2026-10-25_72f673b626e998838a719408b7d86dd9_elex_floxif_glassworm_hijackloader_njrat

General

Target
2026-10-25_72f673b626e998838a719408b7d86dd9_elex_floxif_glassworm_hijackloader_njrat
Size 12.3MB
Sample261027-acrmcaxt6m
SHA256 ed14738b086b2457aa8c83dc7bb5263b4a017c4c77549ae77885ecd83a31c6e4
MD5 72f673b626e998838a719408b7d86dd9
SHA1 d651cec80aa84b4c2927c54e673fa4efc58a1a9e
SHA512 cc44d3ce4eda050d8a0ba76931bedf22476ad077455528835b30b84966c1c7d0743e44be32a2c575c9f6bbafc632f19e20c0dbf878f45f9223bfb7ff6c1cd252
SSDEEP 196608:XeY314wwr47SH7gSQWU2m+JiSQ343DgFhRAvQlcslcXjTmt4yXVbrYAEmF9:XR3+wU4767pu+J3UF3AvEhGj6txxB9
TLSH
T1F6D6014A7264C3E9C0B7023D6EAAF3D459BAFCE46E61B627B38513ED48F05104C9536B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-25_72f673b626e998838a719408b7d86dd9_elex_floxif_glassworm_hijackloader_njrat

File Explorer

2026-10-25_72f673b626e998838a719408b7d86dd9_elex_floxif_glassworm_hijackloader_njrat

.exe 12.3MB

2026-10-25_72f673b626e998838a719408b7d86dd9_elex_floxif_glassworm_hijackloader_njrat

IMPHASH 8e9d11ec1043d08c4a7d0a713cf3ba75
SHA256 ed14738b086b2457aa8c83dc7bb5263b4a017c4c77549ae77885ecd83a31c6e4
MD5 72f673b626e998838a719408b7d86dd9
SHA1 d651cec80aa84b4c2927c54e673fa4efc58a1a9e
SHA512 cc44d3ce4eda050d8a0ba76931bedf22476ad077455528835b30b84966c1c7d0743e44be32a2c575c9f6bbafc632f19e20c0dbf878f45f9223bfb7ff6c1cd252
SSDEEP 196608:XeY314wwr47SH7gSQWU2m+JiSQ343DgFhRAvQlcslcXjTmt4yXVbrYAEmF9:XR3+wU4767pu+J3UF3AvEhGj6txxB9
TLSH
T1F6D6014A7264C3E9C0B7023D6EAAF3D459BAFCE46E61B627B38513ED48F05104C9536B
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

6b:1f:53:23:27:69:fd:08:1d:4c:9a:f2:8c:71:83:ef:e4:82:0c:fc:70:18:b6:50:80:c9:75:94:fb:e4:dd:20

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=3876899,CN=Blizzard Entertainment\, Inc.,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US,2.5.4.15=#131450726976617465206f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Nov 28, 2024

SERIALNUMBER=3876899,CN=Blizzard Entertainment\, Inc.,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US,2.5.4.15=#131450726976617465206f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=3876899,CN=Blizzard Entertainment\, Inc.,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US,2.5.4.15=#131450726976617465206f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=3876899,CN=Blizzard Entertainment\, Inc.,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US,2.5.4.15=#131450726976617465206f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

0d:1d:f3:14:e9:79:07:11:80:07:30:0a:3e:ad:c4:ec

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 5, 2023 - Oct 6, 2026

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

684960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\starcraft_pipeline@2\Starcraft\build\bin\ReleaseAntiCheat\StarCraft.pdb

Name

.text

Size

9.2MB

Virtual Size

9.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

503KB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

224KB

Virtual Size

223KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

515KB

Virtual Size

514KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=46, id=259, version=26213,

count=3, id=199, version=41118,

count=33, id=259, version=26706,

count=65, id=261, version=26706,

count=37, id=260, version=26706,

count=38, id=260, version=26213,

count=2, id=262, version=26213,

count=1, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=1, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=208, id=261, version=26213,

count=1, id=110, productName=VS2005 build 50727, version=50727,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=2, id=257, version=27040,

count=43, id=257, version=26213,

count=544, id=1, productName=Unmarked objects,

count=45, productName=Unmarked objects (old),

count=233, id=260, version=27051,

count=1173, id=261, version=27051,

count=1, id=256, version=27051,

count=1, id=255, version=27051,

count=2, id=151,

count=1, id=258, version=27051,

2026-10-25_72f673b626e998838a719408b7d86dd9_elex_floxif_glassworm_hijackloader_njrat

PE Signature issue

user32

clientsdk

generic

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-25_72f673b626e998838a719408b7d86dd9_elex_floxif_glassworm_hijackloader_njrat

PE Signature issue

user32

clientsdk

generic