General
- Target 2026-08-16_6e8888891eb36a29a938efe926f033a1_elex_expiro_glassworm_hawkeye_maze_remcos_stealc
- Size 1.7MB
- Sample260816-ms8l1scg76
- SHA256 09c5f23674cc5acf67a991bdc2e4d3232b18de462b1a26a682b7f6b68bea5785
- MD5 6e8888891eb36a29a938efe926f033a1
- SHA1 066d7eda95f6286975cb911c77a5d3b95ecbd819
- SHA512 f7618155cf9f26dcdc3687cfbea08ebc58cf66515c3a497c26e6ec5fee4558287562aadad1261aca8ceca97904c69facd6e3cc8fbc881452796b0c9c2839c44c
- SSDEEP 24576:hzqSjHcq/X3AcEdT0vU2UHsqjnhMgeiCl7G0nehbGZpbD:Ya5wddTkUbDmg27RnWGj
- TLSH T18C85F022B1809031D17210B48BAAEF25547E7D701B7608E7F7E8BD5A2A705C2EF36B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_6e8888891eb36a29a938efe926f033a1_elex_expiro_glassworm_hawkeye_maze_remcos_stealc.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-16_6e8888891eb36a29a938efe926f033a1_elex_expiro_glassworm_hawkeye_maze_remcos_stealc
- Size 1.7MB
- SHA256 09c5f23674cc5acf67a991bdc2e4d3232b18de462b1a26a682b7f6b68bea5785
- MD5 6e8888891eb36a29a938efe926f033a1
- SHA1 066d7eda95f6286975cb911c77a5d3b95ecbd819
- SHA512 f7618155cf9f26dcdc3687cfbea08ebc58cf66515c3a497c26e6ec5fee4558287562aadad1261aca8ceca97904c69facd6e3cc8fbc881452796b0c9c2839c44c
- SSDEEP 24576:hzqSjHcq/X3AcEdT0vU2UHsqjnhMgeiCl7G0nehbGZpbD:Ya5wddTkUbDmg27RnWGj
- TLSH T18C85F022B1809031D17210B48BAAEF25547E7D701B7608E7F7E8BD5A2A705C2EF36B57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1