2026-11-09_726c69a10518820491522ad6907e8a03_elex_emotet_glassworm_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_726c69a10518820491522ad6907e8a03_elex_emotet_glassworm_stealc_stop
Size 4.0MB
Sample261110-tmdb9avyds
SHA256 c5ca2c3cd14d9a173e92e21896ab5e5143b7c05d8621937f4c5bc4b64685f8db
MD5 726c69a10518820491522ad6907e8a03
SHA1 552983f33113d18ec299bd287697c8bc01c85eb0
SHA512 cf91d9f2e2216940cacf35b95bd52dbd021019e5f234e3d103ce1217da6150a989cf3c18e49cc39e42be7986003d27bc733e91461ab5fdb7dca81c0ce4287c55
SSDEEP 98304:wpK9I43PjMFk/h7cBz2PJx6Z9TpfTCgrrasA:UehwBz2PUCgrrR
TLSH
T14E167E50BFC9C2B5C68652BB40BE932E5366E7546B2066C395143E2FDAB03E33E35385
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-09_726c69a10518820491522ad6907e8a03_elex_emotet_glassworm_stealc_stop

.exe 4.0MB

2026-11-09_726c69a10518820491522ad6907e8a03_elex_emotet_glassworm_stealc_stop

IMPHASH 8816932b0270acd717c74d863f6c6e12
SHA256 c5ca2c3cd14d9a173e92e21896ab5e5143b7c05d8621937f4c5bc4b64685f8db
MD5 726c69a10518820491522ad6907e8a03
SHA1 552983f33113d18ec299bd287697c8bc01c85eb0
SHA512 cf91d9f2e2216940cacf35b95bd52dbd021019e5f234e3d103ce1217da6150a989cf3c18e49cc39e42be7986003d27bc733e91461ab5fdb7dca81c0ce4287c55
SSDEEP 98304:wpK9I43PjMFk/h7cBz2PJx6Z9TpfTCgrrasA:UehwBz2PUCgrrR
TLSH
T14E167E50BFC9C2B5C68652BB40BE932E5366E7546B2066C395143E2FDAB03E33E35385
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

08:31:7e:f0:c3:bc:88:8a:ec:71:ed:0d:2d:80:c0:6e:3a:e3:1b:b0:bf:ac:12:3a:5a:53:20:1f:7c:ba:dc:e4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=110111-5221158,CN=SGA Solutions Co.\,Ltd.,O=SGA Solutions Co.\,Ltd.,STREET=54 Gwangjinmal-ro,L=Uiwang-si,ST=Gyeonggi-do,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Oct 23, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

79:81:fd:27:24:e4:3d:02:4b:10:06:fd

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 16, 2026 - Sep 18, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

2716525

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\SVN\agent\PASS Agent Vista\Release_jenkins\PASS Agent Vista.pdb

kernel32

GetFileTime GetTempFileNameA GetDiskFreeSpaceA RtlUnwind GetTimeZoneInformation GetSystemTimeAsFileTime HeapFree UnhandledExceptionFilter IsDebuggerPresent HeapAlloc RaiseException HeapReAlloc VirtualProtect VirtualQuery ExitThread ExitProcess HeapSize IsValidCodePage GetConsoleCP GetConsoleMode HeapCreate HeapDestroy FatalAppExitA GetStdHandle LCMapStringA LCMapStringW SetHandleCount GetFileType GetTimeFormatA GetDateFormatA GetFileSizeEx EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW CompareStringW SetEnvironmentVariableW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter SetConsoleCtrlHandler InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetLocaleInfoW GetProcessHeap LocalFileTimeToFileTime GetFileAttributesExA SetErrorMode LocalLock LocalUnlock GetFullPathNameA GetVolumeInformationA DuplicateHandle SetCurrentDirectoryA MoveFileExA FormatMessageW WaitForMultipleObjects PeekNamedPipe VerSetConditionMask VerifyVersionInfoA SleepEx QueryPerformanceFrequency SetEndOfFile UnlockFile LockFile FlushFileBuffers GetStringTypeExA GetCurrentDirectoryA GetPrivateProfileStringA WritePrivateProfileStringA GetPrivateProfileIntA GetOEMCP GetCPInfo GlobalFlags GetThreadLocale GetAtomNameA TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue GetModuleHandleW GetModuleFileNameW GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA lstrcmpA FreeResource GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom CompareStringA lstrcmpW SuspendThread ResumeThread SetThreadPriority GlobalFree GlobalSize GlobalAlloc GlobalLock GlobalUnlock GetLocalTime GetFileInformationByHandle FileTimeToLocalFileTime FindFirstVolumeA FindNextVolumeA FindVolumeClose CreatePipe GetStartupInfoA GetComputerNameA GetSystemInfo GetSystemDefaultLCID CreateFileW MoveFileW VirtualAlloc VirtualFree LoadLibraryExA LocalAlloc CreateProcessA GetProcessVersion GetExitCodeProcess TerminateProcess lstrcmpiA GetCommandLineA LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection SetUnhandledExceptionFilter GetCurrentThreadId lstrcpynA InterlockedDecrement SetFileAttributesW DeleteFileW InterlockedExchange InterlockedIncrement MoveFileA CopyFileA GetSystemTime SetFileTime SetEvent SetSystemTime SetComputerNameA lstrlenA lstrlenW GetVersion SetFilePointer MulDiv GetDriveTypeA FindFirstFileA FindNextFileA FindClose RemoveDirectoryA GetShortPathNameA GetWindowsDirectoryA SetFileAttributesA DeleteFileA ReadFile DeviceIoControl SetLastError WriteFile GetDiskFreeSpaceExA CreateFileA GetFileSize GetFileAttributesW GetFileAttributesA CreateSemaphoreA CreateThread ReleaseSemaphore GetEnvironmentVariableA SetEnvironmentVariableA GetModuleFileNameA UnmapViewOfFile OpenFileMappingA CreateFileMappingA MapViewOfFile GetVersionExA ExpandEnvironmentStringsA GetSystemDirectoryA GetTickCount Sleep SystemTimeToFileTime FileTimeToSystemTime GetCurrentProcessId OpenProcess CreateDirectoryA FindResourceA LoadResource LockResource FreeLibrary SizeofResource GetCurrentProcess GetModuleHandleA GetLogicalDriveStringsA QueryDosDeviceA WideCharToMultiByte GetACP MultiByteToWideChar CreateEventA WaitForSingleObject CloseHandle GetLastError FormatMessageA LocalFree LoadLibraryA GetProcAddress GetUserDefaultLCID

user32

IsWindow SetFocus GetWindowTextLengthA GetWindowTextA GetForegroundWindow GetLastActivePopup SetActiveWindow BeginDeferWindowPos EndDeferWindowPos GetDlgItem GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints ScrollWindow TrackPopupMenuEx TrackPopupMenu SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos SetForegroundWindow ShowScrollBar UpdateWindow MessageBoxA CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA AdjustWindowRectEx GetParent EqualRect DeferWindowPos GetScrollInfo SetScrollInfo SetWindowPlacement GetDlgCtrlID DefWindowProcA CallWindowProcA PtInRect DispatchMessageA TranslateMessage PeekMessageA wsprintfA PostMessageA GetMenu GetWindowLongA SetWindowLongA GetFocus OffsetRect IntersectRect MapVirtualKeyA GetWindowPlacement GetWindowRect GetWindow EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen ScreenToClient SetWindowsHookExA CallNextHookEx GetMessageA GetActiveWindow IsWindowVisible GetKeyState GetCursorPos ValidateRect GetMenuState GetMenuStringA AppendMenuA GetMenuItemID InsertMenuA GetMenuItemCount GetSubMenu RemoveMenu GetDesktopWindow GrayStringA DrawTextExA DrawTextA TabbedTextOutA InvalidateRect InflateRect SetRect CopyRect DrawStateA ChangeDisplaySettingsA ExitWindowsEx ShowWindow CheckMenuItem EnableMenuItem ModifyMenuA LoadBitmapA GetMenuCheckMarkDimensions InsertMenuItemA SetMenuItemBitmaps CheckDlgButton GetSystemMetrics LoadIconA RemovePropA GetPropA SetPropA GetClassNameA GetClassLongA GetCapture IsChild WinHelpA SendDlgItemMessageA RegisterWindowMessageA SetWindowPos GetKeyNameTextA SendMessageA GetSysColor FillRect GetClientRect RedrawWindow SetTimer KillTimer EnableWindow UnregisterDeviceNotification RegisterDeviceNotificationA DrawIcon IsIconic CheckRadioButton GetDlgItemInt GetDlgItemTextA SetDlgItemInt SetDlgItemTextA IsDlgButtonChecked IsDialogMessageA SetWindowTextA MoveWindow IsWindowEnabled ScrollWindowEx GetWindowThreadProcessId PostQuitMessage SetCursor ShowOwnedPopups EndDialog GetNextDlgTabItem CreateDialogIndirectParamA GetSysColorBrush LoadCursorA DestroyMenu DeleteMenu SetCapture WindowFromPoint ReleaseCapture WaitMessage DestroyIcon CharUpperA GetDialogBaseUnits IsClipboardFormatAvailable MessageBeep GetTabbedTextExtentA UnregisterClassA SetRectEmpty TranslateAcceleratorA BringWindowToTop CreatePopupMenu LockWindowUpdate GetDCEx UnionRect SetParent GetSystemMenu IsRectEmpty UnpackDDElParam ReuseDDElParam LoadMenuA GetMenuBarInfo LoadAcceleratorsA SystemParametersInfoA GetMenuItemInfoA

gdi32

SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetCurrentPositionEx ArcTo PolyDraw PolylineTo PolyBezierTo ExtSelectClipRgn CreateDIBPatternBrushPt CreatePatternBrush CreateBitmap SelectPalette PlayMetaFileRecord SelectObject EnumMetaFile PlayMetaFile ExtCreatePen CreateHatchBrush GetDCOrgEx CreateRectRgnIndirect PatBlt SetRectRgn CombineRgn GetTextMetricsA GetCharWidthA CreateFontA StretchDIBits StartPage EndPage SetAbortProc AbortDoc EndDoc GetViewportExtEx StartDocA SelectClipPath GetPixel GetClipRgn SelectClipRgn DeleteObject SetColorAdjustment SetArcDirection SetMapperFlags SetTextCharacterExtra SetTextJustification SetTextAlign MoveToEx LineTo OffsetClipRgn IntersectClipRect ExcludeClipRect GetClipBox SetMapMode ModifyWorldTransform SetWorldTransform SetGraphicsMode SetTextColor SetStretchBltMode SetROP2 SetPolyFillMode SetBkMode SetBkColor RestoreDC SaveDC CopyMetaFileA Escape ExtTextOutA TextOutA RectVisible PtVisible GetTextExtentPoint32A RoundRect LPtoDP DPtoLP GetMapMode GetBkColor CreateSolidBrush GetStockObject GetObjectA CreateFontIndirectA SetPixel CreateRectRgn GetWindowExtEx BitBlt Rectangle CreateCompatibleDC CreateCompatibleBitmap CreatePen CreateDCA GetDeviceCaps GetObjectType DeleteDC

comdlg32

GetFileTitleA

winspool.drv

GetJobA OpenPrinterA ClosePrinter DocumentPropertiesA

advapi32

CryptGetHashParam CryptHashData CryptCreateHash CryptAcquireContextA CryptImportKey CryptReleaseContext CryptEncrypt CryptDestroyKey GetFileSecurityA SetFileSecurityA RegCreateKeyA RegQueryValueA RegSetValueA ConvertStringSecurityDescriptorToSecurityDescriptorA RegEnumValueA RegEnumKeyA RegOpenKeyExA RegDeleteKeyA RegOpenKeyA RegDeleteValueA RegSetValueExA RegCreateKeyExA RegQueryValueExA RegCloseKey ChangeServiceConfigA QueryServiceConfigA DuplicateTokenEx SetTokenInformation CreateProcessAsUserA LookupPrivilegeValueA AdjustTokenPrivileges IsValidSecurityDescriptor GetSecurityDescriptorDacl GetAclInformation LookupAccountSidW GetAce DeleteAce DeleteService ControlService QueryServiceStatus OpenServiceA StartServiceA OpenSCManagerA CreateServiceA CloseServiceHandle OpenProcessToken GetTokenInformation LookupAccountSidA OpenEventLogA ReadEventLogA CloseEventLog InitializeSecurityDescriptor SetSecurityDescriptorDacl CryptDestroyHash

shell32

DragQueryFileA SHGetFileInfoA ExtractIconA SHGetSpecialFolderLocation SHGetPathFromIDListA SHGetMalloc DragFinish

comctl32

_TrackMouseEvent

shlwapi

PathIsUNCA PathStripToRootA PathRemoveExtensionA PathFindExtensionA PathFileExistsW PathFileExistsA PathMatchSpecA PathFindFileNameA PathStripPathA StrFormatByteSizeA PathRemoveFileSpecW

ole32

CoTreatAsClass CreateBindCtx ReleaseStgMedium CoTaskMemAlloc OleDuplicateData StringFromCLSID ReadClassStg ReadFmtUserTypeStg OleRegGetUserType WriteClassStg WriteFmtUserTypeStg SetConvertStg CoTaskMemFree CoCreateGuid OleUninitialize OleInitialize CoUninitialize StringFromGUID2 CoDisconnectObject CoCreateInstance CLSIDFromString CoInitializeEx

oleaut32

SysReAllocStringLen SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayDestroy SafeArrayUnlock SafeArrayLock SafeArrayPutElement SafeArrayPtrOfIndex SafeArrayGetElement SafeArrayCopy SafeArrayAllocDescriptor SafeArrayAllocData VariantCopy SafeArrayRedim SafeArrayCreate VarDateFromStr SafeArrayGetElemsize SafeArrayGetLBound SafeArrayGetUBound SafeArrayAccessData SafeArrayUnaccessData LoadRegTypeLi LoadTypeLi RegisterTypeLi VariantInit VariantChangeType VariantClear SysStringByteLen SysAllocStringByteLen SysStringLen SysAllocStringLen SysFreeString VarBstrFromDate VarBstrFromCy VarBstrFromDec VarDecFromStr SafeArrayGetDim VarCyFromStr

netapi32

NetShareEnum NetApiBufferFree NetShareDel NetShareSetInfo

wldap32

ord41 ord27 ord301 ord33 ord46 ord35 ord60 ord200 ord30 ord26 ord50 ord143 ord217 ord211 ord22 ord32 ord79

psapi

EnumProcessModules EnumProcesses GetModuleFileNameExA

ws2_32

ioctlsocket WSACleanup inet_ntoa gethostbyname WSAStartup ntohs ntohl inet_addr gethostname closesocket send WSAGetLastError WSACreateEvent WSASetEvent WSAResetEvent WSAEnumNetworkEvents WSAWaitForMultipleEvents WSAEventSelect WSACloseEvent recv WSAIoctl setsockopt getsockname bind htons getsockopt getpeername socket connect WSASetLastError freeaddrinfo getaddrinfo accept listen htonl sendto recvfrom select __WSAFDIsSet

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_726c69a10518820491522ad6907e8a03_elex_emotet_glassworm_stealc_stop

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

netapi32

wldap32

psapi

ws2_32

userenv

generic