2026-08-09_d8f05144070096000d6687afab7cd209_elex_floxif_glassworm_hijackloader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_d8f05144070096000d6687afab7cd209_elex_floxif_glassworm_hijackloader_stop
Size 7.0MB
Sample260809-fhr3ystyev
SHA256 7c8bfa0e6e17068387d5d127541397998f24d282601cf90c92f64965c91c0620
MD5 d8f05144070096000d6687afab7cd209
SHA1 8ea9b99833899033892f74f4febbfd173902d3cc
SHA512 4200489dcfbe013ab7646424bbadcde3637c1351625077b737e1ff950c26765623927aa0610cb4ae48f14d584138385df8c2ef2e9a6aa4f7a8a28ea74065a1fa
SSDEEP 196608:xa2vLHyZENKZbC+O05l8i+DHRDigS+HFD:1+oKI+dlgDjS+Hp
TLSH
T1687633163EF0E1BAD0B646B03967827599F2B83A0937D64F53A01B4C2E7C782D725376
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_d8f05144070096000d6687afab7cd209_elex_floxif_glassworm_hijackloader_stop

File Explorer

2026-08-09_d8f05144070096000d6687afab7cd209_elex_floxif_glassworm_hijackloader_stop

.exe 7.0MB

2026-08-09_d8f05144070096000d6687afab7cd209_elex_floxif_glassworm_hijackloader_stop

IMPHASH 2899c11b10fdc3af957eec3bbb5dcf84
SHA256 7c8bfa0e6e17068387d5d127541397998f24d282601cf90c92f64965c91c0620
MD5 d8f05144070096000d6687afab7cd209
SHA1 8ea9b99833899033892f74f4febbfd173902d3cc
SHA512 4200489dcfbe013ab7646424bbadcde3637c1351625077b737e1ff950c26765623927aa0610cb4ae48f14d584138385df8c2ef2e9a6aa4f7a8a28ea74065a1fa
SSDEEP 196608:xa2vLHyZENKZbC+O05l8i+DHRDigS+HFD:1+oKI+dlgDjS+Hp
TLSH
T1687633163EF0E1BAD0B646B03967827599F2B83A0937D64F53A01B4C2E7C782D725376
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

15:5a:fc:4e:f6:2c:e0:ff:c1:65:e2:d5:f8:37:b1:4c:f5:ef:28:80:5a:10:9f:21:75:3c:aa:96:7a:31:33:58

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

Chains

Oct 21, 2024

CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

PE Signature issue

Digest

49:52:61:e2:d5:c6:9e:0b:8d:61:ad:1b:4b:cb:2a:32:b1:71:61:33

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

Chains

Oct 21, 2024

CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

Serial Number

45:2d:ba:a0:52:13:f6:ea:e3:56:65:03:d3:5c:05:ad

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 28, 2023 - Mar 27, 2026

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

312276

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\devel\inst\bin.2008\xstub.pdb

kernel32

GetUserDefaultLCID InterlockedIncrement InterlockedDecrement lstrcmpiW LeaveCriticalSection RaiseException EnterCriticalSection MultiByteToWideChar InitializeCriticalSection DeleteCriticalSection SetErrorMode FlushInstructionCache SetCurrentDirectoryW MulDiv CopyFileW GetCurrentThreadId SetLastError CreateMutexW WritePrivateProfileStringW MoveFileW GetUserDefaultUILanguage GetVersion GetCurrentThread GlobalAlloc CreateThread SetUnhandledExceptionFilter GetCurrentProcessId WideCharToMultiByte InterlockedExchange lstrlenA GetSystemInfo ReadFile SetFilePointer SetFilePointerEx SetFileTime WriteFile IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetDateFormatA GetTimeFormatA GetModuleFileNameA GetStdHandle LCMapStringW GetEnvironmentStringsW FreeEnvironmentStringsW LoadLibraryExW IsValidCodePage GetOEMCP GetACP GetCPInfo HeapCreate TlsFree TlsSetValue TlsAlloc TlsGetValue GetStartupInfoW SetConsoleCtrlHandler IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime ExitThread VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetStringTypeW SetHandleCount GetFileType GetStartupInfoA RtlUnwind GetCommandLineW QueryPerformanceCounter InitializeCriticalSectionAndSpinCount LCMapStringA GetConsoleCP GetConsoleMode CompareStringW SetEnvironmentVariableA SetEnvironmentVariableW GetLocaleInfoW GetModuleHandleA SetStdHandle FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA CompareStringA Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalMemoryStatusEx GetFileSizeEx CreateFileW GetFileSize GetWindowsDirectoryW GetTempFileNameW GetTempPathW RemoveDirectoryW FindClose FindNextFileW SetFileAttributesW DeleteFileW FindFirstFileW GetStringTypeA GetExitCodeProcess CreateProcessW GetCurrentProcess GetProcAddress GetModuleHandleW lstrcpyW GetLastError GetFileAttributesW GetModuleFileNameW GlobalFree CreateDirectoryW GetSystemDirectoryW FreeLibrary LoadLibraryW lstrlenW ExitProcess FindResourceExW FindResourceW LoadResource LockResource SizeofResource TerminateThread GetTickCount Sleep CloseHandle GetExitCodeThread GetTimeZoneInformation WaitForSingleObject

user32

ReleaseCapture SetCapture TrackPopupMenuEx TrackMouseEvent UpdateWindow UnionRect SetWindowRgn GetPropW RegisterClassW RemovePropW SetPropW GetDesktopWindow GetWindowPlacement ClientToScreen InflateRect InvalidateRect PtInRect SetRect IsWindowEnabled SetScrollRange ScreenToClient SetScrollPos EnableWindow IsWindowVisible EndPaint BeginPaint DestroyWindow SetCursor SetRectEmpty DrawTextW GetSysColor ReleaseDC GetDC GetDlgItem GetFocus GetWindowTextLengthW GetWindowTextW SubtractRect IsRectEmpty IntersectRect AdjustWindowRectEx SetScrollInfo RegisterWindowMessageW SetTimer GetCursorPos AppendMenuW CreatePopupMenu SendMessageTimeoutW GetKeyState ShowWindow CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW KillTimer GetSystemMenu EnableMenuItem GetWindow MonitorFromWindow SetWindowPos SetWindowTextW LoadIconW PostQuitMessage PostMessageW CallWindowProcW DefWindowProcW GetWindowLongW SetWindowLongW MapWindowPoints GetClientRect TranslateAcceleratorW IsDialogMessageW GetNextDlgTabItem GetMessageW LoadAcceleratorsW CharNextW SetFocus GetParent MoveWindow EqualRect GetWindowRect OffsetRect MonitorFromPoint CopyRect GetSystemMetrics SystemParametersInfoW GetMonitorInfoW MonitorFromRect IsCharAlphaW SendMessageW FindWindowW MessageBoxW IsWindow DispatchMessageW TranslateMessage PeekMessageW GetWindowDC UnregisterClassA

gdi32

MoveToEx LineTo CreateRectRgn ExtTextOutW OffsetRgn CreateSolidBrush GetDeviceCaps SetBkColor ExcludeClipRect GetTextMetricsW SetBkMode GetStockObject SetWindowOrgEx CreateCompatibleBitmap SetTextColor CreateFontW BitBlt DeleteDC SelectObject CreateCompatibleDC CreateDIBSection DeleteObject GetObjectW

advapi32

EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken OpenThreadToken RegDeleteValueW RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyW RegCloseKey RegQueryValueExW RegOpenKeyExW FreeSid

shell32

SHGetPathFromIDListW ShellExecuteW SHBrowseForFolderW ord190 ord155 SHAppBarMessage ShellExecuteExW SHGetFolderPathW

ole32

CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoUninitialize

oleaut32

SysFreeString VariantInit SysAllocString VarUI4FromStr VariantClear

shlwapi

PathCanonicalizeW PathIsDirectoryW ord176

wininet

InternetReadFile InternetQueryDataAvailable InternetQueryOptionW HttpOpenRequestA HttpEndRequestW InternetWriteFile HttpSendRequestExW HttpSendRequestW InternetErrorDlg HttpQueryInfoW HttpAddRequestHeadersW InternetConnectA InternetSetOptionW InternetOpenW InternetCrackUrlA InternetCloseHandle

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_d8f05144070096000d6687afab7cd209_elex_floxif_glassworm_hijackloader_stop

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

generic