2026-08-09_b91996b3f8927493f9a95a562236a8cb_elex_glassworm_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_b91996b3f8927493f9a95a562236a8cb_elex_glassworm_stop
Size 162KB
Sample260809-hadlpssdkg
SHA256 a224280c101ae156283bc0049ce5bb74a4d45d989d4cb09eeff310120bea10a0
MD5 b91996b3f8927493f9a95a562236a8cb
SHA1 dadb2ffe3411afbd612cfd6ac289822a90e07fed
SHA512 a968146b0fb1832da31bb5c250d7d510c9dad9732af38aab5fdee26ad4fe00f2d1764d2b0feb00f41072b2f291b0868715faab28481bd338e9321b0c2f92c33f
SSDEEP 1536:7DRvXCho9P/brhD5/VJ7EGabMqkoHfrDI6sXwlj536lX8QcN/EqyQ+Imm2725BOi:7DJChodN5/zgGk+o2wamFeX725BO1Q
TLSH
T193F39E3533E58072E53301B49DE2DA759A7ABC345B32999BAFD00F4E2A35692D339703
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many email and collaboration clients. Observed in information steale 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_b91996b3f8927493f9a95a562236a8cb_elex_glassworm_stop

File Explorer

2026-08-09_b91996b3f8927493f9a95a562236a8cb_elex_glassworm_stop

.exe 162KB

2026-08-09_b91996b3f8927493f9a95a562236a8cb_elex_glassworm_stop

IMPHASH bab016171ab24d9fc5329a895f5e0097
SHA256 a224280c101ae156283bc0049ce5bb74a4d45d989d4cb09eeff310120bea10a0
MD5 b91996b3f8927493f9a95a562236a8cb
SHA1 dadb2ffe3411afbd612cfd6ac289822a90e07fed
SHA512 a968146b0fb1832da31bb5c250d7d510c9dad9732af38aab5fdee26ad4fe00f2d1764d2b0feb00f41072b2f291b0868715faab28481bd338e9321b0c2f92c33f
SSDEEP 1536:7DRvXCho9P/brhD5/VJ7EGabMqkoHfrDI6sXwlj536lX8QcN/EqyQ+Imm2725BOi:7DJChodN5/zgGk+o2wamFeX725BO1Q
TLSH
T193F39E3533E58072E53301B49DE2DA759A7ABC345B32999BAFD00F4E2A35692D339703
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables referencing many email and collaboration clients. Observed in information steale
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

80707

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetDiskFreeSpaceExW FindVolumeClose FindFirstVolumeW GetVersionExW FindNextVolumeW LocalFree LocalAlloc CreateNamedPipeW GetCommandLineW ReleaseMutex CreateMutexW FileTimeToSystemTime GetVolumeInformationW GetDriveTypeW OpenMutexW ExpandEnvironmentStringsW MapViewOfFile UnmapViewOfFile CreateFileMappingW GetFileSize GetCurrentThreadId GlobalLock GlobalUnlock SetCurrentDirectoryW FileTimeToLocalFileTime GetVolumePathNamesForVolumeNameW FindNextVolumeMountPointW GetCurrentDirectoryW FindVolumeMountPointClose FindFirstVolumeMountPointW GetOEMCP HeapCompact GetStringTypeW GetStringTypeA RtlUnwind LoadLibraryA VirtualAlloc GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter VirtualFree HeapDestroy GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA GetStdHandle IsDebuggerPresent UnhandledExceptionFilter TerminateProcess LCMapStringW WideCharToMultiByte LCMapStringA IsValidCodePage GetCPInfo HeapSize InterlockedDecrement InterlockedIncrement TlsFree HeapReAlloc SetLastError HeapCreate GetVolumeNameForVolumeMountPointW GetFileSizeEx SetFilePointer CreateFileW ReadFile GetFileAttributesW SetFileAttributesW DeleteFileW GetSystemWow64DirectoryW GetSystemDirectoryW GetProcAddress FindNextFileW WriteFile SetFileTime CreateToolhelp32Snapshot Process32NextW Process32FirstW MoveFileW SetUnhandledExceptionFilter FreeConsole CopyFileW ExitProcess CreateProcessW FreeLibrary SetErrorMode lstrlenA SetThreadPriority GetCurrentThread GetTickCount lstrcmpW GetModuleHandleW GetACP FindFirstFileW SleepEx GetSystemTime GetLocalTime FindClose SystemTimeToFileTime GetCurrentProcess GetExitCodeThread ExitThread CloseHandle WaitForSingleObject TerminateThread CreateThread Sleep GetWindowsDirectoryW GetEnvironmentVariableW GetTempPathW lstrcatW lstrlenW GetModuleFileNameW GetComputerNameW TlsSetValue TlsAlloc TlsGetValue GetModuleHandleA RaiseException GetStartupInfoA GetProcessHeap GetVersionExA GetCommandLineA lstrcpyW IsBadReadPtr GetLastError MultiByteToWideChar lstrcpynW LoadLibraryW lstrcmpiW GetLocaleInfoA

user32

DestroyWindow SetWindowLongW PostQuitMessage PeekMessageW GetMessageW DispatchMessageW ToUnicodeEx GetAsyncKeyState GetWindowThreadProcessId GetKeyboardLayout GetForegroundWindow GetKeyboardState RegisterRawInputDevices GetRawInputData GetWindowTextW GetProcessWindowStation GetUserObjectInformationW SetThreadDesktop CharLowerW wsprintfA wsprintfW GetKeyboardType DefWindowProcW RegisterClassExW UnregisterDeviceNotification CreateWindowExW ShowWindow GetThreadDesktop GetWindowRect GetDesktopWindow RegisterDeviceNotificationW GetKeyboardLayoutNameW OpenClipboard CloseClipboard GetClipboardData SetProcessWindowStation SendMessageW GetDC ReleaseDC

gdi32

DeleteObject GetDIBits CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteDC SelectObject

advapi32

CryptAcquireContextW LookupPrivilegeValueW OpenProcessToken AdjustTokenPrivileges OpenServiceW CloseServiceHandle OpenSCManagerW LookupAccountSidA QueryServiceStatus CryptHashData CryptGetHashParam CryptReleaseContext CryptDestroyHash CryptDestroyKey CryptSetKeyParam CryptCreateHash CryptEncrypt CryptImportKey SetEntriesInAclW OpenThreadToken SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExW RegQueryInfoKeyW RegCloseKey RegOpenKeyW RegQueryValueExW RegCreateKeyExW RegEnumKeyW GetTokenInformation RegOpenKeyExW RegEnumValueW GetUserNameW FreeSid AllocateAndInitializeSid CheckTokenMembership ChangeServiceConfigW CryptGenRandom StartServiceW

shell32

SHGetFolderPathW CommandLineToArgvW ShellExecuteExW

ole32

IIDFromString CoInitializeSecurity CoUninitialize CoInitialize CoCreateInstance StringFromIID CoTaskMemFree

oleaut32

VariantInit VariantChangeType VariantClear SysAllocString

rpcrt4

UuidCreate UuidToStringW RpcStringFreeW

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

secur32

GetComputerObjectNameW

wininet

InternetGetLastResponseInfoW InternetGetConnectedState

ws2_32

WSACleanup WSAStartup

shlwapi

PathRemoveFileSpecW PathAppendW PathAddBackslashW StrStrA

crypt32

CertCloseStore CertOpenStore PFXExportCertStoreEx CryptUnprotectData

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_b91996b3f8927493f9a95a562236a8cb_elex_glassworm_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

rpcrt4

wtsapi32

secur32

wininet

ws2_32

shlwapi

crypt32

generic