2026-09-04_29b8b64a5c008bd23ae2274d0f19741d_elex_glassworm_mafia_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_29b8b64a5c008bd23ae2274d0f19741d_elex_glassworm_mafia_remcos
Size 1.2MB
Sample260905-s847esef85
SHA256 60c035a469f29d3bf2de2d83f78e724c2dd580a138458ca996821be4e6388616
MD5 29b8b64a5c008bd23ae2274d0f19741d
SHA1 91f5b0ea73b4e870cb1f3eec7ad3a09e7b66d242
SHA512 c431b0a9e5e96b78a06ea8f15214e4a1df01f6b59a2a4d3ff64d91e3792289e5a3ad8c7d6c3927e78d05783a469e81401c223c3991abe52082917018b0cb1a66
SSDEEP 24576:4hfDc6X3lQM3xr4cQFTj0OZeVJpc67rDYRcPeHbZ5LK2b7kU:zul13qcQFTIOZe37nycWHV5LNvB
TLSH
T12645E01E7AF1C032C03352309E6AD358A2B5E47248260447BBED675D2FB15D2DB39BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_29b8b64a5c008bd23ae2274d0f19741d_elex_glassworm_mafia_remcos

File Explorer

2026-09-04_29b8b64a5c008bd23ae2274d0f19741d_elex_glassworm_mafia_remcos

.exe 1.2MB

2026-09-04_29b8b64a5c008bd23ae2274d0f19741d_elex_glassworm_mafia_remcos

IMPHASH 786d492994809809a8824667c8485518
SHA256 60c035a469f29d3bf2de2d83f78e724c2dd580a138458ca996821be4e6388616
MD5 29b8b64a5c008bd23ae2274d0f19741d
SHA1 91f5b0ea73b4e870cb1f3eec7ad3a09e7b66d242
SHA512 c431b0a9e5e96b78a06ea8f15214e4a1df01f6b59a2a4d3ff64d91e3792289e5a3ad8c7d6c3927e78d05783a469e81401c223c3991abe52082917018b0cb1a66
SSDEEP 24576:4hfDc6X3lQM3xr4cQFTj0OZeVJpc67rDYRcPeHbZ5LK2b7kU:zul13qcQFTIOZe37nycWHV5LNvB
TLSH
T12645E01E7AF1C032C03352309E6AD358A2B5E47248260447BBED675D2FB15D2DB39BA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

257843

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

IIDFromString StringFromGUID2 OleRun CLSIDFromString CoTaskMemAlloc CoTaskMemFree CoInitialize CoTaskMemRealloc CoUninitialize CoCreateInstance

shell32

Shell_NotifyIconA ShellExecuteA SHGetFolderPathW

wininet

InternetTimeFromSystemTime InternetTimeToSystemTime InternetCrackUrlA HttpQueryInfoA InternetConnectA InternetReadFile HttpOpenRequestA InternetErrorDlg HttpSendRequestA InternetOpenA InternetCloseHandle

user32

GetDesktopWindow SetWindowLongA CreateWindowExA PeekMessageA GetWindowLongA CharNextA wsprintfA DispatchMessageW RegisterClassA LoadImageA GetSystemMetrics DispatchMessageA PostMessageA AppendMenuA CreatePopupMenu ShowWindow MsgWaitForMultipleObjectsEx GetCursorPos DefWindowProcA MessageBoxA DestroyWindow GetMessageA GetMessageW PostQuitMessage TrackPopupMenu SetForegroundWindow LoadStringA TranslateMessage IsWindowUnicode

version

VerQueryValueW GetFileVersionInfoA GetFileVersionInfoSizeA

kernel32

FindFirstFileExW GetDriveTypeW FileTimeToLocalFileTime GetFullPathNameW CreateDirectoryW GetConsoleMode GetConsoleCP GetFileType GetStartupInfoW HeapSetInformation VirtualQuery GetSystemInfo GetModuleHandleW VirtualAlloc VirtualProtect HeapAlloc HeapFree DecodePointer EncodePointer GetStringTypeW InterlockedExchange SetStdHandle HeapReAlloc RtlUnwind LCMapStringW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime IsProcessorFeaturePresent GetTimeZoneInformation HeapCreate FindResourceA lstrcmpA lstrlenA FreeLibrary LoadResource SystemTimeToTzSpecificLocalTime InterlockedIncrement InterlockedDecrement WaitForSingleObject GetCommandLineA WideCharToMultiByte InitializeCriticalSectionAndSpinCount SizeofResource CreateEventA SetDllDirectoryA IsDBCSLeadByte lstrcatA MultiByteToWideChar lstrlenW RaiseException GetLastError lstrcmpiA GetProcAddress WaitForMultipleObjects GetModuleFileNameA GetStdHandle LoadLibraryExA CreateMutexA DeleteCriticalSection CloseHandle SetEvent ResetEvent CreateThread lstrcpyA lstrcpynA CreateFileA WriteFile Sleep OpenEventA GetCurrentProcess GetVersionExA GetTempPathA LocalFree DeleteFileA ReadFile FileTimeToSystemTime FormatMessageW GetLocalTime GetCurrentThreadId GetCurrentProcessId PeekNamedPipe SetHandleInformation GetExitCodeProcess CreateProcessA TerminateProcess CreatePipe ExitProcess GetLocaleInfoA FormatMessageA GetSystemDirectoryA FindClose LoadLibraryA LocalAlloc LockResource SetEndOfFile SetFilePointerEx GetNativeSystemInfo GetModuleHandleExW GetSystemDefaultUILanguage GetThreadLocale GetUserDefaultUILanguage GetTickCount GetModuleFileNameW SetLastError LoadLibraryExW OpenMutexA GetModuleHandleExA LoadLibraryW CreateFileW InitializeCriticalSection LeaveCriticalSection EnterCriticalSection HeapSize TlsAlloc TlsGetValue TlsSetValue TlsFree GetLocaleInfoW SetHandleCount SetFilePointer FlushFileBuffers GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetProcessHeap WriteConsoleW GetCurrentDirectoryW GetFileInformationByHandle GetUserDefaultLCID EnumSystemLocalesA IsValidLocale CompareStringW SetEnvironmentVariableA GetModuleHandleA GetFileAttributesA

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumKeyA CryptHashData CryptDestroyHash CryptCreateHash CryptAcquireContextA CryptReleaseContext RegQueryValueExA CryptGetHashParam SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegNotifyChangeKeyValue RegDeleteValueA RegOpenKeyExA RegCreateKeyExA RegEnumKeyExA RegDeleteKeyA RegQueryInfoKeyW RegSetValueExA

oleaut32

GetErrorInfo SysStringByteLen VarUI4FromStr SysFreeString SysAllocString VariantClear VariantInit VariantChangeType

shlwapi

ord12

gdi32

GetStockObject

crypt32

CryptStringToBinaryA CryptUnprotectData CryptProtectData CryptBinaryToStringA

msi

ord141 ord168 ord160 ord158 ord115 ord159 ord117 ord8 ord44 ord204 ord189 ord67 ord31 ord137 ord91

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_29b8b64a5c008bd23ae2274d0f19741d_elex_glassworm_mafia_remcos

ole32

shell32

wininet

user32

version

kernel32

advapi32

oleaut32

shlwapi

gdi32

crypt32

msi

generic