2026-10-01_be6da0014eb443771cad844521d4982d_elex_floxif_glassworm_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_be6da0014eb443771cad844521d4982d_elex_floxif_glassworm_mespinoza
Size 285KB
Sample261002-eqcskatt4l
SHA256 3d2123bf05963dad9a6c5dce2444e796e9daf69c3261957b93e8cc514ad33ab7
MD5 be6da0014eb443771cad844521d4982d
SHA1 fe20a1a1f99b392a9a70a426115e763a6f73ca94
SHA512 7489eb42ced7f81d74496c5f0a3db5ab0a5c0913fbb790bffb66e5abcbc85d175f9f58f6fa7861209ca9a05a6cea6b37ebc305e6d242c5e8e3df5730820081a9
SSDEEP 6144:xm7eAcjd9skUKv6amIVw9JJ2NXr4Q2n+fW3sBV+UdvrEFp7hKZK1f:xm7eAcrC3JJ2NXr4X+O3sBjvrEH7zf
TLSH
T1C3549C713245C3FAD5A201B078BD7B7E54A8E87C0B6520C7E3C90F6D4A6C9F21B7661A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-01_be6da0014eb443771cad844521d4982d_elex_floxif_glassworm_mespinoza

File Explorer

2026-10-01_be6da0014eb443771cad844521d4982d_elex_floxif_glassworm_mespinoza

.exe 285KB

2026-10-01_be6da0014eb443771cad844521d4982d_elex_floxif_glassworm_mespinoza

IMPHASH a14cadfbc16232633121c9c9bbacf1aa
SHA256 3d2123bf05963dad9a6c5dce2444e796e9daf69c3261957b93e8cc514ad33ab7
MD5 be6da0014eb443771cad844521d4982d
SHA1 fe20a1a1f99b392a9a70a426115e763a6f73ca94
SHA512 7489eb42ced7f81d74496c5f0a3db5ab0a5c0913fbb790bffb66e5abcbc85d175f9f58f6fa7861209ca9a05a6cea6b37ebc305e6d242c5e8e3df5730820081a9
SSDEEP 6144:xm7eAcjd9skUKv6amIVw9JJ2NXr4Q2n+fW3sBV+UdvrEFp7hKZK1f:xm7eAcrC3JJ2NXr4X+O3sBjvrEH7zf
TLSH
T1C3549C713245C3FAD5A201B078BD7B7E54A8E87C0B6520C7E3C90F6D4A6C9F21B7661A
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

69:e3:93:a9:a2:0d:fb:ab:3a:45:46:f7:a5:b0:ca:71:d6:ad:23:b4:bb:13:4e:74:a2:4c:53:0d:84:6b:bf:52

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Intel(R) Embedded Subsystems and IP Blocks Group,OU=EIG,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Chains

Nov 8, 2017

CN=Intel(R) Embedded Subsystems and IP Blocks Group,OU=EIG,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=Intel(R) Embedded Subsystems and IP Blocks Group,OU=EIG,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Subject

CN=Intel(R) Embedded Subsystems and IP Blocks Group,OU=EIG,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Serial Number

56:00:00:01:75:73:76:cd:78:ad:00:0c:9a:00:00:00:00:01:75

Issuer

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 8, 2016 - Nov 8, 2018

Subject

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Serial Number

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 28, 2015 - Jun 17, 2021

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Serial Number

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 15, 2013 - Aug 15, 2023

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Serial Number

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2014 - Mar 17, 2021

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:E892-D055-162F+OU=Thales TSS ESN:E892-D055-162F,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Serial Number

17:a7:17:a0:16:72:36:ef:9b:1e:c2:c6:65:fa:8c:20:28:ad:7f:75

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 24, 2015 - Apr 24, 2018

Minor OS version

Major OS version

Entry point

130872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\buildagent_prod\p4\1326309012\services\DAL\Src\VisualStudio\bin\Win32\Release\jhi_service.pdb

kernel32

GetModuleHandleW lstrlenA CreateFileA GetMailslotInfo CreateMailslotA ResetEvent OpenProcess GetProcAddress GetExitCodeProcess GetModuleFileNameW lstrcmpiW WideCharToMultiByte MultiByteToWideChar InitializeSListHead CreateEventW Sleep CreateFileW DeviceIoControl WriteFile ReadFile FreeLibrary LocalFree LoadLibraryW LocalAlloc CreateThread CopyFileW SetFileAttributesW FindNextFileW FindFirstFileW GetLastError VerifyVersionInfoW VerSetConditionMask ReleaseMutex CreateMutexW CreateSemaphoreW ReleaseSemaphore CloseHandle SetEvent WaitForSingleObject OpenEventA OutputDebugStringW GetProcessTimes OutputDebugStringA GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryExA VirtualQuery GetSystemInfo VirtualProtect RaiseException

user32

RegisterDeviceNotificationW UnregisterDeviceNotification

advapi32

SetSecurityDescriptorDacl GetSecurityDescriptorDacl CreateServiceW CloseServiceHandle OpenSCManagerW BuildExplicitAccessWithNameW AllocateAndInitializeSid SetServiceStatus ChangeServiceConfig2W SetEntriesInAclW DeleteService SetServiceObjectSecurity ControlService FreeSid StartServiceW InitializeSecurityDescriptor StartServiceCtrlDispatcherW OpenServiceW LookupAccountSidW QueryServiceObjectSecurity SetSecurityInfo DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey RegSetValueExW RegOpenKeyExW RegQueryValueExW RegisterServiceCtrlHandlerExW

ole32

CoCreateInstance CoInitialize CoInitializeEx CoUninitialize

oleaut32

GetErrorInfo VariantInit SafeArrayGetUBound SysFreeString SysAllocString VariantClear

teetransport

TEE_Transport_Create

msvcp140

??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_BADOFF@std@@3_JB ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ??Bid@locale@std@@QAEIXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAG@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z _Make_dir _Stat ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ?_Winerror_message@std@@YAKKPADK@Z ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPBDH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPBD@Z

vcruntime140

_except_handler4_common memset _CxxThrowException __CxxFrameHandler3 __vcrt_InitializeCriticalSectionEx strchr _purecall __std_exception_copy __std_exception_destroy __std_terminate memmove memchr memcpy

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vswprintf_s _set_fmode __stdio_common_vsprintf_s fsetpos _fseeki64 fputc fflush setvbuf fgetpos __stdio_common_vfprintf __acrt_iob_func fwrite _get_stream_buffer_pointers fclose __stdio_common_vsscanf fgetc ungetc

api-ms-win-crt-string-l1-1-0

strncpy_s strcat_s wcsncpy_s _stricmp strcpy_s toupper isalpha strnlen isdigit

api-ms-win-crt-runtime-l1-1-0

_getpid _invalid_parameter_noinfo _initialize_onexit_table _errno _crt_atexit _invalid_parameter_noinfo_noreturn _cexit _seh_filter_exe _set_app_type terminate _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit _exit __p___argc __p___wargv _c_exit _register_onexit_function _register_thread_local_exe_atexit_callback _controlfp_s

api-ms-win-crt-filesystem-l1-1-0

_wrename _waccess_s _wremove _lock_file _unlock_file

api-ms-win-crt-utility-l1-1-0

rand_s

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

139KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

116B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_be6da0014eb443771cad844521d4982d_elex_floxif_glassworm_mespinoza

PE Signature issue

kernel32

user32

advapi32

ole32

oleaut32

teetransport

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic