2026-08-16_9138c927e78935b56a143aef6934a5ce_chir_elex_glassworm_kwampirs_mafia_remcos_rhadamanthys_stealc_tofsee

General

Target
2026-08-16_9138c927e78935b56a143aef6934a5ce_chir_elex_glassworm_kwampirs_mafia_remcos_rhadamanthys_stealc_tofsee
Size 1.8MB
Sample260816-3dheaabr21
SHA256 010ad3a9f01ace808c705485935e1e06104cc3b1c504b3c8c79c51d854c793be
MD5 9138c927e78935b56a143aef6934a5ce
SHA1 b77f579cea0aeeac94a0e5334cee2b39de33b34d
SHA512 efb99ba7c3ffdac7cd0c6f8beb8e3530047ff961f5758d65daf7d7fa993677a31a0db3c0da42a2e98c5910d9c6b391176080940b23a978c1d5a444491b25efe7
SSDEEP 49152:6W4qyth5s9/2QFbayjUawj+n6z41uoT2gvCD54tVx6Xly:99/2QFbXUdj+n6z413Q45
TLSH
T1C0859D1277D5D036F5B312319DB99268A97ABCA18A35849FB3CD131E4F706D18E32B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-16_9138c927e78935b56a143aef6934a5ce_chir_elex_glassworm_kwampirs_mafia_remcos_rhadamanthys_stealc_tofsee

File Explorer

2026-08-16_9138c927e78935b56a143aef6934a5ce_chir_elex_glassworm_kwampirs_mafia_remcos_rhadamanthys_stealc_tofsee

.exe 1.8MB

2026-08-16_9138c927e78935b56a143aef6934a5ce_chir_elex_glassworm_kwampirs_mafia_remcos_rhadamanthys_stealc_tofsee

IMPHASH 1ca0524118d0fda0a70479ae0d39af0f
SHA256 010ad3a9f01ace808c705485935e1e06104cc3b1c504b3c8c79c51d854c793be
MD5 9138c927e78935b56a143aef6934a5ce
SHA1 b77f579cea0aeeac94a0e5334cee2b39de33b34d
SHA512 efb99ba7c3ffdac7cd0c6f8beb8e3530047ff961f5758d65daf7d7fa993677a31a0db3c0da42a2e98c5910d9c6b391176080940b23a978c1d5a444491b25efe7
SSDEEP 49152:6W4qyth5s9/2QFbayjUawj+n6z41uoT2gvCD54tVx6Xly:99/2QFbXUdj+n6z413Q45
TLSH
T1C0859D1277D5D036F5B312319DB99268A97ABCA18A35849FB3CD131E4F706D18E32B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c7:9a:0f:a0:4d:d2:42:e2:07:2f:6b:2e:75:e2:c5:53:24:c4:0e:52

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Oracle America\, Inc.,OU=Code Signing Bureau,O=Oracle America\, Inc.,L=Redwood Shores,ST=California,C=US

Chains

Dec 20, 2017

CN=Oracle America\, Inc.,OU=Code Signing Bureau,O=Oracle America\, Inc.,L=Redwood Shores,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Oracle America\, Inc.,OU=Code Signing Bureau,O=Oracle America\, Inc.,L=Redwood Shores,ST=California,C=US

Serial Number

12:f0:27:7e:0f:23:3b:39:f9:41:9b:06:e8:cd:e3:52

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 14, 2015 - Apr 13, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

1

Major OS version

5

Entry point

1883200

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcess GetModuleHandleExW GetSystemDirectoryA GetModuleFileNameA GetTempPathA LocalFree CreateFileA MoveFileExA GetTickCount GetFileAttributesA FindFirstFileA SetLastError RemoveDirectoryA SetFileAttributesA FindClose FindNextFileA CloseHandle DeleteFileA Sleep FormatMessageW GetLocalTime GetCurrentThreadId GetCurrentProcessId FindResourceA LoadResource SizeofResource LockResource WideCharToMultiByte MultiByteToWideChar InterlockedDecrement FreeLibrary LoadLibraryW InterlockedIncrement InterlockedExchange GetStringTypeW DecodePointer InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleHandleW ExitProcess HeapFree GetCommandLineA HeapSetInformation GetStartupInfoW GetFileType WriteFile GetConsoleCP GetConsoleMode GetModuleHandleA RtlUnwind HeapAlloc LCMapStringW GetCPInfo TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount GetLocaleInfoW TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle GetModuleFileNameW HeapCreate FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount QueryPerformanceCounter GetSystemTimeAsFileTime ReadFile SetFilePointer FlushFileBuffers HeapSize SetStdHandle SetEndOfFile GetProcessHeap WriteConsoleW GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapReAlloc CreateFileW GetProcAddress GetLastError CreateDirectoryA CreateProcessA SetDllDirectoryA GetExitCodeProcess WaitForSingleObject GetModuleHandleExA EncodePointer RaiseException

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_9138c927e78935b56a143aef6934a5ce_chir_elex_glassworm_kwampirs_mafia_remcos_rhadamanthys_stealc_tofsee

PE Signature issue

kernel32

advapi32

generic