2026-09-01_00c0088bfd26c7aaad8242c5ac990129_elex_glassworm_remcos_stealc_stop

General

Target
2026-09-01_00c0088bfd26c7aaad8242c5ac990129_elex_glassworm_remcos_stealc_stop
Size 419KB
Sample260901-2fjvfssxd1
SHA256 a4a79298c5e7e48be001087a6e823aa85d73ca7e3953e29f90f77aec162b37ca
MD5 00c0088bfd26c7aaad8242c5ac990129
SHA1 aec04eb5d51cb92a442c42baa105ff90afd5a6d7
SHA512 aa91b214634d545a4e156a019d837952e955d4ef0007432ba4b0ea93640cb8d9ed3b85123a8e1c9a4a3724ab39565cf9008d6d1c05c3f881d35933b41fe92e08
SSDEEP 6144:lIERV1OXujWvnY7wc7mgJS6ljqM7USJ8gEjTWi86v53mK0yqygi0Jt5uGgQarnV:+ERV1OXuag7wcigbuM7RdE3mPJPrgQa
TLSH
T171947C747A988121F14BC4FE3876F234C8B834A217F19BD3AFDC8AB59B984D159B250D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-01_00c0088bfd26c7aaad8242c5ac990129_elex_glassworm_remcos_stealc_stop

File Explorer

2026-09-01_00c0088bfd26c7aaad8242c5ac990129_elex_glassworm_remcos_stealc_stop

.exe 419KB

2026-09-01_00c0088bfd26c7aaad8242c5ac990129_elex_glassworm_remcos_stealc_stop

IMPHASH 30c1d5fe08808dbcb56fef16c4847600
SHA256 a4a79298c5e7e48be001087a6e823aa85d73ca7e3953e29f90f77aec162b37ca
MD5 00c0088bfd26c7aaad8242c5ac990129
SHA1 aec04eb5d51cb92a442c42baa105ff90afd5a6d7
SHA512 aa91b214634d545a4e156a019d837952e955d4ef0007432ba4b0ea93640cb8d9ed3b85123a8e1c9a4a3724ab39565cf9008d6d1c05c3f881d35933b41fe92e08
SSDEEP 6144:lIERV1OXujWvnY7wc7mgJS6ljqM7USJ8gEjTWi86v53mK0yqygi0Jt5uGgQarnV:+ERV1OXuag7wcigbuM7RdE3mPJPrgQa
TLSH
T171947C747A988121F14BC4FE3876F234C8B834A217F19BD3AFDC8AB59B984D159B250D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

143978

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Documents and Settings\Ken\Desktop\ppsieve-cuda-src\TPS-BOINC-Release\tpsieve-cuda-boinc-x86-windows.pdb

cudart

cudaMemcpy cudaConfigureCall __cudaRegisterFatBinary __cudaRegisterFunction __cudaRegisterVar cudaSetupArgument cudaGetDeviceProperties cudaMalloc cudaLaunch cudaMemcpyToSymbol __cudaUnregisterFatBinary cudaSetDevice cudaSetDeviceFlags cudaGetLastError cudaGetErrorString cudaFree

kernel32

GetCurrentProcess GetSystemTimeAsFileTime GetProcessTimes SetPriorityClass SetUnhandledExceptionFilter GetCurrentThreadId FindClose FindNextFileA FindFirstFileA DeleteFileA GetLastError CopyFileA MoveFileA CreateDirectoryA RemoveDirectoryA CreateFileA CloseHandle GetDiskFreeSpaceA GetProcAddress GetModuleHandleA GetVersionExA ReleaseMutex CreateMutexA WaitForSingleObject GetCurrentProcessId HeapFree HeapAlloc GetProcessHeap DuplicateHandle GetCurrentThread MapViewOfFile CreateFileMappingA CreateEventA UnmapViewOfFile SetEvent WaitForMultipleObjects InitializeCriticalSection Sleep TerminateProcess GetThreadContext SuspendThread LeaveCriticalSection EnterCriticalSection DebugBreak LocalFree lstrlenA FormatMessageA GetThreadTimes GetExitCodeProcess CreateProcessA LoadLibraryA GetEnvironmentVariableA GetModuleFileNameA GetCurrentDirectoryA FreeLibrary SetLastError GetVersion lstrcmpA LocalAlloc OpenProcess HeapReAlloc Thread32Next ResumeThread Thread32First CreateToolhelp32Snapshot SetCurrentDirectoryA GetFullPathNameA SetThreadPriority CreateThread LCMapStringA ReadFile MultiByteToWideChar GetTickCount QueryPerformanceCounter GetEnvironmentStringsW GetTimeZoneInformation WriteConsoleA GetConsoleOutputCP WriteConsoleW GetStringTypeA GetStringTypeW GetLocaleInfoA CompareStringA CompareStringW SetEnvironmentVariableA OpenFileMappingA DeleteCriticalSection FileTimeToSystemTime FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe GetFileType GetModuleHandleW ExitProcess SetConsoleCtrlHandler GetCommandLineA UnhandledExceptionFilter IsDebuggerPresent GetLocalTime GetDriveTypeA RtlUnwind SetEndOfFile RaiseException ExitThread GetTimeFormatA GetDateFormatA SetHandleCount GetStdHandle GetStartupInfoA SetStdHandle WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode HeapCreate VirtualFree VirtualAlloc SetFilePointer FlushFileBuffers GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree InitializeCriticalSectionAndSpinCount HeapSize FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW LCMapStringW

user32

SetUserObjectSecurity GetForegroundWindow GetWindowThreadProcessId GetWindowTextA GetClassNameA GetUserObjectSecurity

advapi32

AllocateAndInitializeSid SetEntriesInAclA FreeSid LookupAccountNameA AddAccessAllowedAce GetSecurityDescriptorDacl GetAclInformation GetLengthSid InitializeAcl GetAce AddAce CopySid RegOpenKeyA InitializeSecurityDescriptor SetSecurityDescriptorDacl RegOpenKeyExA RegQueryValueExA RegCloseKey

Name

.text

Size

235KB

Virtual Size

235KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

159KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.nvFatBi

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-01_00c0088bfd26c7aaad8242c5ac990129_elex_glassworm_remcos_stealc_stop

cudart

kernel32

user32

advapi32

generic