2026-08-10_79ed3f8e352c8768c096b7ad5998e46d_elex_glassworm

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

resource	yara_rule
sample	costura

resource
2026-08-10_79ed3f8e352c8768c096b7ad5998e46d_elex_glassworm
unpack001/costura.dll
unpack001/smblibrary.dll
unpack001/utilities.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 58b13b195453d0797959a134bffe3358982a729932bd4674e105f809744d00c1
MD5 79ed3f8e352c8768c096b7ad5998e46d
SHA1 3e8cf6d1666c46cf415341b17c8eadecc2aa8ea2
SHA512 74d682ec8d96f5368490a68c9f5e2cbbd26ecdd0de6f48c0583f418388f896967ac85d96fd2871851e1f1393be3829660cef1312c3eace345b33159ec027dea9
SSDEEP 12288:QfEYRogUo/e0iC9KhNTvO/74pBnkAfhJpjxrKjWK2:QcqogUo2UK7M8pBkItxu
TLSH
T1FCF4CF2413EC1F09E0BE1F36D5B5981886F3F412A4F5EB1E698994AE0F23749D920B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

758558

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Sec\sharpCertighost\sharpCertighost\obj\Release\net472\sharpCertighost.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
MD5 501981c7fc457d59238eb99780efb615
SHA1 f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
SHA512 5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
SSDEEP 48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
TLSH
T1F791A51097A8477BE9BB0FB6ACB3534A4275FA61DC27CB2F19C562172C123180A31F72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\198629\Source\Costura_Fody\src\Costura\obj\Release\netstandard1.0\Costura.pdb

costura.pdb

SHA256 89b13aa6efbc0b04745a00bb5fcf05b7a4e3537095bde974ed3490a9cf582d17
MD5 34b42a5776a3ad022b429124d55e576d
SHA1 6c6000a5eaf8579850ab82a89bd6268776eb51ad
SHA512 c24bf10e1d95a07fcd65c1f7841d2d4bdf25c5db02f5f4912286c8d6c077fe8bd3fc564cb249cb4ae01aed10889f25cc22a48bd9698499ed556560d0621a64f4
TLSH
T1F35193776F04C291ED9884B28513DA492B3047127602EE7AE9E51B05CCFFDF8077286B
MD5 SHA1 SHA512 TLSH

Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

smblibrary.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4bb8effcef418efedf287227416cd8a2e586e3b29edf89bf385c5ec55facb667
MD5 1b17e53ccba612c2c08fbc93e799bc37
SHA1 d53d9845f4b700f9d80c8ac53e3672fa73498e20
SHA512 dd0ec6d4d56795e52dd0cc78b5749b091215a5a61bee59772a9adf9cf9c55310ea30d103b539e1cecb6eaa321ae43923ccbaa646c2524f5020d99481c07e2b10
SSDEEP 6144:q4r8TmsjaMoEJWUasOUaUllVGRyANDxIVBdp8nUsGbMWcgugS+nJr5cvXv:ImWaE/l1ANoB8nUlbJxW
TLSH
T12A844C566BE81623D1BF93B1E0712C16C7F6F84A936BF34E1A40DAB66C637949810733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

409038

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\Sec\sharpCertighost\refs\SMBLibrary\SMBLibrary\obj\net40\Release\net40\SMBLibrary.pdb

smblibrary.pdb

SHA256 c862944a8bfa383282b295e68bd321383d0fa34cf745d723e81d99b957abf26f
MD5 3f08cb92d771d7ee91be2bed15d296be
SHA1 040941f50c12fbf430a15802faefff9e13e5f80c
SHA512 173b411bb34ccf5fe2a8a38d50782e363f678c5f316944a5f8f16714c61307f0f588e4b67e9ed799481736122f15387a5681e6913b0aca2dab4cfa7751c26093
SSDEEP 1536:+1oqL3y1MpynINSNJtu1b3iRHoBQ8UPgXz9JxXRNDMJ44RCjqnuHCxV1jgo/BwnK:NaiNIN8dRHd8nrNDM19XBj4zyQu96g
TLSH
T18E241992CAA48A1FC619267A91FB436ABFF1D0469146CF4371ACB3B37CB1B4484D7718
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

system.diagnostics.diagnosticsource.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d22133818a30313e0becf010d78a556a56b34ea361dbd33588c9817631fed540
MD5 8d9df432109f1cfdd86723b5f171e3d7
SHA1 85dc92edd4b0049ed9049e075c4def8a3d64e43b
SHA512 5c83303934eecfa61c43a071d29c98e5804d37a5dc7f7b035772d6a168b0c5e65dfabef20b46214e65493c4bda44831cafee83615498fbe9e718c884f4650edf
SSDEEP 384:iQobG82oiaPaf/gn5LQ0+0zdQUv2CtyW8fiFISWbW9pWJbWivT1Nq0GftpBjAvnC:nA299fI5dxzL2CC11vimvnEBBNFT
TLSH
T145F25B54EBAC8953DEE71D3062A4D9423A3AEB936C10C25E2699E18D0D83BD1EB11737
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

d6:fb:4d:67:72:14:08:d2:75:46:a0:06:cb:be:f9:d3:5f:db:20:bd:97:db:cd:de:3c:cd:a0:78:2f:b1:93:7f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

bc:c6:7a:ba:4c:c6:19:72:95:75:c0:52:c5:b2:9c:4b:5f:0f:69:2e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:a1:a5:fd:b9:ee:a7:fc:9e:9d:00:00:00:00:00:a1

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

0

Major OS version

4

Entry point

24690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Diagnostics.DiagnosticSource\System.Diagnostics.DiagnosticSource.pdb

utilities.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d72ef3db663dc50e3ac15130fd7cae1ed7ec04619e12f303da197b3869e12d44
MD5 46983ab94045694c5a93d5728efb2e19
SHA1 6857e5d2337020e2b8e8f1daa07d081c46697a6c
SHA512 9f003c6f30cbf15d2dafd5580873818b591113fdd988889655667afc64b07e49ec3d7130d1f52870651d450a86fa58c4f62ad48b91f82a903a742ff10c72c9e3
SSDEEP 768:nZ+HaHg54HiSFGTwQxgHrLHckhWHLoLYQZI1YtniUrUrjCg1OCFS:nkgHPH3haUYQ4YtnhrUvCg1OR
TLSH
T1B1D2C409BBD4B621CBBE47F6D633034AE770E244D953EB9B3A58D57928063BC18463D2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

36718

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\Sec\sharpCertighost\refs\SMBLibrary\Utilities\obj\net40\Release\net40\Utilities.pdb

utilities.pdb

SHA256 b86b0816d5de781fd3320dc777c1bb74c9d9ae5d121eefae889ea42efaa281fb
MD5 bbb2c43ee905e677996d1897edcb5d92
SHA1 b308d402a5fa75d628bc9e5a09173dc617ed7103
SHA512 efa45574a633ea7860a9636d2c78e7ccdea512a8d064cc7db635fa7a2bd3a27cb63765e58d7f85e84f35edd665b942f3609a30af3d9ce27076f074aeb0d28480
SSDEEP 384:pHvbWAg14uFAKtCrup9rdQPuorwvybupbu8BA2vL2+gRY:1vRVCCrg9rdQPuXpTBqY
TLSH
T1FF82D513D185CF25CE271B3785F242197771E428879B8F1752B4BB396C8BB886EE2349
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer