2026-10-28_96aa12f5262ffe5fbfceba19c4553200_elex_glassworm_poet-rat_remcos_stop_tobfy

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_96aa12f5262ffe5fbfceba19c4553200_elex_glassworm_poet-rat_remcos_stop_tobfy
Size 9.9MB
Sample261029-25ayvacf74
SHA256 c20f4cc2a1342353e47eaf5fae34ce996adae65869f91bedbe5b6663453883ac
MD5 96aa12f5262ffe5fbfceba19c4553200
SHA1 6330504c5880b80467253d902ffd3e49d3b1eb29
SHA512 7b17847f0995da1f32c5bd0b1ed541a23bef8bf9e81e32fa69af6dec6364332eb0562f142fe443d12583f99cf53d61a1453f25367fab8eca9b77bbc91ded04bd
SSDEEP 98304:ik9FKdtrO8cwOBcz5RscH8dk92Tl3FDxXKupnyR47QwP5ExjXR:ikTKdtrO8cwOS2u8dkATfIwI
TLSH
T1E6A69E03E7C686B6D49D267048EB7326B336EC602BF547C397A43D69ACB13C16C75289
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-28_96aa12f5262ffe5fbfceba19c4553200_elex_glassworm_poet-rat_remcos_stop_tobfy

.exe 9.9MB

2026-10-28_96aa12f5262ffe5fbfceba19c4553200_elex_glassworm_poet-rat_remcos_stop_tobfy

IMPHASH 4edb4f5d6d1705e1f7c74ecdad4258bf
SHA256 c20f4cc2a1342353e47eaf5fae34ce996adae65869f91bedbe5b6663453883ac
MD5 96aa12f5262ffe5fbfceba19c4553200
SHA1 6330504c5880b80467253d902ffd3e49d3b1eb29
SHA512 7b17847f0995da1f32c5bd0b1ed541a23bef8bf9e81e32fa69af6dec6364332eb0562f142fe443d12583f99cf53d61a1453f25367fab8eca9b77bbc91ded04bd
SSDEEP 98304:ik9FKdtrO8cwOBcz5RscH8dk92Tl3FDxXKupnyR47QwP5ExjXR:ikTKdtrO8cwOS2u8dkATfIwI
TLSH
T1E6A69E03E7C686B6D49D267048EB7326B336EC602BF547C397A43D69ACB13C16C75289
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

26:eb:31:31:c9:0c:d4:64:1b:8c:19:ae:77:ee:fe:0e:2c:33:4c:39:a3:f1:99:3d:4c:7e:55:8a:4c:84:fc:5c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=4489370,CN=NCH Software\, Inc.,O=NCH Software\, Inc.,L=Greenwood Village,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Oct 13, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

05:bf:20:1b:48:6d:fc:33:84:d7:cf:f2:1c:13:80:67

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 31, 2025 - Mar 28, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

4848713

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\sourcecode\wavepad\release\WavePad.pdb

kernel32

MapViewOfFile GetExitCodeProcess GetFileSize GetLocaleInfoW GetProcessHeap GetCurrentProcessId EnterCriticalSection DisconnectNamedPipe ConnectNamedPipe DeviceIoControl CreateNamedPipeW InterlockedExchangeAdd CreateProcessW CreatePipe MultiByteToWideChar GetVersionExW WaitForMultipleObjects GlobalFree SetEvent CreateEventW InterlockedExchange InitializeCriticalSection VerSetConditionMask GlobalLock LoadResource GlobalUnlock LocalFree GetTickCount WriteFile FindResourceW DeleteCriticalSection VerifyVersionInfoW SetThreadPriority CopyFileW LocalAlloc GlobalHandle GetProcAddress FreeResource DeleteFileW CreateMutexW GetLastError GetCPInfo GetModuleHandleW GlobalAlloc SizeofResource Sleep GetUserDefaultUILanguage CloseHandle lstrlenW GetOverlappedResult InterlockedIncrement DuplicateHandle WaitForSingleObject GetDriveTypeW ResetEvent GetUserDefaultLCID LockResource GetStdHandle CreateFileW MulDiv GetLogicalDriveStringsW GetVersionExA GetTempPathW CreateDirectoryW FlushFileBuffers GetCurrentProcess GetCurrentThreadId GetCommandLineW GetShortPathNameW SetFilePointerEx GetThreadPriority WaitNamedPipeW CancelIo LoadLibraryExW FileTimeToSystemTime GetFileAttributesW PeekNamedPipe SetLastError FreeLibrary LoadLibraryA GetUserDefaultLangID ReadFile LoadLibraryW lstrlenA CreateFileA OpenFileMappingW GetEnvironmentVariableW GetLogicalDrives FindNextFileW GetCurrentDirectoryW GetTimeFormatW GetVolumeInformationW GetFileTime CreateFileMappingW QueryPerformanceCounter HeapAlloc GetACP GetTimeZoneInformation SetEnvironmentVariableW SetFileAttributesW GlobalMemoryStatusEx lstrcpyW GetPrivateProfileStringW MoveFileExW ResumeThread SetUnhandledExceptionFilter SetFilePointer RemoveDirectoryW IsBadReadPtr GetEnvironmentVariableA GetPrivateProfileIntW VirtualQuery CreateToolhelp32Snapshot ReadProcessMemory GetSystemInfo GetModuleFileNameA RtlCaptureContext FindFirstFileW SuspendThread OpenProcess GetThreadContext SetEndOfFile GetLongPathNameW GetPrivateProfileSectionNamesW TerminateProcess Process32FirstW GetModuleFileNameW GetDiskFreeSpaceExW FindClose QueryPerformanceFrequency GetComputerNameW IsBadWritePtr SystemTimeToTzSpecificLocalTime GetSystemTime UnmapViewOfFile FileTimeToLocalFileTime SetCurrentDirectoryW CreateThread HeapFree GetCurrentDirectoryA GetStartupInfoW Process32NextW ExitProcess SetErrorMode GlobalSize ProcessIdToSessionId ReleaseMutex WideCharToMultiByte GetFileSizeEx LeaveCriticalSection GetCurrentThread InterlockedDecrement MoveFileW GetSystemTimeAsFileTime HeapReAlloc UnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetStartupInfoA GetOEMCP IsValidCodePage SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode GetConsoleCP RtlUnwind GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA RaiseException VirtualAlloc VirtualFree HeapCreate HeapDestroy GetStringTypeW GetStringTypeA GetLocaleInfoA GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree LCMapStringA LCMapStringW HeapSize

advapi32

GetLengthSid GetTokenInformation RegOpenKeyExW RegEnumKeyExW OpenProcessToken GetSidSubAuthority RegEnumValueW RegQueryValueExW RegOpenKeyW RegEnumKeyW RegCreateKeyExW RegSetKeySecurity RegQueryInfoKeyW RegCloseKey GetSidLengthRequired InitializeSecurityDescriptor SetSecurityDescriptorDacl InitializeSid GetAce InitializeAcl AddAccessAllowedAce ConvertSidToStringSidW CryptEncrypt CryptDeriveKey RegDeleteValueW CheckTokenMembership DuplicateTokenEx SetFileSecurityW CryptAcquireContextW CryptDuplicateKey RegDeleteKeyW RegSetValueExW CryptDestroyKey CryptCreateHash CryptHashData CryptDestroyHash GetUserNameW CryptDecrypt FreeSid AllocateAndInitializeSid

comctl32

PropertySheetW ImageList_DragEnter ImageList_GetImageInfo ImageList_Merge ImageList_DrawEx ImageList_BeginDrag CreatePropertySheetPageW ImageList_EndDrag ImageList_GetIconSize ImageList_DragLeave _TrackMouseEvent ImageList_Create ImageList_DragMove ImageList_Destroy ImageList_DragShowNolock ImageList_GetIcon ImageList_AddMasked ImageList_ReplaceIcon InitCommonControlsEx ord17

comdlg32

GetOpenFileNameW GetSaveFileNameW

gdi32

CreateBrushIndirect SetBitmapBits TextOutW GetTextCharset EnumFontFamiliesExW CreateDCW Polyline SetDIBitsToDevice CreateRoundRectRgn PtInRegion SetTextAlign GetBitmapBits GetViewportExtEx GetTextMetricsA CreateCompatibleBitmap SetStretchBltMode SetDIBits GetStockObject GetWindowExtEx CreateDIBSection GetClipBox CreateFontIndirectW LineTo BitBlt SetTextColor GetTextExtentPoint32W CreateSolidBrush IntersectClipRect CombineRgn CreateDIBitmap GetCurrentObject PatBlt SetPixel CreatePatternBrush CreateBitmap CreatePen GetObjectW SetBrushOrgEx CreateCompatibleDC SetDCBrushColor CreateRectRgnIndirect SelectObject PolyPolyline GetTextMetricsW GetDeviceCaps SetBkMode StretchBlt GetBkMode ExtTextOutW CreateRectRgn DeleteDC GetDIBits ExcludeClipRect SetViewportExtEx SetViewportOrgEx GetObjectA SetBkColor MoveToEx CreateFontW DeleteObject SetWindowExtEx SelectClipRgn Polygon

msacm32

acmStreamOpen acmFormatDetailsW acmStreamSize acmFormatTagEnumW acmStreamUnprepareHeader acmDriverDetailsW acmStreamClose acmStreamConvert acmDriverEnum acmDriverClose acmDriverOpen acmFormatEnumW acmStreamPrepareHeader

ole32

CoResumeClassObjects CoRegisterClassObject CoInitializeEx CoUninitialize CoRevokeClassObject CoInitializeSecurity CoInitialize CoTaskMemFree CreateStreamOnHGlobal CoCreateGuid CoSetProxyBlanket CoCreateInstance PropVariantClear CoAddRefServerProcess CLSIDFromString CoTaskMemAlloc StringFromCLSID CoGetMalloc StringFromGUID2

oleaut32

SysStringByteLen VariantInit SysFreeString VariantClear SysAllocStringByteLen SysAllocString OleLoadPicture SysAllocStringLen OleLoadPicturePath

shell32

CommandLineToArgvW DragAcceptFiles ord155 SHChangeNotify Shell_NotifyIconW SHParseDisplayName SHGetDesktopFolder ShellExecuteW ShellExecuteExW SHGetFolderPathW DragFinish SHGetPathFromIDListW ShellExecuteA DragQueryFileW SHQueryRecycleBinW SHGetMalloc SHBrowseForFolderW SHCreateShellItem ord680 SHEmptyRecycleBinW

shlwapi

StrCmpLogicalW SHDeleteKeyW SHDeleteEmptyKeyW PathCompactPathExW

user32

ReleaseDC CreatePopupMenu DestroyCursor DrawFocusRect SendMessageW SetWindowPos SendDlgItemMessageW EndDialog GetClassNameW ScrollWindowEx EnumChildWindows InsertMenuItemW CreateWindowExW AppendMenuW DialogBoxIndirectParamW GetClipboardFormatNameW GetScrollBarInfo PostMessageW MonitorFromPoint GetWindowLongW OffsetRect EndMenu GetDlgItemTextW ChangeClipboardChain GetWindowThreadProcessId EqualRect WindowFromPoint GetClassInfoW MsgWaitForMultipleObjects IsIconic SetWindowsHookExW RegisterClassExW SetScrollInfo RegisterClipboardFormatW SetCursor SetClipboardData ShowWindow ModifyMenuW DrawTextExW LoadCursorW MapDialogRect EnumDisplayDevicesW EnableWindow GetAsyncKeyState GetMessageW GetKeyState UpdateWindow SetMenuInfo GetWindowWord GetCapture ClientToScreen GetSysColor DrawStateW GetMenuItemInfoW GetParent MoveWindow RemovePropW ReleaseCapture SetPropW SetDlgItemTextW InsertMenuW GetDlgItem BeginPaint IsClipboardFormatAvailable MapWindowPoints AllowSetForegroundWindow CheckMenuItem CallNextHookEx LoadImageW GetClassNameA GetDlgCtrlID UnhookWindowsHookEx GetForegroundWindow SetClassLongW GetClipboardData GetWindowDC SystemParametersInfoW DrawIconEx GetMenuItemID GetCursor SetActiveWindow DispatchMessageW SetCapture DefWindowProcW InvalidateRgn TranslateMDISysAccel GetDC EndPaint CheckDlgButton KillTimer SetTimer GetMessageExtraInfo RemoveMenu IsZoomed DrawTextW RedrawWindow SetWindowLongW DefFrameProcW GetPropW SetClipboardViewer IsWindow GetDesktopWindow GetScrollInfo IsWindowEnabled GetWindowRect CallWindowProcW DestroyIcon CountClipboardFormats IsWindowVisible GetWindowTextW GetComboBoxInfo WindowFromDC GetSysColorBrush GetClientRect ScreenToClient GetMessagePos GetMonitorInfoW GetSystemMetrics DrawEdge AttachThreadInput SetMenuItemBitmaps GetSubMenu MessageBoxW GetUpdateRect wvsprintfW SetMenu MapVirtualKeyW SetMenuDefaultItem GetKeyNameTextW SetWindowPlacement SetDlgItemInt RegisterWindowMessageW CheckRadioButton ShowScrollBar GetMenuInfo UnregisterDeviceNotification RegisterHotKey GetMenuItemRect NotifyWinEvent FindWindowExW MonitorFromWindow ShowWindowAsync IsCharAlphaW GetMenuBarInfo SetWindowRgn ValidateRect GetDlgItemInt CheckMenuRadioItem AdjustWindowRectEx UnregisterHotKey DeleteMenu GetNextDlgGroupItem AdjustWindowRect PostQuitMessage IsDlgButtonChecked GetAncestor GetIconInfo EmptyClipboard InflateRect GetPriorityClipboardFormat RegisterClassW CreateIconIndirect keybd_event GetActiveWindow IsDialogMessageW DialogBoxParamW TrackPopupMenu DefMDIChildProcW OpenClipboard SetWindowWord GetMenuItemCount PeekMessageW GetWindowPlacement CloseClipboard FlashWindowEx SetForegroundWindow EnumDisplaySettingsW DestroyMenu EnableMenuItem LoadIconW FindWindowW GetWindow GetMenu DrawMenuBar EnumWindows FrameRect SetWindowTextW GetWindowTextLengthW CopyImage SetFocus TranslateMessage InvalidateRect PtInRect GetKeyboardState LoadStringW DestroyWindow GetCursorInfo SetMenuItemInfoW CreateDialogIndirectParamW wsprintfW WaitForInputIdle FillRect CreateDialogParamW GetFocus RegisterDeviceNotificationW

winmm

mixerGetID mixerGetLineInfoW waveInUnprepareHeader waveInOpen waveOutWrite waveOutReset waveOutOpen waveInGetDevCapsW waveInReset waveOutGetVolume waveInStart waveInMessage waveInClose waveOutGetDevCapsW waveOutClose mixerGetControlDetailsW waveOutSetVolume waveOutRestart waveInGetNumDevs waveOutMessage waveOutPause waveOutPrepareHeader waveOutGetNumDevs mixerGetLineControlsW mixerSetControlDetails waveInPrepareHeader waveInAddBuffer waveOutUnprepareHeader waveInStop midiInGetNumDevs

ws2_32

inet_addr __WSAFDIsSet recv select ntohs ioctlsocket send closesocket setsockopt WSAGetLastError WSAStartup gethostbyname htons gethostname connect gethostbyaddr socket getsockopt

rpcrt4

UuidFromStringW RpcStringFreeW UuidToStringW UuidCreate

msimg32

AlphaBlend GradientFill

secur32

DecryptMessage EncryptMessage InitializeSecurityContextW ApplyControlToken QueryContextAttributesW DeleteSecurityContext FreeCredentialsHandle FreeContextBuffer AcquireCredentialsHandleW

crypt32

CertFindCertificateInStore CertVerifySubjectCertificateContext CryptQueryObject CertFreeCertificateContext CertCloseStore

wintrust

WinVerifyTrust

netapi32

NetUserGetInfo NetApiBufferFree

wininet

InternetAutodial InternetQueryOptionA InternetGetConnectedState InternetAutodialHangup

iphlpapi

GetIpAddrTable GetAdaptersAddresses

dnsapi

DnsQuery_W DnsRecordListFree

Name

.text

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

974KB

Virtual Size

973KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

112KB

Virtual Size

663KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

297KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_96aa12f5262ffe5fbfceba19c4553200_elex_glassworm_poet-rat_remcos_stop_tobfy

kernel32

advapi32

comctl32

comdlg32

gdi32

msacm32

ole32

oleaut32

shell32

shlwapi

user32

winmm

ws2_32

rpcrt4

msimg32

secur32

crypt32

wintrust

netapi32

wininet

iphlpapi

dnsapi

generic