2026-10-01_4e66b18e58ff6a0eb4ef6b68e66b9e8d_elex_glassworm_mespinoza_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_4e66b18e58ff6a0eb4ef6b68e66b9e8d_elex_glassworm_mespinoza_remcos
Size 1.9MB
Sample261002-sdtr7sv1hx
SHA256 ac0bd9813eeef66b5b3bfecfdcc961d2f9a70ebe374b0af9fbbd3135ad84337a
MD5 4e66b18e58ff6a0eb4ef6b68e66b9e8d
SHA1 892ff22575d74892c9c6dacea3807b4602f90f5d
SHA512 3c3b271f2d2c7f683683779fd44b1485b375ad74bfda4adf9c8d42184c20756ed2992433962715fe3687c9786dab6df32f7d6c511469a437663686948ac917e3
SSDEEP 24576:GWyX36mBnJLfIQxcmGeW+A12AbjEL4DdWb21wfORdIyfNYyfND:GW036eJLjxcmG6gAodt1EYYY
TLSH
T1AC954B93FA627722E5540877A8BF2755AD61FC43073069F3E98A36D282304D0D636F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-01_4e66b18e58ff6a0eb4ef6b68e66b9e8d_elex_glassworm_mespinoza_remcos

.exe 1.9MB

2026-10-01_4e66b18e58ff6a0eb4ef6b68e66b9e8d_elex_glassworm_mespinoza_remcos

IMPHASH 3eb5342f06a2dc712d2d350478eccce0
SHA256 ac0bd9813eeef66b5b3bfecfdcc961d2f9a70ebe374b0af9fbbd3135ad84337a
MD5 4e66b18e58ff6a0eb4ef6b68e66b9e8d
SHA1 892ff22575d74892c9c6dacea3807b4602f90f5d
SHA512 3c3b271f2d2c7f683683779fd44b1485b375ad74bfda4adf9c8d42184c20756ed2992433962715fe3687c9786dab6df32f7d6c511469a437663686948ac917e3
SSDEEP 24576:GWyX36mBnJLfIQxcmGeW+A12AbjEL4DdWb21wfORdIyfNYyfND:GW036eJLjxcmG6gAodt1EYYY
TLSH
T1AC954B93FA627722E5540877A8BF2755AD61FC43073069F3E98A36D282304D0D636F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

68:10:9b:36:09:03:24:f2:14:40:c0:da:d8:f4:93:4c:ed:81:3a:8e:66:7c:20:42:ca:1f:a7:0b:73:0d:8e:2e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91440400MA7FWRMCXK,CN=珠海市莫停之科技有限公司,O=珠海市莫停之科技有限公司,L=珠海市,ST=广东省,C=CN,1.3.6.1.4.1.311.60.2.1.1=#0c09e78fa0e6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 31, 2026

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

Serial Number

7b:44:70:92:7a:f6:c8:9e:3e:2c:2e:2c:d9:40:da:75

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 21, 2025 - Jan 21, 2028

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

291902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\jekins_work\workspace\sysoptasst_build_2022\product\win32\dbginfo\asintercept.pdb

kernel32

TerminateThread GetCurrentProcessId MulDiv CreateThread ResetEvent SetFileAttributesW MoveFileW GetTempPathW CreateMutexW LoadLibraryExW lstrcmpiW FreeResource GetCurrentThreadId UnmapViewOfFile ExpandEnvironmentStringsA PeekNamedPipe GetStdHandle GetFileType VerifyVersionInfoA QueryPerformanceFrequency GetSystemDirectoryA GetModuleHandleA VerSetConditionMask SleepEx LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList EncodePointer InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent WaitForSingleObjectEx OutputDebugStringW Sleep SetLastError InterlockedDecrement InterlockedIncrement CreateProcessW lstrlenW GlobalFree GlobalUnlock GlobalLock GlobalAlloc InterlockedExchange GetTickCount SetEvent CreateEventW OpenEventW WaitForSingleObject WaitForMultipleObjects DecodePointer RaiseException LoadLibraryA GetWindowsDirectoryW GetLocalTime MultiByteToWideChar GetSystemDirectoryW GetVersionExW InitializeCriticalSectionAndSpinCount TerminateProcess Module32FirstW CreateToolhelp32Snapshot GetCurrentProcess OpenProcess GetProcAddress LoadLibraryW GetModuleHandleW QueryDosDeviceW GetLogicalDriveStringsW WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW DeleteFileW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection FreeLibrary GetLastError CreateDirectoryW GetFileAttributesW GetModuleFileNameW FindResourceExW FindResourceW LoadResource LockResource SizeofResource WideCharToMultiByte GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy WriteFile GetFileSize CloseHandle CreateFileW FormatMessageA ReadFile

user32

WindowFromPoint MonitorFromPoint EnumChildWindows EnumDisplayMonitors GetDC IsWindow ReleaseDC PrintWindow GetWindowRect GetWindowDC UnregisterClassW IsRectEmpty GetSystemMetrics PostThreadMessageW SetWindowTextW SetTimer IsDialogMessageW GetCursorPos GetNextDlgTabItem UpdateLayeredWindow DispatchMessageW TranslateMessage GetMessageW PeekMessageW SetWindowRgn IsIconic IsChild GetLayeredWindowAttributes SetFocus ScreenToClient GetClassInfoExW SetActiveWindow SystemParametersInfoW GetWindow MonitorFromWindow MapWindowPoints EnableWindow GetActiveWindow CharNextW LoadBitmapW IsWindowEnabled EndPaint BeginPaint ReleaseCapture SetCapture GetClientRect GetMonitorInfoW SetForegroundWindow AttachThreadInput GetForegroundWindow PostMessageW MoveWindow DestroyWindow ClientToScreen IntersectRect KillTimer CallWindowProcW GetWindowLongW SetWindowLongW EqualRect IsWindowVisible DrawTextW GetDesktopWindow CreateWindowExW RegisterClassExW LoadCursorW DefWindowProcW FindWindowW GetWindowThreadProcessId SendMessageW GetDlgCtrlID InflateRect SetRect DrawIconEx PtInRect SetCursor DestroyIcon SetRectEmpty GetDlgItem ShowWindow CopyRect OffsetRect GetParent DrawFrameControl LoadImageW LoadIconW SetWindowPos InvalidateRect GetAncestor GetFocus

gdi32

CreateRoundRectRgn CreateBitmap StretchBlt ExtSelectClipRgn CombineRgn SetViewportOrgEx RoundRect CreateRectRgn GetClipRgn CreatePen MoveToEx LineTo CreateRectRgnIndirect Rectangle GetViewportOrgEx SetStretchBltMode DeleteDC CreateCompatibleDC BitBlt CreateDIBSection DeleteObject SelectObject GetObjectW CreateCompatibleBitmap GetDeviceCaps CreateFontIndirectW GetStockObject SetBkColor SetBkMode SetTextColor SaveDC GetTextColor GetCurrentObject ExtTextOutW RectInRegion RestoreDC TextOutW GetTextExtentPoint32W SelectClipRgn OffsetRgn

advapi32

CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryInfoKeyW RegEnumKeyExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegQueryValueExW RegSetValueExW RegCloseKey CryptEncrypt RegCreateKeyExW RegOpenKeyW

shell32

ExtractIconW ShellExecuteW

ole32

CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoInitialize CoUninitialize CreateStreamOnHGlobal

oleaut32

SysFreeString VarUI4FromStr

shlwapi

PathAddBackslashW PathFindFileNameW PathAppendW PathRemoveFileSpecW PathIsDirectoryW PathFileExistsW StrToIntW StrToIntA

comctl32

DrawShadowText _TrackMouseEvent

msimg32

AlphaBlend

msvcp140

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ

gdiplus

GdipCreateFontFromLogfontW GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipCloneFontFamily GdipGetFontCollectionFamilyList GdipGetFontCollectionFamilyCount GdipPrivateAddFontFile GdipDeletePrivateFontCollection GdipNewPrivateFontCollection GdipSetStringFormatAlign GdipMeasureString GdipDrawString GdipSetTextRenderingHint GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatFlags GdipDeleteBrush GdipCloneBrush GdipCreateSolidFill GdipFillRectangleI GdipResetWorldTransform GdipDrawImageRectRectI GdipRotateWorldTransform GdipTranslateWorldTransform GdipImageRotateFlip GdipLoadImageFromFile GdipSetImageAttributesColorMatrix GdipSetClipPath GdipSetSmoothingMode GdipCreateBitmapFromHICON GdipCreateBitmapFromStream GdipCreateHBITMAPFromBitmap GdipDrawImageRectRect GdipDrawImagePointsRectI GdipCloneBitmapArea GdipLoadImageFromStream GdipFillRectangle GdipSetPenDashStyle GdipDrawLinesI GdipSetCompositingQuality GdipSetInterpolationMode GdipSetPixelOffsetMode GdipGetFamily GdipAddPathStringI GdipGetFontSize GdipGraphicsClear GdipDrawImageRectI GdipDrawPath GdipAddPathArcI GdipFillPath GdipDrawLine GdipSetPenMode GdipSetPenStartCap GdipSetPenEndCap GdipDeletePen GdipCreateFromHDC GdipDeleteStringFormat GdipCreateStringFormat GdipDrawImageI GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipDeleteGraphics GdipDisposeImage GdipCloneImage GdipAlloc GdipFree GdiplusShutdown GdiplusStartup GdipCreateImageAttributes GdipClosePathFigure GdipAddPathRectangleI GdipAddPathPieI GdipDeletePath GdipCreatePath GdipCreatePen1 GdipDisposeImageAttributes

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

ws2_32

freeaddrinfo accept listen recvfrom getaddrinfo WSACleanup WSAStartup WSAIoctl setsockopt ntohs htons getsockopt getsockname getpeername connect sendto ioctlsocket gethostname WSAGetLastError __WSAFDIsSet select closesocket bind send recv WSASetLastError socket

psapi

GetModuleFileNameExW

vcruntime140

__vcrt_InitializeCriticalSectionEx strstr wcsstr wcschr wcsrchr strchr memchr memcmp __std_exception_copy _purecall __std_terminate memset memcpy strrchr _except_handler3 __RTDynamicCast __std_exception_destroy _CxxThrowException _except_handler4_common memmove __CxxFrameHandler3

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode _callnewh _recalloc realloc calloc free

api-ms-win-crt-runtime-l1-1-0

_cexit _controlfp_s _register_thread_local_exe_atexit_callback _c_exit _crt_atexit strerror __sys_nerr _seh_filter_exe _register_onexit_function _initialize_onexit_table terminate _set_app_type _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _getpid _beginthreadex _initterm _initterm_e _exit exit _invalid_parameter_noinfo_noreturn _errno _invalid_parameter_noinfo

api-ms-win-crt-string-l1-1-0

wcscat_s wcscat _stricmp wcsspn wcscspn strcspn tolower wcscpy_s _strdup _wcsicmp _wcsupr_s _wcsnicmp isalpha isalnum strncpy isspace _wcslwr_s strspn wcsncat wcsnlen wcscmp wmemcpy_s wcsncpy_s wcslen strncmp strnlen strcmp strlen wcsncmp

api-ms-win-crt-convert-l1-1-0

strtol strtoll strtoul _wtof atoi _wtoi wcstoul

api-ms-win-crt-stdio-l1-1-0

fflush __stdio_common_vfprintf __stdio_common_vsprintf_s __stdio_common_vsprintf fclose _open fwrite _wfopen __stdio_common_vswprintf_s __stdio_common_vswprintf fseek __stdio_common_vswscanf _close _lseeki64 __p__commode fread fputc _write __stdio_common_vsnprintf_s fputs fopen fgets __acrt_iob_func __stdio_common_vsscanf _read _set_fmode

api-ms-win-crt-multibyte-l1-1-0

_mbspbrk _mbsicmp _mbscmp _mbschr

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64 _mktime64

api-ms-win-crt-utility-l1-1-0

qsort abs labs srand

api-ms-win-crt-math-l1-1-0

__setusermatherr _except1 floor ceil

api-ms-win-crt-filesystem-l1-1-0

_waccess _stat64 _fstat64 _access

api-ms-win-crt-locale-l1-1-0

setlocale _configthreadlocale

api-ms-win-crt-environment-l1-1-0

getenv

wldap32

ord143 ord217 ord46 ord211 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord60

Name

.text

Size

539KB

Virtual Size

538KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

113KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_4e66b18e58ff6a0eb4ef6b68e66b9e8d_elex_glassworm_mespinoza_remcos

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

msvcp140

gdiplus

version

ws2_32

psapi

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

wldap32

generic