2026-09-16_7394b56ef6d342b37c71867d4c51f0f8_elex_glassworm_maze_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_7394b56ef6d342b37c71867d4c51f0f8_elex_glassworm_maze_stealc
Size 1.1MB
Sample260916-nt8tvazcpg
SHA256 3b1f49b16bd222c9387557b37646d14db0f8c066d85ad1959f92c66a44f94dd7
MD5 7394b56ef6d342b37c71867d4c51f0f8
SHA1 0143e2b764edb2d9f41f80ad3d163e0c0123cb5d
SHA512 6ac7bae9c4c4b687252a3af28202defcf61e11533156022241435d25ef70d5cffe6b07d64a24466526c0f56870e658c421ece00030941fcd29f7ebcd057bff90
SSDEEP 24576:t8rDhHCE28UilVb4vyPEouc+asJSPij508OfmnavjOT0rUoIqnV:oXVqv23a8oi8OTLOT2UoIqnV
TLSH
T14B45AD22B582C076D5B201B146AEB765A5FEB9340B7A44FBB3D85A0D0DB00C26B7F753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-16_7394b56ef6d342b37c71867d4c51f0f8_elex_glassworm_maze_stealc

File Explorer

2026-09-16_7394b56ef6d342b37c71867d4c51f0f8_elex_glassworm_maze_stealc

.exe 1.1MB

2026-09-16_7394b56ef6d342b37c71867d4c51f0f8_elex_glassworm_maze_stealc

IMPHASH 08b916a937c1a15de2cc1f0179b877cf
SHA256 3b1f49b16bd222c9387557b37646d14db0f8c066d85ad1959f92c66a44f94dd7
MD5 7394b56ef6d342b37c71867d4c51f0f8
SHA1 0143e2b764edb2d9f41f80ad3d163e0c0123cb5d
SHA512 6ac7bae9c4c4b687252a3af28202defcf61e11533156022241435d25ef70d5cffe6b07d64a24466526c0f56870e658c421ece00030941fcd29f7ebcd057bff90
SSDEEP 24576:t8rDhHCE28UilVb4vyPEouc+asJSPij508OfmnavjOT0rUoIqnV:oXVqv23a8oi8OTLOT2UoIqnV
TLSH
T14B45AD22B582C076D5B201B146AEB765A5FEB9340B7A44FBB3D85A0D0DB00C26B7F753
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c8:71:8b:33:2f:b7:41:f1:61:ab:e6:77:45:05:0e:39:f5:2e:7a:c6:12:40:1f:ce:13:61:2d:8f:58:7b:f0:83

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=BEIJING KUWO TECHNOLOGY CO.\,LTD.,OU=KUWO MUSIC,O=BEIJING KUWO TECHNOLOGY CO.\,LTD.,L=Beijing,ST=Beijing,C=CN

Chains

Oct 11, 2016

CN=BEIJING KUWO TECHNOLOGY CO.\,LTD.,OU=KUWO MUSIC,O=BEIJING KUWO TECHNOLOGY CO.\,LTD.,L=Beijing,ST=Beijing,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

42:7a:24:b4:82:8c:cc:54:89:8d:df:60:6d:51:07:ca:8e:15:b7:26

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=BEIJING KUWO TECHNOLOGY CO.\,LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=KUWO MUSIC,O=BEIJING KUWO TECHNOLOGY CO.\,LTD.,L=Beijing,ST=Beijing,C=CN

Chains

Oct 11, 2016

CN=BEIJING KUWO TECHNOLOGY CO.\,LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=KUWO MUSIC,O=BEIJING KUWO TECHNOLOGY CO.\,LTD.,L=Beijing,ST=Beijing,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=BEIJING KUWO TECHNOLOGY CO.\,LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=KUWO MUSIC,O=BEIJING KUWO TECHNOLOGY CO.\,LTD.,L=Beijing,ST=Beijing,C=CN

Serial Number

50:da:15:04:90:9f:72:73:48:6d:47:ac:0a:b7:46:75

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 4, 2013 - Jan 2, 2017

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=BEIJING KUWO TECHNOLOGY CO.\,LTD.,OU=KUWO MUSIC,O=BEIJING KUWO TECHNOLOGY CO.\,LTD.,L=Beijing,ST=Beijing,C=CN

Serial Number

0d:5c:c9:2d:b4:eb:6c:91:a0:0f:f9:a1:97:3d:15:68

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 1, 2016 - Jan 2, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Serial Number

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 11, 2015 - Dec 29, 2020

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Serial Number

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Timespan

Jan 1, 1997 - Dec 31, 2020

Minor OS version

Major OS version

Entry point

692092

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

N:\正式打包勿动_项目\DataRepair\Bin\Release\DataRepair.pdb

kernel32

GetFullPathNameW GetFullPathNameA SetFilePointer TlsGetValue SetEndOfFile FreeLibrary UnlockFile LockFile GetSystemTimeAsFileTime WriteFile TlsSetValue WideCharToMultiByte LoadLibraryW Sleep GetFileAttributesW ReadFile CreateFileW MultiByteToWideChar FlushFileBuffers GetTempPathW GetProcAddress LockFileEx LoadLibraryA GetVersionExA TlsAlloc DeleteFileW GetSystemTime AreFileApisANSI CreateToolhelp32Snapshot Process32First Process32Next HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap FileTimeToLocalFileTime FileTimeToSystemTime GetLocalTime GetModuleHandleA SetUnhandledExceptionFilter SetErrorMode IsDebuggerPresent GetCurrentThreadId GetCurrentProcessId GetCurrentProcess GetCurrentDirectoryA GetCommandLineA lstrlenA GetSystemDirectoryA GetACP GetOEMCP GetUserDefaultLCID GetComputerNameExA ResetEvent SetEvent TerminateThread GetFileAttributesExA OpenMutexA GetFileSize TerminateProcess CreateFileMappingA MapViewOfFile UnmapViewOfFile GetPrivateProfileStringA WritePrivateProfileStringA CreateDirectoryA lstrcpyA MoveFileExA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects GetCPInfo lstrcpynA SystemTimeToFileTime LocalFileTimeToFileTime SetFileTime GetFileInformationByHandle GetLogicalDriveStringsA GetDriveTypeA GetLogicalDrives DeviceIoControl SetFileAttributesA FindFirstFileA FindClose RemoveDirectoryA FindNextFileA SystemTimeToTzSpecificLocalTime GetFileAttributesExW WriteConsoleW MoveFileExW CreatePipe GetExitCodeProcess FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetConsoleCP GetTimeZoneInformation CreateFileA GetPrivateProfileIntA CreateSemaphoreA GetFileAttributesA CopyFileA GetTempFileNameA GetTempPathA GetTickCount CreateEventA GetModuleFileNameA WaitForSingleObject DecodePointer DeleteFileA CloseHandle DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError ReadConsoleW GetConsoleMode SetFilePointerEx GetFileType SetStdHandle IsValidCodePage GetModuleFileNameW GetStdHandle DuplicateHandle EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetModuleHandleW GetStartupInfoW TlsFree SetLastError UnhandledExceptionFilter RtlUnwind LoadLibraryExW ExitThread CreateThread IsProcessorFeaturePresent GetModuleHandleExW ExitProcess OutputDebugStringW FormatMessageA GetStringTypeW EncodePointer CreateProcessA RaiseException SetEnvironmentVariableA

user32

GetDesktopWindow wsprintfA

advapi32

AllocateAndInitializeSid FreeSid CheckTokenMembership RegCloseKey RegQueryInfoKeyA RegQueryValueExA RegEnumKeyExA RegOpenKeyExA

shell32

ShellExecuteA SHGetSpecialFolderPathA

ole32

CoInitialize CoUninitialize CoInitializeSecurity CoTaskMemFree CoCreateInstance

oleaut32

VariantTimeToSystemTime SystemTimeToVariantTime

shlwapi

PathFileExistsA StrStrIA PathFindFileNameA PathRemoveFileSpecA PathAddBackslashA PathIsURLA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

wininet

InternetCloseHandle InternetReadFile HttpEndRequestA HttpOpenRequestA InternetConnectA InternetWriteFile HttpSendRequestExA HttpSendRequestA InternetSetCookieA InternetOpenA

urlmon

URLDownloadToFileA

iphlpapi

GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_7394b56ef6d342b37c71867d4c51f0f8_elex_glassworm_maze_stealc

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

wininet

urlmon

iphlpapi

generic