2026-09-16_8d42656a0d4963992d066962bff9d3ed_elex_glassworm_hacktools_remcos_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_8d42656a0d4963992d066962bff9d3ed_elex_glassworm_hacktools_remcos_stop
Size 11.4MB
Sample260916-mzbkvsaf39
SHA256 47590e590116247761297a10667536314593349bbaa06d0b01d453c9ceccde20
MD5 8d42656a0d4963992d066962bff9d3ed
SHA1 22834f4ee70a7dfc818cfa92b16c37d8b2e6acaf
SHA512 4f08e966146591bf23ed9d8dd800b01d53cc37343469cf53c9cfdf1316a5729b9c5ec6d3617c784cea67aff6501415eb8656a2eae1c8dd5d0db47af9ce5aa2f8
SSDEEP 196608:I0MWdlrB6atTnFM2e0yUIHr+/0b+DDAdPjyBi3K0UevGA/22cw/jrHQNrjt6jy0v:gL+/0SQ1M+BwlNZrS
TLSH
T106C66C02E6429529F9A300B289BD56BEA62CB730175970C3E3CC6C7D97E69F23D31617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_8d42656a0d4963992d066962bff9d3ed_elex_glassworm_hacktools_remcos_stop

File Explorer

2026-09-16_8d42656a0d4963992d066962bff9d3ed_elex_glassworm_hacktools_remcos_stop

.exe 11.4MB

2026-09-16_8d42656a0d4963992d066962bff9d3ed_elex_glassworm_hacktools_remcos_stop

SHA256 47590e590116247761297a10667536314593349bbaa06d0b01d453c9ceccde20
MD5 8d42656a0d4963992d066962bff9d3ed
SHA1 22834f4ee70a7dfc818cfa92b16c37d8b2e6acaf
SHA512 4f08e966146591bf23ed9d8dd800b01d53cc37343469cf53c9cfdf1316a5729b9c5ec6d3617c784cea67aff6501415eb8656a2eae1c8dd5d0db47af9ce5aa2f8
SSDEEP 196608:I0MWdlrB6atTnFM2e0yUIHr+/0b+DDAdPjyBi3K0UevGA/22cw/jrHQNrjt6jy0v:gL+/0SQ1M+BwlNZrS
TLSH
T106C66C02E6429529F9A300B289BD56BEA62CB730175970C3E3CC6C7D97E69F23D31617
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2401072

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

9.1MB

Virtual Size

9.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

117KB

Virtual Size

138.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

11KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

936KB

Virtual Size

940KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=280, id=132, productName=VS2008 build 21022, version=21022,

count=5, id=150, version=20413,

count=60, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=211, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=1, id=11, version=8966,

count=11, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=44, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=1, id=28, version=9178,

count=1, id=29, version=9178,

count=2, id=25, version=9210,

count=35, id=123, productName=VS2005 build 50727, version=50727,

count=517, id=1, productName=Unmarked objects,

count=585, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,