2026-08-24_30d62dd0d0013a1073c3fa636e3968ee_elex_glassworm_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-24_30d62dd0d0013a1073c3fa636e3968ee_elex_glassworm_stop
Size 204KB
Sample260825-tksn6acj21
SHA256 db4f0060dc5c00dcff1e3216951703d6e0d1caa3c38ca93563f4a08e48b89d1d
MD5 30d62dd0d0013a1073c3fa636e3968ee
SHA1 06d4d856e859fbfcdcced3225a3f5b1662b8d20c
SHA512 f1b867625085731f1c06960ebcc0c13f9c5f031c8da95b8e94d3ec66aba3c6111d447914cb95958774ade8c2cadcb20f992d08771cb5c3660928aa7f08cb1d78
SSDEEP 3072:Jk2Q30LXU2u0GXDcs3LYEc82kzXfqfSgcOQkeFc715f5:JBQ30LXxgXDdVVO4c7n
TLSH
T11614AD3132D2C072E61305744DF2DA79A67B7C248A36894BEFD43F4E5A31692A33A717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many email and collaboration clients. Observed in information steale 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-24_30d62dd0d0013a1073c3fa636e3968ee_elex_glassworm_stop

File Explorer

2026-08-24_30d62dd0d0013a1073c3fa636e3968ee_elex_glassworm_stop

.exe 204KB

2026-08-24_30d62dd0d0013a1073c3fa636e3968ee_elex_glassworm_stop

IMPHASH c159df6902154a1bda0df1ada53dea19
SHA256 db4f0060dc5c00dcff1e3216951703d6e0d1caa3c38ca93563f4a08e48b89d1d
MD5 30d62dd0d0013a1073c3fa636e3968ee
SHA1 06d4d856e859fbfcdcced3225a3f5b1662b8d20c
SHA512 f1b867625085731f1c06960ebcc0c13f9c5f031c8da95b8e94d3ec66aba3c6111d447914cb95958774ade8c2cadcb20f992d08771cb5c3660928aa7f08cb1d78
SSDEEP 3072:Jk2Q30LXU2u0GXDcs3LYEc82kzXfqfSgcOQkeFc715f5:JBQ30LXxgXDdVVO4c7n
TLSH
T11614AD3132D2C072E61305744DF2DA79A67B7C248A36894BEFD43F4E5A31692A33A717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables referencing many email and collaboration clients. Observed in information steale
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

102883

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\botgenstudio\generations\fed14e50\bin\Bot.pdb

kernel32

InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GlobalFree GetVersionExW LocalFree LocalAlloc CreateNamedPipeW GetCommandLineW ReleaseMutex CreateMutexW FileTimeToSystemTime GetVolumeInformationW GetDriveTypeW OpenMutexW ExpandEnvironmentStringsW GetFileSize MapViewOfFile UnmapViewOfFile CreateFileMappingW CreateDirectoryW RemoveDirectoryW GetCurrentThreadId GlobalLock GlobalUnlock WideCharToMultiByte SetCurrentDirectoryW GetCurrentDirectoryW FindVolumeMountPointClose FindFirstVolumeMountPointW FindVolumeClose GetOEMCP GetDiskFreeSpaceExW FileTimeToLocalFileTime FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindNextVolumeMountPointW HeapFree GetLocaleInfoA GetStringTypeW GetStringTypeA RtlUnwind LoadLibraryA VirtualAlloc GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter VirtualFree HeapDestroy GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA GetStdHandle IsDebuggerPresent UnhandledExceptionFilter TerminateProcess LCMapStringW LCMapStringA IsValidCodePage GetCPInfo HeapSize InterlockedDecrement InterlockedIncrement TlsFree TlsSetValue TlsAlloc HeapAlloc HeapCompact HeapReAlloc SetLastError HeapCreate GetVolumeNameForVolumeMountPointW GetFileSizeEx SetFilePointer CreateFileW ReadFile GetFileAttributesW SetFileAttributesW DeleteFileW GetSystemWow64DirectoryW GetSystemDirectoryW FindNextFileW WriteFile SetFileTime GetProcAddress CreateToolhelp32Snapshot Process32NextW Process32FirstW MoveFileW SetUnhandledExceptionFilter FreeConsole CopyFileW ExitProcess CreateProcessW FreeLibrary SetErrorMode lstrlenA SetThreadPriority GetCurrentThread GetTickCount lstrcmpW GetModuleHandleW GetACP FindFirstFileW SleepEx GetSystemTime GetLocalTime FindClose SystemTimeToFileTime GetCurrentProcess GetExitCodeThread ExitThread CloseHandle WaitForSingleObject TerminateThread CreateThread Sleep GetWindowsDirectoryW GetEnvironmentVariableW GetTempPathW lstrcatW lstrlenW TlsGetValue GetModuleHandleA RaiseException GetStartupInfoA GetProcessHeap GetVersionExA GetCommandLineA GetModuleFileNameW GetComputerNameW lstrcpyW IsBadReadPtr GetLastError MultiByteToWideChar lstrcpynW LoadLibraryW lstrcmpiW

user32

GetForegroundWindow GetKeyboardState RegisterRawInputDevices GetRawInputData GetWindowTextW ToUnicodeEx GetAsyncKeyState PostQuitMessage GetKeyboardLayout GetMessageW GetDesktopWindow SetProcessWindowStation ReleaseDC GetDC GetProcessWindowStation GetUserObjectInformationW SetWindowLongW RegisterDeviceNotificationW ShowWindow CreateWindowExW UnregisterDeviceNotification RegisterClassExW DefWindowProcW DispatchMessageW GetWindowThreadProcessId PeekMessageW SetThreadDesktop GetThreadDesktop CloseClipboard CharLowerW OpenClipboard GetKeyboardType wsprintfW wsprintfA GetWindowRect GetKeyboardLayoutNameW SetForegroundWindow SystemParametersInfoW LockSetForegroundWindow GetClipboardData

gdi32

CreateCompatibleBitmap CreateCompatibleDC SelectObject BitBlt DeleteDC GetDIBits DeleteObject

advapi32

CryptGenRandom LookupPrivilegeValueW OpenProcessToken AdjustTokenPrivileges OpenServiceW CloseServiceHandle CryptAcquireContextW OpenSCManagerW LookupAccountSidA QueryServiceStatus CryptSetKeyParam CryptCreateHash CryptEncrypt CryptImportKey CryptHashData CryptGetHashParam CryptReleaseContext CryptDestroyHash CryptDestroyKey SetEntriesInAclW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExW RegQueryInfoKeyW RegCloseKey RegOpenKeyW RegQueryValueExW RegCreateKeyExW RegEnumKeyW GetTokenInformation RegOpenKeyExW RegEnumValueW OpenThreadToken GetUserNameW FreeSid AllocateAndInitializeSid CheckTokenMembership ChangeServiceConfigW StartServiceW

shell32

SHFileOperationW CommandLineToArgvW ShellExecuteExW SHGetFolderPathW

ole32

IIDFromString CoCreateInstance CoInitialize CoInitializeSecurity StringFromIID OleUninitialize OleInitialize CoTaskMemFree CoUninitialize

oleaut32

VariantChangeType SafeArrayPutElement SafeArrayDestroy SafeArrayCreate SysFreeString SysAllocString VariantClear VariantInit

rpcrt4

RpcStringFreeW UuidToStringW UuidCreate

iphlpapi

GetNetworkParams GetIpForwardTable

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

secur32

GetComputerObjectNameW

wininet

InternetGetConnectedState InternetGetLastResponseInfoW

ws2_32

WSASetLastError GetAddrInfoW FreeAddrInfoW shutdown WSACleanup recv ioctlsocket socket connect __WSAFDIsSet WSAStartup htonl closesocket select WSAGetLastError send htons

shlwapi

PathAddBackslashW PathFileExistsW PathIsDirectoryEmptyW PathFindFileNameW PathFindExtensionW PathAppendW StrStrA PathRemoveFileSpecW

crypt32

CertCloseStore CertOpenStore PFXExportCertStoreEx CryptUnprotectData

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-24_30d62dd0d0013a1073c3fa636e3968ee_elex_glassworm_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

rpcrt4

iphlpapi

wtsapi32

secur32

wininet

ws2_32

shlwapi

crypt32

generic