2026-08-09_2f976bec5bfa6cbfdefaf8541fd19967_glassworm_helldown_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_2f976bec5bfa6cbfdefaf8541fd19967_glassworm_helldown_remcos
Size 642KB
Sample260809-vkja6abe53
SHA256 a2aa5b71cbd5e84e83d20099b5fc0e7e25806c3156e6a070bd2dd556d14afd69
MD5 2f976bec5bfa6cbfdefaf8541fd19967
SHA1 0e9511318b326a80968a0cfbe0aa13f207c8db6a
SHA512 b661fe565bf5aaa0606c72a2826286b6f1d3f578ecda8e9bc52381a3316f9a15309bf63449146d766dc7ed14a1c6aac60f3d646502aa68d22cbf1f5cc8be7260
SSDEEP 12288:TOg7dUx2rgtteW1u0/dGpYQx4SfNxRWQCzjDp7el/o+:bRUx2rgtteW1u0/dkx3flCzvBko+
TLSH
T1F2E42913F29360FCC667C174825B6773FA62F85911307E3B1694DE312E65E90AB2DB28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_2f976bec5bfa6cbfdefaf8541fd19967_glassworm_helldown_remcos

File Explorer

2026-08-09_2f976bec5bfa6cbfdefaf8541fd19967_glassworm_helldown_remcos

.exe 642KB

2026-08-09_2f976bec5bfa6cbfdefaf8541fd19967_glassworm_helldown_remcos

IMPHASH ea86576170920a3317334ecaa9a0fa43
SHA256 a2aa5b71cbd5e84e83d20099b5fc0e7e25806c3156e6a070bd2dd556d14afd69
MD5 2f976bec5bfa6cbfdefaf8541fd19967
SHA1 0e9511318b326a80968a0cfbe0aa13f207c8db6a
SHA512 b661fe565bf5aaa0606c72a2826286b6f1d3f578ecda8e9bc52381a3316f9a15309bf63449146d766dc7ed14a1c6aac60f3d646502aa68d22cbf1f5cc8be7260
SSDEEP 12288:TOg7dUx2rgtteW1u0/dGpYQx4SfNxRWQCzjDp7el/o+:bRUx2rgtteW1u0/dkx3flCzvBko+
TLSH
T1F2E42913F29360FCC667C174825B6773FA62F85911307E3B1694DE312E65E90AB2DB28
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AccessCheck GetNamedSecurityInfoA GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation GetUserNameA LookupAccountSidA MapGenericMask RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegGetValueA RegOpenKeyExA RegQueryValueExA RegSaveKeyA RegSetValueExA

bcrypt

BCryptGenRandom

kernel32

AllocConsole CloseHandle CopyFileA CreateDirectoryA CreateEventA CreateFileA CreateFileMappingW CreateFileW CreatePipe CreateProcessA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DeleteProcThreadAttributeList EnterCriticalSection ExitProcess FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileA FindNextFileA FreeConsole FreeLibrary GetConsoleWindow GetCurrentDirectoryA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetFileAttributesA GetFileSizeEx GetLastError GetLocalTime GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetSystemDirectoryA GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathA GetTickCount GetVersionExA HeapAlloc HeapFree InitializeCriticalSection InitializeProcThreadAttributeList IsDBCSLeadByte IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryA LocalFree Module32First Module32Next MoveFileExA MultiByteToWideChar OpenProcess PeekNamedPipe Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency ReadFile RemoveDirectoryA SetCurrentDirectoryA SetEvent SetHandleInformation SetStdHandle SetUnhandledExceptionFilter Sleep TerminateProcess TerminateThread Thread32First Thread32Next TlsGetValue UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WaitNamedPipeW WideCharToMultiByte WriteFile

api-ms-win-crt-convert-l1-1-0

mbrtowc strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file remove

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove strchr strrchr strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _seh_filter_exe _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsnprintf_s __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf _write fclose ferror fflush fgets fopen fputc fread fseek ftell fwrite putchar puts setbuf setvbuf

api-ms-win-crt-string-l1-1-0

_strdup _strdup _stricmp _strnicmp memset strcmp strlen strncat strncmp strncpy strnlen strtok tolower toupper wcslen wcsncpy wcsnlen

api-ms-win-crt-time-l1-1-0

_gmtime64_s

api-ms-win-crt-utility-l1-1-0

rand rand_s srand

netapi32

NetApiBufferFree

ole32

CoCreateInstance CoGetObject CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoUninitialize

oleaut32

SafeArrayAccessData SafeArrayCreate SafeArrayPutElement SafeArrayUnaccessData SysAllocString SysAllocStringLen SysFreeString VariantClear VariantInit

user32

ShowWindow

wldap32

ldap_bind_s ldap_first_entry ldap_get_values ldap_init ldap_msgfree ldap_next_entry ldap_search_s ldap_set_option ldap_unbind ldap_value_free

ws2_32

WSAGetLastError WSAStartup __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo getsockopt htons ioctlsocket listen ntohs recv select send setsockopt socket

Name

.text

Size

476KB

Virtual Size

476KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.run

Size

1024B

Virtual Size

704B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

832B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

119KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_2f976bec5bfa6cbfdefaf8541fd19967_glassworm_helldown_remcos

advapi32

bcrypt

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

netapi32

ole32

oleaut32

user32

wldap32

ws2_32

generic