2026-08-09_31220a25afe1e2deef1cea9461283067_elex_glassworm_hawkeye_maze_remcos_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_31220a25afe1e2deef1cea9461283067_elex_glassworm_hawkeye_maze_remcos_stealc
Size 986KB
Sample260809-vj78wssdja
SHA256 3622c93df2ae9bd98e07a7d388c1481c8f0a90cea15ea0e80026ac26b155df37
MD5 31220a25afe1e2deef1cea9461283067
SHA1 3ba3f4f18faa5b0f836b4ea74368ec197313b3ec
SHA512 18e992956189dc9e50ea66b2b08cda859ba9259a0376b5749cd7c933a5e0c9d5420d190d3e18cde5668537c2b164ccdd938139001c0d441404b75a963ede2bd0
SSDEEP 24576:UzqSjHcq0X3AcEdT0vU2UNgXe4i7ojhsP5Lgrk1TWb4AN5:5a4wddTkUIe30jaNf1TWbdz
TLSH
T13C25F112B5809031D2B311B096EAAF31917D7DB0177648EBE7E8BD061A745C2FE32B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_31220a25afe1e2deef1cea9461283067_elex_glassworm_hawkeye_maze_remcos_stealc

File Explorer

2026-08-09_31220a25afe1e2deef1cea9461283067_elex_glassworm_hawkeye_maze_remcos_stealc

.exe 986KB

2026-08-09_31220a25afe1e2deef1cea9461283067_elex_glassworm_hawkeye_maze_remcos_stealc

IMPHASH e45266adb386243ee7864784adb0ed84
SHA256 3622c93df2ae9bd98e07a7d388c1481c8f0a90cea15ea0e80026ac26b155df37
MD5 31220a25afe1e2deef1cea9461283067
SHA1 3ba3f4f18faa5b0f836b4ea74368ec197313b3ec
SHA512 18e992956189dc9e50ea66b2b08cda859ba9259a0376b5749cd7c933a5e0c9d5420d190d3e18cde5668537c2b164ccdd938139001c0d441404b75a963ede2bd0
SSDEEP 24576:UzqSjHcq0X3AcEdT0vU2UNgXe4i7ojhsP5Lgrk1TWb4AN5:5a4wddTkUIe30jaNf1TWbdz
TLSH
T13C25F112B5809031D2B311B096EAAF31917D7DB0177648EBE7E8BD061A745C2FE32B5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

166610

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\rdm\projects\7075\out\Release\BugReport.exe.pdb

wininet

InternetCloseHandle HttpSendRequestW InternetOpenA HttpOpenRequestW HttpQueryInfoW InternetSetOptionW InternetConnectW InternetReadFile HttpSendRequestA

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

ws2_32

htons ntohl htonl ntohs

psapi

GetProcessMemoryInfo GetModuleFileNameExA

winmm

timeGetTime

shlwapi

PathFileExistsW PathRemoveBlanksW PathRemoveBackslashW

user32

DialogBoxParamW SetWindowTextW GetDlgCtrlID SendMessageW LoadStringW SetWindowPos EndDialog GetWindowThreadProcessId EnumChildWindows SendDlgItemMessageW GetDlgItem GetWindowTextW LoadIconW GetClassNameW EnumWindows GetGuiResources GetParent MessageBoxW BeginPaint DrawIconEx LoadImageW FillRect GetWindowRect ScreenToClient EndPaint

comctl32

InitCommonControlsEx ord17

kernel32

HeapReAlloc GetConsoleMode GetConsoleCP ExitProcess IsProcessorFeaturePresent OutputDebugStringW GetStringTypeW EncodePointer LoadLibraryExA SetStdHandle GetFileType RtlUnwind GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapSize IsValidCodePage GetACP GetOEMCP GetStdHandle LoadLibraryExW GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW ReadConsoleW GetDriveTypeW SetFilePointer CreateDirectoryW GetModuleHandleW GetTickCount InitializeCriticalSectionAndSpinCount ReadFile CreateFileW GetTempPathW RaiseException GetLastError GetProcAddress DecodePointer DeleteCriticalSection CloseHandle CreateFileA FindFirstFileW GetSystemTimeAsFileTime VirtualQueryEx WriteFile GetProcessTimes ReadProcessMemory lstrcpynW FindClose GetLocalTime OpenThread GetProcessId LocalAlloc GlobalMemoryStatusEx Module32FirstW FindNextFileW CreateToolhelp32Snapshot Module32NextW DeleteFileW LocalFree CreateProcessW HeapAlloc SetDllDirectoryW HeapFree WaitForSingleObject SetEvent GetProcessHeap OpenProcess SetCurrentDirectoryW VirtualProtect GetFileSize GetFileAttributesW GetCurrentThreadId GetCurrentProcessId WideCharToMultiByte MapViewOfFile UnmapViewOfFile CreateFileMappingW GetFullPathNameW GetPrivateProfileStringW Sleep RemoveDirectoryW lstrcmpiW FreeLibrary GetSystemDirectoryW LoadLibraryW GetVersionExW MultiByteToWideChar DeviceIoControl ExpandEnvironmentStringsW GetCurrentProcess InterlockedCompareExchange GetModuleHandleA CreateMutexW SetLastError ReleaseMutex LeaveCriticalSection EnterCriticalSection GetCurrentDirectoryW GetWindowsDirectoryW IsDebuggerPresent GetCommandLineW QueryPerformanceCounter InterlockedExchange QueryPerformanceFrequency SetFilePointerEx FlushFileBuffers GetModuleHandleExW TlsGetValue TlsSetValue TlsAlloc TlsFree GetModuleFileNameW GetNativeSystemInfo

gdi32

DeleteObject SetBkColor SetTextColor CreateSolidBrush CreateFontW

advapi32

RegDeleteKeyW TraceEvent RegQueryValueExW RegOpenKeyExW RegCloseKey RegQueryValueExA RegOpenKeyExA RegCreateKeyExW RegDeleteValueW RegEnumKeyExW RegSetValueExW

ole32

CoUninitialize CoCreateGuid CoCreateInstance OleUninitialize CoInitialize CoFreeUnusedLibrariesEx CoTaskMemFree OleInitialize

oleaut32

SysAllocString VariantInit VariantClear

netapi32

Netbios NetApiBufferFree NetWkstaTransportEnum

Name

.text

Size

269KB

Virtual Size

268KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_31220a25afe1e2deef1cea9461283067_elex_glassworm_hawkeye_maze_remcos_stealc

wininet

version

ws2_32

psapi

winmm

shlwapi

user32

comctl32

kernel32

gdi32

advapi32

ole32

oleaut32

netapi32

generic