2026-04-20_9d41bd8b3fd8173f5af38a07b540cdc0_amadey_elex_glassworm_luca-stealer_magniber_njrat_remcos_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-20_9d41bd8b3fd8173f5af38a07b540cdc0_amadey_elex_glassworm_luca-stealer_magniber_njrat_remcos_revil
Size 2.5MB
Sample260420-km41jahv21
SHA256 449f88915f57c302cf3b7513ceccb3d5ece4e61247fbde1a570466de7a38e611
MD5 9d41bd8b3fd8173f5af38a07b540cdc0
SHA1 318a17f471ab5466dd750663d627f3f03927dc85
SHA512 635fa032d951edacf223aa4ebf4ce741a18623f2b7c5d042fc80f557681569728c1751bdc323974672ab83be73c48a0c5b9bf3cb72785880644040d9959a8014
SSDEEP 49152:n0yA2hISBKbzsHWpqZAoPDZn+AJ8sB4QA7PMn3Pc3MDQDDxLNiXicJFFRGNzj3:nzXszsNuQAsPo7wRGpj3
TLSH
T1ADC5BF22B8C0C4B3F6B31171B6FDB73514AD9910132A41CF629676684BB27D2363DF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-20_9d41bd8b3fd8173f5af38a07b540cdc0_amadey_elex_glassworm_luca-stealer_magniber_njrat_remcos_revil

File Explorer

2026-04-20_9d41bd8b3fd8173f5af38a07b540cdc0_amadey_elex_glassworm_luca-stealer_magniber_njrat_remcos_revil

.exe 2.5MB

2026-04-20_9d41bd8b3fd8173f5af38a07b540cdc0_amadey_elex_glassworm_luca-stealer_magniber_njrat_remcos_revil

IMPHASH 2ae03c6ac6e8e97227a32d3cf8526202
SHA256 449f88915f57c302cf3b7513ceccb3d5ece4e61247fbde1a570466de7a38e611
MD5 9d41bd8b3fd8173f5af38a07b540cdc0
SHA1 318a17f471ab5466dd750663d627f3f03927dc85
SHA512 635fa032d951edacf223aa4ebf4ce741a18623f2b7c5d042fc80f557681569728c1751bdc323974672ab83be73c48a0c5b9bf3cb72785880644040d9959a8014
SSDEEP 49152:n0yA2hISBKbzsHWpqZAoPDZn+AJ8sB4QA7PMn3Pc3MDQDDxLNiXicJFFRGNzj3:nzXszsNuQAsPo7wRGpj3
TLSH
T1ADC5BF22B8C0C4B3F6B31171B6FDB73514AD9910132A41CF629676684BB27D2363DF9A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1075272

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\qzwang\Documents\workspace\InputSafe\winsrc\browser\Release\KeyScrambler.pdb

keyscramblerie

KSUninit KSInit KSSetOption KSUpdate KSSetKeyInfo KSPromptForKey KSOptions

kernel32

GetCurrentProcess OpenEventW SetDllDirectoryW ExitProcess Sleep CreateEventW SetEvent ResetEvent GetCurrentThreadId DecodePointer GetLocaleInfoW PeekConsoleInputA GetNumberOfConsoleInputEvents WaitForSingleObject OpenProcess CloseHandle CreateFileW DeleteFileW MoveFileExW DeleteCriticalSection FlushConsoleInputBuffer GetModuleHandleA GlobalMemoryStatus LoadLibraryA SetEndOfFile WriteConsoleW SetStdHandle CreateThread WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA GetTimeZoneInformation SetConsoleCtrlHandler EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetModuleFileNameW SetConsoleMode LoadLibraryExW FindResourceW LoadResource SizeofResource GetLastError GetModuleHandleExW EnterCriticalSection RaiseException LeaveCriticalSection lstrcmpiW GetModuleHandleW GetProcAddress FreeLibrary FindClose FindNextFileW SetLastError FindFirstFileW InterlockedDecrement GetDateFormatW ReadConsoleW SetFilePointerEx ReadFile GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize GetFileType GetCurrentThread LCMapStringW GetACP WriteFile GetStdHandle GetModuleFileNameA LocalFree MultiByteToWideChar GetCommandLineW GetCommandLineA InterlockedFlushSList RtlUnwind GetCurrentProcessId InterlockedIncrement ReadConsoleInputA GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW OutputDebugStringA WideCharToMultiByte IsDebuggerPresent OutputDebugStringW EncodePointer HeapAlloc HeapFree GetProcessHeap InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA FormatMessageW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount CompareStringW QueryPerformanceCounter

user32

MapWindowPoints SetWindowRgn UpdateWindow GetParent GetWindowRect GetMonitorInfoW MessageBoxA GetClientRect CharNextW SetWindowPos GetUserObjectInformationW CallWindowProcW CreateWindowExW SetWindowLongW LoadBitmapW LoadCursorW GetClassInfoExW RegisterClassExW UnregisterClassW DestroyWindow DefWindowProcW BroadcastSystemMessageW PeekMessageW GetMessageW TranslateMessage DispatchMessageW MessageBoxW PostMessageW KillTimer EndPaint BeginPaint SetTimer GetWindow GetWindowLongW MonitorFromWindow ReleaseDC GetDC GetProcessWindowStation

gdi32

SelectObject CreateCompatibleDC DeleteObject DeleteDC GetObjectA GetDeviceCaps GetDIBits CreateCompatibleBitmap CreateRoundRectRgn GetObjectW BitBlt

advapi32

RegOpenKeyExW ReportEventA RegisterEventSourceA RegDeleteKeyW RegCloseKey RegQueryInfoKeyW RegEnumKeyExW DeregisterEventSource RegSetValueExW RegCreateKeyExW RegDeleteValueW ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityInfo GetSecurityDescriptorSacl

shell32

SHGetFolderPathW ShellExecuteW

ole32

CoUninitialize CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoInitialize

oleaut32

VarUI4FromStr SysFreeString

shlwapi

PathCombineW PathRemoveFileSpecW

comctl32

InitCommonControlsEx

wintrust

WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WinVerifyTrust WTHelperGetProvCertFromChain

crypt32

CertGetNameStringW CryptQueryObject CertEnumCertificatesInStore CertGetCertificateContextProperty CertFreeCertificateContext CertCloseStore CertNameToStrW CryptMsgClose

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-20_9d41bd8b3fd8173f5af38a07b540cdc0_amadey_elex_glassworm_luca-stealer_magniber_njrat_remcos_revil

keyscramblerie

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

wintrust

crypt32

generic