2026-09-23_eaf8aa8f837e17a0444da7d76d9ff5f8_elex_floxif_glassworm_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-23_eaf8aa8f837e17a0444da7d76d9ff5f8_elex_floxif_glassworm_stop
Size 6.4MB
Sample260924-apdagsxtbt
SHA256 e621f97ae80908c539b33d8cb35752ede1a6fd73abeacd4ae5cfeffb32d75450
MD5 eaf8aa8f837e17a0444da7d76d9ff5f8
SHA1 b98679b9ae6ad3fb7c3ad833e4cae37d3e1a001f
SHA512 4e172bbec19a573d3d7e499e8f26c50c09fc4b48490f94e3dc3adccc139565ed183efafb00be402e52cec1fc5a24c91b160c57cd2ba789fdacb166e3f2182d59
SSDEEP 196608:W8kSZlm9RLslS+dmPC4IiXWrBfpMXOfCG0lGp:GilCL3jqYX6FJCFGp
TLSH
T1136633223AE0D6B1E07125F07A7AD77595B2FC390825988F53E84B1D2F386528F2D736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-23_eaf8aa8f837e17a0444da7d76d9ff5f8_elex_floxif_glassworm_stop

File Explorer

2026-09-23_eaf8aa8f837e17a0444da7d76d9ff5f8_elex_floxif_glassworm_stop

.exe 6.4MB

2026-09-23_eaf8aa8f837e17a0444da7d76d9ff5f8_elex_floxif_glassworm_stop

IMPHASH 586694de0c822e86829bf1e2c856646f
SHA256 e621f97ae80908c539b33d8cb35752ede1a6fd73abeacd4ae5cfeffb32d75450
MD5 eaf8aa8f837e17a0444da7d76d9ff5f8
SHA1 b98679b9ae6ad3fb7c3ad833e4cae37d3e1a001f
SHA512 4e172bbec19a573d3d7e499e8f26c50c09fc4b48490f94e3dc3adccc139565ed183efafb00be402e52cec1fc5a24c91b160c57cd2ba789fdacb166e3f2182d59
SSDEEP 196608:W8kSZlm9RLslS+dmPC4IiXWrBfpMXOfCG0lGp:GilCL3jqYX6FJCFGp
TLSH
T1136633223AE0D6B1E07125F07A7AD77595B2FC390825988F53E84B1D2F386528F2D736
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

7c:fc:06:18:55:42:2e:04:55:d5:74:28:79:b0:e1:38:be:8a:fb:9d:d5:e8:38:51:e7:34:c8:8f:ed:a8:61:22

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Bandisoft,O=Bandisoft,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Chains

Jan 4, 2022

CN=Bandisoft,O=Bandisoft,L=Yeongdeungpo-gu,ST=Seoul,C=KR

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

76:53:44:9d:85:87:6e:5d:ce:b1:5a:6d:82:de:34:e1:73:bd:f3:5d

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Bandisoft,O=Bandisoft,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Chains

Jan 4, 2022

CN=Bandisoft,O=Bandisoft,L=Yeongdeungpo-gu,ST=Seoul,C=KR

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Bandisoft,O=Bandisoft,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Serial Number

1f:f4:a4:9d:4c:ac:03:27:a3:fe:9c:d7:1e:31:cb:4a

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 29, 2020 - Mar 26, 2023

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2020 - Jan 22, 2032

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

311213

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\devel\inst\bin.2008\xstub.pdb

kernel32

InterlockedIncrement InterlockedDecrement lstrcmpiW LeaveCriticalSection RaiseException EnterCriticalSection MultiByteToWideChar InitializeCriticalSection DeleteCriticalSection SetErrorMode FlushInstructionCache SetCurrentDirectoryW MulDiv CopyFileW GetCurrentThreadId SetLastError CreateMutexW MoveFileW GetUserDefaultUILanguage GetVersion GetCurrentThread GlobalAlloc CreateThread SetUnhandledExceptionFilter GetCurrentProcessId WideCharToMultiByte InterlockedExchange lstrlenA GetSystemInfo ReadFile SetFilePointer SetFilePointerEx SetFileTime WriteFile IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetModuleFileNameA GetStdHandle LCMapStringW GetEnvironmentStringsW FreeEnvironmentStringsW LoadLibraryExW IsValidCodePage GetOEMCP GetACP GetCPInfo HeapCreate TlsFree TlsSetValue TlsAlloc TlsGetValue GetStartupInfoW SetConsoleCtrlHandler IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime ExitThread VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetStringTypeW SetHandleCount GetFileType GetStartupInfoA RtlUnwind GetCommandLineW QueryPerformanceCounter InitializeCriticalSectionAndSpinCount LCMapStringA GetConsoleCP GetConsoleMode CompareStringW SetEnvironmentVariableA SetEnvironmentVariableW GetLocaleInfoW GetModuleHandleA SetStdHandle FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA CompareStringA Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalMemoryStatusEx GetFileSizeEx CreateFileW GetFileSize GetWindowsDirectoryW GetTempFileNameW GetTempPathW RemoveDirectoryW FindClose FindNextFileW SetFileAttributesW DeleteFileW FindFirstFileW GetExitCodeProcess GetStringTypeA CreateProcessW GetCurrentProcess GetProcAddress GetModuleHandleW lstrcpyW GetLastError GetFileAttributesW GetModuleFileNameW GlobalFree CreateDirectoryW GetSystemDirectoryW FreeLibrary LoadLibraryW lstrlenW ExitProcess FindResourceExW FindResourceW LoadResource LockResource SizeofResource TerminateThread GetTickCount Sleep CloseHandle GetExitCodeThread GetTimeZoneInformation WaitForSingleObject

user32

ReleaseCapture SetCapture TrackPopupMenuEx TrackMouseEvent UpdateWindow UnionRect SetWindowRgn GetPropW RegisterClassW RemovePropW SetPropW GetDesktopWindow GetWindowPlacement ClientToScreen InflateRect InvalidateRect SetRect GetWindowDC IsWindowEnabled SetScrollRange ScreenToClient SetScrollPos EnableWindow IsWindowVisible EndPaint BeginPaint DestroyWindow SetCursor SetRectEmpty DrawTextW GetSysColor ReleaseDC GetDC GetDlgItem GetFocus GetWindowTextLengthW GetWindowTextW SubtractRect IsRectEmpty SetScrollInfo AdjustWindowRectEx IntersectRect RegisterWindowMessageW SetTimer GetCursorPos AppendMenuW CreatePopupMenu SendMessageTimeoutW GetKeyState ShowWindow CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW KillTimer GetSystemMenu EnableMenuItem GetWindow MonitorFromWindow SetWindowPos SetWindowTextW LoadIconW PostQuitMessage PostMessageW CallWindowProcW DefWindowProcW GetWindowLongW SetWindowLongW MapWindowPoints GetClientRect TranslateAcceleratorW IsDialogMessageW GetNextDlgTabItem GetMessageW LoadAcceleratorsW CharNextW SetFocus GetParent MoveWindow EqualRect GetWindowRect OffsetRect MonitorFromPoint CopyRect GetSystemMetrics SystemParametersInfoW GetMonitorInfoW MonitorFromRect IsCharAlphaW SendMessageW FindWindowW MessageBoxW IsWindow DispatchMessageW TranslateMessage PeekMessageW PtInRect UnregisterClassA

gdi32

MoveToEx LineTo CreateRectRgn ExtTextOutW OffsetRgn CreateSolidBrush GetDeviceCaps SetBkColor ExcludeClipRect GetTextMetricsW SetBkMode GetStockObject SetWindowOrgEx CreateCompatibleBitmap SetTextColor CreateFontW BitBlt DeleteDC SelectObject CreateCompatibleDC CreateDIBSection DeleteObject GetObjectW

advapi32

EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken OpenThreadToken RegDeleteValueW RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyW RegCloseKey RegQueryValueExW RegOpenKeyExW FreeSid

shell32

SHGetPathFromIDListW ShellExecuteW SHBrowseForFolderW ord190 ord155 SHAppBarMessage ShellExecuteExW SHGetFolderPathW

ole32

CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoUninitialize

oleaut32

SysFreeString VariantInit SysAllocString VarUI4FromStr VariantClear

shlwapi

PathCanonicalizeW PathIsDirectoryW ord176

wininet

InternetReadFile InternetQueryDataAvailable InternetQueryOptionW HttpOpenRequestA HttpEndRequestW InternetWriteFile HttpSendRequestExW HttpSendRequestW InternetErrorDlg HttpQueryInfoW HttpAddRequestHeadersW InternetConnectA InternetSetOptionW InternetOpenW InternetCrackUrlA InternetCloseHandle

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-23_eaf8aa8f837e17a0444da7d76d9ff5f8_elex_floxif_glassworm_stop

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

generic