2026-08-24_6cb0ee2eaacb915b0c91fd5cbc510f78_elex_glassworm_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-24_6cb0ee2eaacb915b0c91fd5cbc510f78_elex_glassworm_stop
Size 1.8MB
Sample260825-m4fqda1bpc
SHA256 f9fde1a44d9545f52c5d04fb1ea4067e7e24673e462204088cc5d2c7ff4783f7
MD5 6cb0ee2eaacb915b0c91fd5cbc510f78
SHA1 bc78670ed795e577c2ebc1b4d25be84c7e504f18
SHA512 1d5b32c21e93ae4eddddb43cab103c0e60d9fcddcd0b6d0d50c90f7c5c017b7c1d359b46c792f5695a07261f2ca67f3524c35cd852e223048d1d5317d3769e83
SSDEEP 3072:2MYdsQTuj39kc8ca/2nWYYxB4enYyp+eEshE3AOQqt7t5GS6W:jYdsQTuj39J8cvW94iEX7mS
TLSH
T18E959E3331D2C073E96305744DF2CA75A67BBC254B36895BABD00F0E6E72692963A713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many email and collaboration clients. Observed in information steale 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-24_6cb0ee2eaacb915b0c91fd5cbc510f78_elex_glassworm_stop

File Explorer

2026-08-24_6cb0ee2eaacb915b0c91fd5cbc510f78_elex_glassworm_stop

.exe 1.8MB

2026-08-24_6cb0ee2eaacb915b0c91fd5cbc510f78_elex_glassworm_stop

IMPHASH 9c6c0cb3aa4c2bf833869898ad4c8368
SHA256 f9fde1a44d9545f52c5d04fb1ea4067e7e24673e462204088cc5d2c7ff4783f7
MD5 6cb0ee2eaacb915b0c91fd5cbc510f78
SHA1 bc78670ed795e577c2ebc1b4d25be84c7e504f18
SHA512 1d5b32c21e93ae4eddddb43cab103c0e60d9fcddcd0b6d0d50c90f7c5c017b7c1d359b46c792f5695a07261f2ca67f3524c35cd852e223048d1d5317d3769e83
SSDEEP 3072:2MYdsQTuj39kc8ca/2nWYYxB4enYyp+eEshE3AOQqt7t5GS6W:jYdsQTuj39J8cvW94iEX7mS
TLSH
T18E959E3331D2C073E96305744DF2CA75A67BBC254B36895BABD00F0E6E72692963A713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables referencing many email and collaboration clients. Observed in information steale
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

104883

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\botgenstudio\generations\55ff7700\bin\Bot.pdb

kernel32

InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GlobalFree GetVersionExW LocalFree LocalAlloc CreateNamedPipeW GetCommandLineW ReleaseMutex CreateMutexW FileTimeToSystemTime GetVolumeInformationW GetDriveTypeW OpenMutexW ExpandEnvironmentStringsW GetFileSize MapViewOfFile UnmapViewOfFile CreateFileMappingW CreateDirectoryW RemoveDirectoryW GetCurrentThreadId GlobalUnlock GlobalLock GetFileTime WideCharToMultiByte SetCurrentDirectoryW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindNextVolumeMountPointW GetCurrentDirectoryW FindVolumeMountPointClose FindFirstVolumeMountPointW FindVolumeClose GetOEMCP GetDiskFreeSpaceExW FileTimeToLocalFileTime FindFirstVolumeW HeapFree GetLocaleInfoA GetStringTypeW GetStringTypeA RtlUnwind LoadLibraryA VirtualAlloc GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter VirtualFree HeapDestroy GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA GetStdHandle IsDebuggerPresent UnhandledExceptionFilter TerminateProcess LCMapStringW LCMapStringA IsValidCodePage GetCPInfo HeapSize InterlockedDecrement InterlockedIncrement TlsFree TlsSetValue TlsAlloc HeapAlloc HeapCompact HeapReAlloc SetLastError HeapCreate GetVolumeNameForVolumeMountPointW GetFileSizeEx SetFilePointer CreateFileW ReadFile GetFileAttributesW SetFileAttributesW DeleteFileW GetSystemWow64DirectoryW GetSystemDirectoryW FindNextFileW WriteFile SetFileTime CreateToolhelp32Snapshot Process32NextW GetProcAddress Process32FirstW MoveFileW SetUnhandledExceptionFilter FreeConsole CopyFileW ExitProcess CreateProcessW FreeLibrary SetErrorMode lstrlenA SetThreadPriority GetCurrentThread GetTickCount lstrcmpW GetModuleHandleW GetACP FindFirstFileW SleepEx GetSystemTime GetLocalTime FindClose SystemTimeToFileTime GetCurrentProcess GetExitCodeThread ExitThread CloseHandle WaitForSingleObject TerminateThread CreateThread Sleep GetWindowsDirectoryW GetEnvironmentVariableW GetTempPathW lstrcatW lstrlenW TlsGetValue GetModuleHandleA RaiseException GetStartupInfoA GetProcessHeap GetVersionExA GetCommandLineA GetModuleFileNameW GetComputerNameW lstrcpyW IsBadReadPtr GetLastError MultiByteToWideChar lstrcpynW LoadLibraryW lstrcmpiW

user32

PostQuitMessage GetForegroundWindow GetKeyboardState RegisterRawInputDevices GetRawInputData GetWindowTextW ToUnicodeEx GetAsyncKeyState GetWindowThreadProcessId GetKeyboardLayout SetWindowLongW GetThreadDesktop GetWindowRect GetDesktopWindow SetProcessWindowStation ReleaseDC GetDC GetProcessWindowStation GetUserObjectInformationW CloseClipboard OpenClipboard GetClipboardData SetThreadDesktop SystemParametersInfoW CharLowerW wsprintfA wsprintfW GetKeyboardType PeekMessageW GetMessageW DispatchMessageW DefWindowProcW RegisterClassExW UnregisterDeviceNotification CreateWindowExW ShowWindow GetKeyboardLayoutNameW SetForegroundWindow LockSetForegroundWindow RegisterDeviceNotificationW

gdi32

CreateCompatibleBitmap CreateCompatibleDC SelectObject BitBlt DeleteDC GetDIBits DeleteObject

advapi32

ChangeServiceConfigW LookupPrivilegeValueW OpenProcessToken AdjustTokenPrivileges OpenServiceW CloseServiceHandle CryptAcquireContextW OpenSCManagerW LookupAccountSidA QueryServiceStatus CryptSetKeyParam CryptCreateHash CryptEncrypt CryptImportKey CryptHashData CryptGetHashParam CryptReleaseContext CryptDestroyHash CryptDestroyKey SetEntriesInAclW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExW RegQueryInfoKeyW RegCloseKey RegOpenKeyW RegQueryValueExW RegCreateKeyExW RegEnumKeyW GetTokenInformation RegOpenKeyExW RegEnumValueW OpenThreadToken GetUserNameW FreeSid AllocateAndInitializeSid CheckTokenMembership CryptGenRandom StartServiceW

shell32

ShellExecuteExW CommandLineToArgvW SHGetFolderPathW ord232 SHFileOperationW

ole32

CoInitializeEx OleUninitialize StringFromIID CoTaskMemFree IIDFromString CoInitializeSecurity OleInitialize CoInitialize CoUninitialize CoCreateInstance

oleaut32

VariantChangeType SysAllocString VariantClear SafeArrayPutElement SafeArrayDestroy SafeArrayCreate SysFreeString VariantInit

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

iphlpapi

GetIpForwardTable GetNetworkParams

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

secur32

GetComputerObjectNameW

wininet

InternetGetLastResponseInfoW InternetGetConnectedState

ws2_32

htons send WSAGetLastError select closesocket GetAddrInfoW FreeAddrInfoW shutdown WSACleanup recv ioctlsocket socket connect __WSAFDIsSet WSAStartup WSASetLastError htonl

shlwapi

StrStrW PathIsDirectoryW PathCombineW PathMatchSpecW PathIsDirectoryEmptyW PathFindFileNameW PathFindExtensionW PathFileExistsW PathAppendW StrStrA PathAddBackslashW PathRemoveFileSpecW

crypt32

CertOpenStore PFXExportCertStoreEx CertCloseStore CryptUnprotectData

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-24_6cb0ee2eaacb915b0c91fd5cbc510f78_elex_glassworm_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

rpcrt4

iphlpapi

wtsapi32

secur32

wininet

ws2_32

shlwapi

crypt32

generic