General
- Target 2026-08-18_5012646c34c1b02d439f4da840051433_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee
- Size 1.1MB
- Sample260818-wk361ayxfw
- SHA256 ffbb69e3e69302b1078bd232608be2cf0ad9c2fbf3795df7998749e6af89311c
- MD5 5012646c34c1b02d439f4da840051433
- SHA1 d9ba788100769d2e28c5d2f3f1d539f9a9d001a6
- SHA512 75820baf76afee6f71b0ef4d033669cc416f8dd5f82be2cfe9759d91c8753776626cbad20810017e01d01492c230e55322e14349c9b723e136e9fa5a9c664238
- SSDEEP 12288:fwKfOVRo9yRYcQgwzYDteYIpREn0tQa7XTfb:fxWVeyRYcjwzYDteYIp6TaPfb
- TLSH T1C745950277F89119F5F36F309DB942A4DA76BC526F39C64F3688324E1E71B809A21763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-18_5012646c34c1b02d439f4da840051433_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-18_5012646c34c1b02d439f4da840051433_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-18_5012646c34c1b02d439f4da840051433_elex_glassworm_remcos_smoke-loader_stealc_stop_tofsee
- Size 1.1MB
- SHA256 ffbb69e3e69302b1078bd232608be2cf0ad9c2fbf3795df7998749e6af89311c
- MD5 5012646c34c1b02d439f4da840051433
- SHA1 d9ba788100769d2e28c5d2f3f1d539f9a9d001a6
- SHA512 75820baf76afee6f71b0ef4d033669cc416f8dd5f82be2cfe9759d91c8753776626cbad20810017e01d01492c230e55322e14349c9b723e136e9fa5a9c664238
- SSDEEP 12288:fwKfOVRo9yRYcQgwzYDteYIpREn0tQa7XTfb:fxWVeyRYcjwzYDteYIp6TaPfb
- TLSH T1C745950277F89119F5F36F309DB942A4DA76BC526F39C64F3688324E1E71B809A21763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory