2026-09-09_0d630f6bef1905356ec55ed42a85a825_bugat_elex_glassworm_remcos_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-09_0d630f6bef1905356ec55ed42a85a825_bugat_elex_glassworm_remcos_stop
Size 15.0MB
Sample260910-apxdcscj7s
SHA256 2d230e3c00327a7d618cf9edc6ee6e7c30c6c8944e942aa955ff692bffd75e05
MD5 0d630f6bef1905356ec55ed42a85a825
SHA1 4396c2c62b36eee57fa8be67345e2f56db8997d4
SHA512 4445c22c03018a8f4260a0bd6983b21ac66dc6548d922f5c1925d6cf4b819b23d1671eada73136b031398be176b1fde6eec21bbfb242649df94bd328d6afe579
SSDEEP 196608:19m+ulkLHAItci1kQ7Yh8pwhs1v26yaq/Noql3w/:qlEHAIci1kEODSuRl3w/
TLSH
T129F68D41B6F7C2B5D06934B475AA725FE53AB2440F3D0AD3ABE42E0CC9E17D01AFA191
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-09_0d630f6bef1905356ec55ed42a85a825_bugat_elex_glassworm_remcos_stop

File Explorer

2026-09-09_0d630f6bef1905356ec55ed42a85a825_bugat_elex_glassworm_remcos_stop

.exe 15.0MB

2026-09-09_0d630f6bef1905356ec55ed42a85a825_bugat_elex_glassworm_remcos_stop

IMPHASH 69d7e092cec6c1fd870b371419b4c0a1
SHA256 2d230e3c00327a7d618cf9edc6ee6e7c30c6c8944e942aa955ff692bffd75e05
MD5 0d630f6bef1905356ec55ed42a85a825
SHA1 4396c2c62b36eee57fa8be67345e2f56db8997d4
SHA512 4445c22c03018a8f4260a0bd6983b21ac66dc6548d922f5c1925d6cf4b819b23d1671eada73136b031398be176b1fde6eec21bbfb242649df94bd328d6afe579
SSDEEP 196608:19m+ulkLHAItci1kQ7Yh8pwhs1v26yaq/Noql3w/:qlEHAIci1kEODSuRl3w/
TLSH
T129F68D41B6F7C2B5D06934B475AA725FE53AB2440F3D0AD3ABE42E0CC9E17D01AFA191
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9392798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Program Files (x86)\Rockstar Games\Grand Theft Auto IV\GTAIV.pdb

user32

MessageBoxW MessageBoxA wsprintfA ReleaseCapture GetParent PostMessageA EnableWindow GetWindow GetActiveWindow GetForegroundWindow GetCapture IsWindowEnabled GetTopWindow SetForegroundWindow GetFocus SetCapture SetActiveWindow RegisterClassA ReleaseDC PeekMessageA SetFocus AdjustWindowRect UpdateWindow MoveWindow ShowWindow SetWindowTextA GetDesktopWindow GetWindowInfo RegisterClassW IsIconic TranslateMessage DispatchMessageA GetDC EnumDisplayDevicesA CreateWindowExW LoadIconA SetRect LoadCursorA ShowCursor GetSystemMetrics SetWindowLongA DestroyWindow UnregisterClassA GetWindowRect GetClientRect SetWindowPos DefWindowProcW CharLowerBuffA SendMessageA SystemParametersInfoA ToUnicodeEx ToAsciiEx MapVirtualKeyExA LoadKeyboardLayoutA GetKeyboardLayoutNameA GetKeyboardType GetKeyboardLayout GetKeyboardState SendInput GetMessageExtraInfo GetTitleBarInfo IsWindowUnicode IsWindowVisible GetWindowTextA IsWindow CallNextHookEx SetWindowsHookExA UnhookWindowsHookEx DefWindowProcA

wininet

InternetSetOptionA InternetQueryOptionA HttpEndRequestA InternetReadFile InternetGetConnectedState InternetCheckConnectionA InternetWriteFile InternetCrackUrlA InternetOpenA InternetConnectA InternetCloseHandle HttpOpenRequestA HttpSendRequestA HttpAddRequestHeadersA HttpSendRequestExA InternetQueryDataAvailable

crypt32

CertFreeCertificateContext CryptMsgGetParam CryptUnprotectData CryptProtectData CertFindCertificateInStore CertCloseStore CertGetNameStringA CryptQueryObject CryptMsgClose

psapi

EnumProcessModules GetModuleFileNameExA

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

dsound

ord3 ord11 ord2 ord9

d3d9

Direct3DCreate9

xlive

ord5264 ord5263 ord5022 ord5315 ord5292 ord5024 ord1082 ord5265 ord5262 ord5254 ord5311 ord5310 ord66 ord63 ord75 ord5324 ord5276 ord5277 ord20 ord24 ord7 ord5038 ord5034 ord5036 ord5037 ord5035 ord5019 ord5018 ord70 ord69 ord5303 ord72 ord5344 ord5305 ord5345 ord5372 ord5367 ord652 ord5021 ord5020 ord5360 ord5 ord58 ord73 ord39 ord5335 ord5256 ord15 ord5030 ord5297 ord84 ord38 ord4 ord18 ord14 ord13 ord27 ord22 ord6 ord11 ord9 ord12 ord3 ord26 ord51 ord2 ord52 ord1 ord5016 ord5017 ord5295 ord5294 ord5331 ord1083 ord5337 ord5002 ord5007 ord5005 ord5326 ord5330 ord5328 ord5316 ord5323 ord5327 ord5300 ord5336 ord5322 ord5325 ord5318 ord5329 ord5333 ord5332 ord5317 ord57 ord5319 ord5280 ord5278 ord5215 ord5365 ord5252 ord5214 ord5260 ord5286 ord5284 ord5281 ord5312 ord5314 ord5008 ord5003 ord651 ord5270 ord5267 ord5251 ord5355 ord5350

wintrust

WinVerifyTrust

atl80

ord41 ord42

shlwapi

PathStripPathW PathFileExistsA PathAppendW PathAppendA

wmvcore

WMCreateReader WMCreateSyncReader

winmm

waveOutPrepareHeader waveOutOpen timeEndPeriod waveOutClose waveOutReset waveOutSetVolume timeGetTime timeBeginPeriod waveOutWrite

powrprof

CallNtPowerInformation

kernel32

GetModuleFileNameW OpenFileMappingW SetErrorMode lstrcmpiA OpenEventA SystemTimeToFileTime GetSystemDirectoryA GlobalAlloc GlobalFree lstrlenW SetStdHandle VirtualQuery GetConsoleOutputCP WriteConsoleA SetEnvironmentVariableA CompareStringW CompareStringA GetLocaleInfoA GetStringTypeW GetStringTypeA RtlUnwind GetConsoleMode GetConsoleCP GetCurrentDirectoryA LCMapStringW LCMapStringA HeapCreate HeapDestroy GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA HeapSize IsDebuggerPresent UnhandledExceptionFilter GetStdHandle InterlockedPopEntrySList InterlockedPushEntrySList InitializeSListHead InterlockedFlushSList TerminateThread DuplicateHandle FlushFileBuffers WriteConsoleW SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP GetCPInfo HeapReAlloc GetFullPathNameA GetDriveTypeA GetTimeZoneInformation GetSystemTimeAsFileTime GetStartupInfoA ExitProcess RaiseException Process32First LocalAlloc WaitForMultipleObjects CreateEventA Sleep CloseHandle ReadFile SetFilePointer CreateFileW GetProcAddress LoadLibraryW FreeLibrary GetModuleHandleA MultiByteToWideChar LoadLibraryA GetUserDefaultUILanguage GetCurrentProcess GlobalMemoryStatusEx GetVersionExA CreateProcessA WaitForSingleObject HeapAlloc GetProcessHeap OpenProcess GetCurrentProcessId HeapFree GetUserDefaultLangID GetLastError CreateMutexA SetThreadPriority ReleaseSemaphore GetCurrentThreadId ReleaseMutex ResetEvent ResumeThread CreateThread SwitchToThread SetThreadPriorityBoost CreateSemaphoreA SetEvent GetSystemInfo TryEnterCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection QueryPerformanceCounter GetThreadPriority QueryPerformanceFrequency GetCurrentThread InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange InterlockedExchangeAdd GetProcessAffinityMask GetTimeFormatA VirtualFree GetDateFormatA GetModuleFileNameA VirtualAlloc CreateFileA GetLocalTime FileTimeToLocalFileTime FormatMessageA SetFileTime WriteFile LocalFree DeleteFileA MoveFileA CreateDirectoryA FindFirstFileA RemoveDirectoryA FindNextFileA SetFileAttributesA GetFileAttributesA SetEndOfFile FindClose FileTimeToSystemTime OpenFile GetSystemTime SetUnhandledExceptionFilter GetWindowsDirectoryA GlobalMemoryStatus GetDiskFreeSpaceExA DeleteFileW CopyFileA CreateDirectoryW HeapSetInformation WideCharToMultiByte GetTickCount GetFileSize GetExitCodeThread FoldStringW FindNextFileW GetFileAttributesW FindFirstFileW UnmapViewOfFile GetProcessId MapViewOfFile CreateFileMappingA InitializeCriticalSectionAndSpinCount GetCommandLineA OpenThread SetThreadAffinityMask ExpandEnvironmentStringsA GetSystemTimes CreateToolhelp32Snapshot Process32Next TerminateProcess

gdi32

GetDeviceCaps DeleteDC GetStockObject ExtEscape CreateDCA

advapi32

RegCreateKeyExA RegOpenKeyA RegEnumKeyA RegQueryValueExA RegOpenKeyExA RegCloseKey RegSetValueExA

shell32

ShellExecuteExA ShellExecuteA SHCreateDirectoryExA SHGetFolderPathW SHGetFolderPathA

ole32

CoInitialize CoUninitialize CoCreateInstance CLSIDFromString CoInitializeEx CoSetProxyBlanket OleUninitialize OleInitialize OleDraw

oleaut32

SafeArrayCopy VariantInit SafeArrayCreateVector SafeArrayAccessData SafeArrayUnaccessData VariantClear SafeArrayGetVartype SysFreeString SysAllocString

binkw32

_BinkDoFrame@4 _BinkGetSummary@8 _BinkSetSoundSystem@8 _BinkRegisterFrameBuffers@8 _BinkNextFrame@4 _BinkSetVolume@12 _BinkWait@4 _BinkGoto@12 _BinkPause@8 _BinkGetKeyFrame@12 _BinkOpenDirectSound@4 _BinkShouldSkip@4 _BinkGetFrameBuffersInfo@8 _BinkClose@4 _BinkOpen@8 _BinkSetMemory@8

ws2_32

htonl inet_addr ntohl recvfrom connect gethostbyname closesocket htons socket WSACleanup __WSAFDIsSet sendto recv inet_ntoa ntohs shutdown WSAGetLastError getsockname gethostname select send

dinput8

DirectInput8Create

Name

.text

Size

9.4MB

Virtual Size

9.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.7MB

Virtual Size

11.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

936KB

Virtual Size

933KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=3, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=2, id=147, productName=VS2008 build 21022, version=21022,

count=2, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=4, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=2, id=93, version=2179,

count=5, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=57, id=125, productName=VS2005 build 50727, version=50727,

count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=741, id=110, productName=VS2005 build 50727, version=50727,

count=41, id=123, productName=VS2005 build 50727, version=50727,

count=564, id=1, productName=Unmarked objects,

count=236, id=109, productName=VS2005 build 50727, version=50727,

count=800, id=114, version=50727,

count=1, id=124, productName=VS2005 build 50727, version=50727,

count=1, productName=Unmarked objects (old),

count=1, id=120, productName=VS2005 build 50727, version=50727,