FormatMessageA GetSystemDirectoryA FindClose LoadLibraryA LocalAlloc LockResource SetEndOfFile SetFilePointerEx GetNativeSystemInfo GetModuleHandleExW GetSystemDefaultUILanguage GetThreadLocale GetUserDefaultUILanguage GetTickCount GetModuleFileNameW SetLastError LoadLibraryExW OpenMutexA GetModuleHandleExA LoadLibraryW CreateFileW InitializeCriticalSection LeaveCriticalSection EnterCriticalSection HeapSize TlsAlloc TlsGetValue TlsSetValue TlsFree GetLocaleInfoW SetHandleCount SetFilePointer FlushFileBuffers GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetProcessHeap WriteConsoleW GetCurrentDirectoryW GetFileInformationByHandle GetUserDefaultLCID EnumSystemLocalesA IsValidLocale CompareStringW SetEnvironmentVariableA GetModuleHandleA GetFileAttributesA

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumKeyA CryptHashData CryptDestroyHash CryptCreateHash CryptAcquireContextA CryptReleaseContext RegQueryValueExA CryptGetHashParam SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegNotifyChangeKeyValue RegDeleteValueA RegOpenKeyExA RegCreateKeyExA RegEnumKeyExA RegDeleteKeyA RegQueryInfoKeyW RegSetValueExA

oleaut32

GetErrorInfo SysStringByteLen VarUI4FromStr SysFreeString SysAllocString VariantClear VariantInit VariantChangeType

shlwapi

ord12

gdi32

GetStockObject

crypt32

CryptStringToBinaryA CryptUnprotectData CryptProtectData CryptBinaryToStringA

msi

ord141 ord168 ord160 ord158 ord115 ord159 ord117 ord8 ord44 ord204 ord189 ord67 ord31 ord137 ord91

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_d0c96b60d145b2e3dce1dac4821e58db_elex_floxif_glassworm_mafia_remcos

PE Signature issue

ole32

shell32

wininet

user32

version

kernel32

advapi32

oleaut32

shlwapi

gdi32

crypt32

msi

generic