2026-09-19_935eeb980a4b5bdc4ec1ed37721cb504_elex_floxif_glassworm_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-19_935eeb980a4b5bdc4ec1ed37721cb504_elex_floxif_glassworm_stop
Size 6.4MB
Sample260919-21tkdscd93
SHA256 1442d3f64bd235be3f18daf8f3f8367eaa1ef24da9c8b71503d1cf307ec6dce9
MD5 935eeb980a4b5bdc4ec1ed37721cb504
SHA1 d2e3e83976da91ae530991ce246fe2cba134f874
SHA512 ad46a1d62cb43c04ec8b95857c851446eee91b92b5caf341f8b74f0e7e520141b515108c2cd6d906008575880e2615c33fb56ce34e73025008e8a001061cd2bd
SSDEEP 196608:W8fS2lm9RLslS+dmPC4IiXWrBfpMXOfCG0lG7:p9lCL3jqYX6FJCFG7
TLSH
T11E6633223EE0D6B1E17125F07ABA877595B2FC390825948F53E84B192F386538F2D736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-19_935eeb980a4b5bdc4ec1ed37721cb504_elex_floxif_glassworm_stop

File Explorer

2026-09-19_935eeb980a4b5bdc4ec1ed37721cb504_elex_floxif_glassworm_stop

.exe 6.4MB

2026-09-19_935eeb980a4b5bdc4ec1ed37721cb504_elex_floxif_glassworm_stop

IMPHASH 586694de0c822e86829bf1e2c856646f
SHA256 1442d3f64bd235be3f18daf8f3f8367eaa1ef24da9c8b71503d1cf307ec6dce9
MD5 935eeb980a4b5bdc4ec1ed37721cb504
SHA1 d2e3e83976da91ae530991ce246fe2cba134f874
SHA512 ad46a1d62cb43c04ec8b95857c851446eee91b92b5caf341f8b74f0e7e520141b515108c2cd6d906008575880e2615c33fb56ce34e73025008e8a001061cd2bd
SSDEEP 196608:W8fS2lm9RLslS+dmPC4IiXWrBfpMXOfCG0lG7:p9lCL3jqYX6FJCFG7
TLSH
T11E6633223EE0D6B1E17125F07ABA877595B2FC390825948F53E84B192F386538F2D736
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ba:33:6d:96:8b:b4:de:ad:5f:06:3e:54:66:91:b5:f7:8d:82:1b:9c:32:89:c4:cf:4d:06:28:4b:d8:8f:68:f8

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Bandisoft,O=Bandisoft,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Chains

Jan 4, 2022

CN=Bandisoft,O=Bandisoft,L=Yeongdeungpo-gu,ST=Seoul,C=KR

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

26:d1:a4:b9:38:b3:f9:3c:cd:09:49:94:f8:be:4b:92:6e:5d:a4:8c

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Bandisoft,O=Bandisoft,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Chains

Jan 4, 2022

CN=Bandisoft,O=Bandisoft,L=Yeongdeungpo-gu,ST=Seoul,C=KR

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Bandisoft,O=Bandisoft,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Serial Number

1f:f4:a4:9d:4c:ac:03:27:a3:fe:9c:d7:1e:31:cb:4a

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 29, 2020 - Mar 26, 2023

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2020 - Jan 22, 2032

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

311213

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\devel\inst\bin.2008\xstub.pdb

kernel32

InterlockedIncrement InterlockedDecrement lstrcmpiW LeaveCriticalSection RaiseException EnterCriticalSection MultiByteToWideChar InitializeCriticalSection DeleteCriticalSection SetErrorMode FlushInstructionCache SetCurrentDirectoryW MulDiv CopyFileW GetCurrentThreadId SetLastError CreateMutexW MoveFileW GetUserDefaultUILanguage GetVersion GetCurrentThread GlobalAlloc CreateThread SetUnhandledExceptionFilter GetCurrentProcessId WideCharToMultiByte InterlockedExchange lstrlenA GetSystemInfo ReadFile SetFilePointer SetFilePointerEx SetFileTime WriteFile IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetModuleFileNameA GetStdHandle LCMapStringW GetEnvironmentStringsW FreeEnvironmentStringsW LoadLibraryExW IsValidCodePage GetOEMCP GetACP GetCPInfo HeapCreate TlsFree TlsSetValue TlsAlloc TlsGetValue GetStartupInfoW SetConsoleCtrlHandler IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime ExitThread VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetStringTypeW SetHandleCount GetFileType GetStartupInfoA RtlUnwind GetCommandLineW QueryPerformanceCounter InitializeCriticalSectionAndSpinCount LCMapStringA GetConsoleCP GetConsoleMode CompareStringW SetEnvironmentVariableA SetEnvironmentVariableW GetLocaleInfoW GetModuleHandleA SetStdHandle FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA CompareStringA Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalMemoryStatusEx GetFileSizeEx CreateFileW GetFileSize GetWindowsDirectoryW GetTempFileNameW GetTempPathW RemoveDirectoryW FindClose FindNextFileW SetFileAttributesW DeleteFileW FindFirstFileW GetExitCodeProcess GetStringTypeA CreateProcessW GetCurrentProcess GetProcAddress GetModuleHandleW lstrcpyW GetLastError GetFileAttributesW GetModuleFileNameW GlobalFree CreateDirectoryW GetSystemDirectoryW FreeLibrary LoadLibraryW lstrlenW ExitProcess FindResourceExW FindResourceW LoadResource LockResource SizeofResource TerminateThread GetTickCount Sleep CloseHandle GetExitCodeThread GetTimeZoneInformation WaitForSingleObject

user32

ReleaseCapture SetCapture TrackPopupMenuEx TrackMouseEvent UpdateWindow UnionRect SetWindowRgn GetPropW RegisterClassW RemovePropW SetPropW GetDesktopWindow GetWindowPlacement ClientToScreen InflateRect InvalidateRect SetRect GetWindowDC IsWindowEnabled SetScrollRange ScreenToClient SetScrollPos EnableWindow IsWindowVisible EndPaint BeginPaint DestroyWindow SetCursor SetRectEmpty DrawTextW GetSysColor ReleaseDC GetDC GetDlgItem GetFocus GetWindowTextLengthW GetWindowTextW SubtractRect IsRectEmpty SetScrollInfo AdjustWindowRectEx IntersectRect RegisterWindowMessageW SetTimer GetCursorPos AppendMenuW CreatePopupMenu SendMessageTimeoutW GetKeyState ShowWindow CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW KillTimer GetSystemMenu EnableMenuItem GetWindow MonitorFromWindow SetWindowPos SetWindowTextW LoadIconW PostQuitMessage PostMessageW CallWindowProcW DefWindowProcW GetWindowLongW SetWindowLongW MapWindowPoints GetClientRect TranslateAcceleratorW IsDialogMessageW GetNextDlgTabItem GetMessageW LoadAcceleratorsW CharNextW SetFocus GetParent MoveWindow EqualRect GetWindowRect OffsetRect MonitorFromPoint CopyRect GetSystemMetrics SystemParametersInfoW GetMonitorInfoW MonitorFromRect IsCharAlphaW SendMessageW FindWindowW MessageBoxW IsWindow DispatchMessageW TranslateMessage PeekMessageW PtInRect UnregisterClassA

gdi32

MoveToEx LineTo CreateRectRgn ExtTextOutW OffsetRgn CreateSolidBrush GetDeviceCaps SetBkColor ExcludeClipRect GetTextMetricsW SetBkMode GetStockObject SetWindowOrgEx CreateCompatibleBitmap SetTextColor CreateFontW BitBlt DeleteDC SelectObject CreateCompatibleDC CreateDIBSection DeleteObject GetObjectW

advapi32

EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken OpenThreadToken RegDeleteValueW RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyW RegCloseKey RegQueryValueExW RegOpenKeyExW FreeSid

shell32

SHGetPathFromIDListW ShellExecuteW SHBrowseForFolderW ord190 ord155 SHAppBarMessage ShellExecuteExW SHGetFolderPathW

ole32

CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoUninitialize

oleaut32

SysFreeString VariantInit SysAllocString VarUI4FromStr VariantClear

shlwapi

PathCanonicalizeW PathIsDirectoryW ord176

wininet

InternetReadFile InternetQueryDataAvailable InternetQueryOptionW HttpOpenRequestA HttpEndRequestW InternetWriteFile HttpSendRequestExW HttpSendRequestW InternetErrorDlg HttpQueryInfoW HttpAddRequestHeadersW InternetConnectA InternetSetOptionW InternetOpenW InternetCrackUrlA InternetCloseHandle

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-19_935eeb980a4b5bdc4ec1ed37721cb504_elex_floxif_glassworm_stop

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

generic