2026-08-27_4109b1f91e18ce4430c809fbdf78c8e3_elex_glassworm_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-27_4109b1f91e18ce4430c809fbdf78c8e3_elex_glassworm_stop
Size 17.5MB
Sample260827-xpcqaazeph
SHA256 6dc652629ffaea29222bffbd8b07f36f23feb4b6f8237a807abcf808addce7cb
MD5 4109b1f91e18ce4430c809fbdf78c8e3
SHA1 2ce2bc5ccf970c268f13a6418a3d99af8ddc2026
SHA512 6c8c5cce88df5cf7691e8f4acbaa638298d177b594fd9a3995c5c32fc6684d5b2975e049efa9c8cc069213bf280ce7a7957bc06f83484bf3ca9290f8291bc5eb
SSDEEP 393216:DY2p7n9zo7QcNlVDnD0Bl8mcOAXUL331xe:jpj9zFcVsMlUL31xe
TLSH
T1BD07C0A067C6C86BC51D1F38644FCA65C3E5BDB00B18DEE3B035237E65216C9892B77A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-27_4109b1f91e18ce4430c809fbdf78c8e3_elex_glassworm_stop

File Explorer

2026-08-27_4109b1f91e18ce4430c809fbdf78c8e3_elex_glassworm_stop

.exe 17.5MB

2026-08-27_4109b1f91e18ce4430c809fbdf78c8e3_elex_glassworm_stop

SHA256 6dc652629ffaea29222bffbd8b07f36f23feb4b6f8237a807abcf808addce7cb
MD5 4109b1f91e18ce4430c809fbdf78c8e3
SHA1 2ce2bc5ccf970c268f13a6418a3d99af8ddc2026
SHA512 6c8c5cce88df5cf7691e8f4acbaa638298d177b594fd9a3995c5c32fc6684d5b2975e049efa9c8cc069213bf280ce7a7957bc06f83484bf3ca9290f8291bc5eb
SSDEEP 393216:DY2p7n9zo7QcNlVDnD0Bl8mcOAXUL331xe:jpj9zFcVsMlUL31xe
TLSH
T1BD07C0A067C6C86BC51D1F38644FCA65C3E5BDB00B18DEE3B035237E65216C9892B77A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

fc:46:29:2a:30:33:e7:db:3c:df:39:4b:b4:a4:4a:6a:f3:ee:c5:38:aa:09:ef:e0:42:2e:d8:ac:e5:31:33:64

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=AnyDesk Software GmbH,OU=Software,O=AnyDesk Software GmbH,C=US,1.2.840.113549.1.9.1=#0c13737570706f727440616e796465736b2e636f6d

Chains

Aug 23, 2026

CN=AnyDesk Software GmbH,OU=Software,O=AnyDesk Software GmbH,C=US,1.2.840.113549.1.9.1=#0c13737570706f727440616e796465736b2e636f6d

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert Inc,L=Lehi,ST=Utah,C=US

CN=DigiCert Global Root G2,O=DigiCert Inc,C=US

Subject

CN=AnyDesk Software GmbH,OU=Software,O=AnyDesk Software GmbH,C=US,1.2.840.113549.1.9.1=#0c13737570706f727440616e796465736b2e636f6d

Serial Number

01:c7:85:49:a6:00:7e:fb:03:14:17:5c:a8:5f:22:9b:1e:ed:dd:bd

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert Inc,L=Lehi,ST=Utah,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 12, 2026 - Mar 11, 2031

Subject

CN=DigiCert Global Root G2,O=DigiCert Inc,C=US

Serial Number

44:10:d5:ba:d5:8f:f2:8d:b4:da:b2:f6:c0:27:56:bb:15:54:83:aa

Issuer

CN=DigiCert Global Root G2,O=DigiCert Inc,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 12, 2026 - Mar 9, 2036

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert Inc,L=Lehi,ST=Utah,C=US

Serial Number

02:92:59:f8:69:c4:55:7a:0d:74:8c:c0:6b:59:ee:4d:01:19:25:b0

Issuer

CN=DigiCert Global Root G2,O=DigiCert Inc,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 12, 2026 - Mar 11, 2031

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

7248336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

854KB

Virtual Size

853KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

145KB

Virtual Size

474KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dat

Size

11.3MB

Virtual Size

11.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=93, id=131, productName=VS2008 build 21022, version=21022,

count=11, id=150, version=20413,

count=67, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=250, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=523, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=31, id=10, version=8447,

count=127, id=132, productName=VS2008 build 21022, version=21022,

count=17, id=109, productName=VS2005 build 50727, version=50727,

count=44, id=123, productName=VS2005 build 50727, version=50727,

count=7, productName=Unmarked objects (old),

count=5, id=49, version=9044,

count=75, id=48, version=9044,

count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1106, id=1, productName=Unmarked objects,

count=287, id=138, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,