2026-10-30_dc859eed325bc1d7049d86f1d51531bd_akira_elex_glassworm

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-30_dc859eed325bc1d7049d86f1d51531bd_akira_elex_glassworm
Size 11.9MB
Sample261030-sfbz6set4p
SHA256 4591aff9847ddfa8a8208c62351892f2f1f040f099efcb253c1df8d4f140c238
MD5 dc859eed325bc1d7049d86f1d51531bd
SHA1 cf5cce62f45bb9073485b3c398ed25f32243603c
SHA512 27a1d0a2815079e43e48ba03ba5ca6716824bc2d806822c949d6e8e441733e18e53966c6abd7c22ffbcb811f53ff46a443c44135647542235514d84fefa8bc9e
SSDEEP 98304:0quaQZVTSqFooMV8dAMFsbvuQdWLV0Ed+1WDX8+5NP4oKsVn4WYHFgZhB:0qua4RSeoOAhvuQdWZ0KhnNP4ocWYwhB
TLSH
T198C66C56B9271D4AC97B3A7A44BFD73D9A3903192A139BE34D0E5C31AF4B3C42A0934D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-30_dc859eed325bc1d7049d86f1d51531bd_akira_elex_glassworm

.exe 11.9MB

2026-10-30_dc859eed325bc1d7049d86f1d51531bd_akira_elex_glassworm

IMPHASH 0ed27ea82f733987bf99cbfc061185ba
SHA256 4591aff9847ddfa8a8208c62351892f2f1f040f099efcb253c1df8d4f140c238
MD5 dc859eed325bc1d7049d86f1d51531bd
SHA1 cf5cce62f45bb9073485b3c398ed25f32243603c
SHA512 27a1d0a2815079e43e48ba03ba5ca6716824bc2d806822c949d6e8e441733e18e53966c6abd7c22ffbcb811f53ff46a443c44135647542235514d84fefa8bc9e
SSDEEP 98304:0quaQZVTSqFooMV8dAMFsbvuQdWLV0Ed+1WDX8+5NP4oKsVn4WYHFgZhB:0qua4RSeoOAhvuQdWZ0KhnNP4ocWYwhB
TLSH
T198C66C56B9271D4AC97B3A7A44BFD73D9A3903192A139BE34D0E5C31AF4B3C42A0934D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

7a:3d:09:95:dc:57:df:bc:2d:11:b1:cf:6a:0d:e8:b1:5b:9f:b0:fc:5d:52:30:0e:68:83:70:1d:83:a6:45:89

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91440300319639316N,CN=深圳市零点零一科技有限公司,O=深圳市零点零一科技有限公司,L=深圳市,ST=广东省,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13085368656e7a68656e,1.3.6.1.4.1.311.60.2.1.2=#13094775616e67646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 17, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

04:f7:1a:4a:fd:9e:dd:e8:14:f1:cf:a7

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 9, 2025 - Sep 9, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

5104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

OpenProcessToken SystemFunction036

bcrypt

BCryptGenRandom

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler CancelIo CancelIoEx CloseHandle CompareStringOrdinal ConnectNamedPipe CopyFileExW CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateHardLinkW CreateIoCompletionPort CreateMutexA CreateMutexW CreatePipe CreateProcessW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DisconnectNamedPipe DuplicateHandle ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetConsoleMode GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLogicalProcessorInformation GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetNamedPipeInfo GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeProcThreadAttributeList LoadLibraryA LockFileEx MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFile ReadFileEx ReleaseMutex ReleaseSRWLockExclusive RemoveDirectoryW RtlCaptureContext SetConsoleMode SetConsoleTextAttribute SetCurrentDirectoryW SetEnvironmentVariableW SetFileAttributesW SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetNamedPipeHandleState SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableSRW SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnlockFile UnmapViewOfFile UpdateProcThreadAttribute WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx lstrlenW GetTimeZoneInformationForYear DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection VirtualProtect VirtualQuery

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile

ole32

CoTaskMemFree

shell32

SHGetKnownFolderPath

userenv

GetUserProfileDirectoryW

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSAIoctl WSAPoll WSARecv WSARecvFrom WSASend WSASendMsg WSASendTo WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv recvfrom select send sendto setsockopt shutdown socket

msvcrt

__getmainargs __initenv __p__commode __p__fmode __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _fmode _fpreset _initterm _iob _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset pow signal strlen strncmp vfprintf

Name

.text

Size

5.5MB

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

828KB

Virtual Size

827KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

173KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_dc859eed325bc1d7049d86f1d51531bd_akira_elex_glassworm

advapi32

bcrypt

kernel32

ntdll

ole32

shell32

userenv

ws2_32

msvcrt

generic