2026-05-04_439906d66bd1388b4e49a09e3958a9ec_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-05-04_439906d66bd1388b4e49a09e3958a9ec_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample260504-sd1whsat3k
SHA256 9e4f22601a55d73212774c62c98f772703a70ed9c446facaf09b0947996706c0
MD5 439906d66bd1388b4e49a09e3958a9ec
SHA1 50d2682f6adb6fc9a84fcf8a6171cc9ca5383292
SHA512 89fcfcbb3bb8b67133503721fc4d2d88adfa343bb4e6512aefd8309ae6e1d19ae3143f51e8ae03bfee379a0abbcddcfb4c7a6afdce0c1b70b2c7dbefa5c89ce1
SSDEEP 49152:v0OXFz9wvJpGVbEfOXBBDEhOt5TB34alrfUbmtObRR:vVrwvJpGfBBDEiTCqcbBb
TLSH
T1C316BE52667198E1E38903B2E4A9877D7527EFEFC73C13C72694306099644EBE22EF05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-04_439906d66bd1388b4e49a09e3958a9ec_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-05-04_439906d66bd1388b4e49a09e3958a9ec_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-05-04_439906d66bd1388b4e49a09e3958a9ec_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 2508b7fe1985cf8d0a1bbb5d6f0a1524
SHA256 9e4f22601a55d73212774c62c98f772703a70ed9c446facaf09b0947996706c0
MD5 439906d66bd1388b4e49a09e3958a9ec
SHA1 50d2682f6adb6fc9a84fcf8a6171cc9ca5383292
SHA512 89fcfcbb3bb8b67133503721fc4d2d88adfa343bb4e6512aefd8309ae6e1d19ae3143f51e8ae03bfee379a0abbcddcfb4c7a6afdce0c1b70b2c7dbefa5c89ce1
SSDEEP 49152:v0OXFz9wvJpGVbEfOXBBDEhOt5TB34alrfUbmtObRR:vVrwvJpGfBBDEiTCqcbBb
TLSH
T1C316BE52667198E1E38903B2E4A9877D7527EFEFC73C13C72694306099644EBE22EF05
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5951

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError GetCurrentThreadId GetCurrentProcessId SetUnhandledExceptionFilter QueryPerformanceCounter GetProcAddress CloseHandle TerminateProcess Sleep GetTickCount HeapAlloc DeleteCriticalSection EnterCriticalSection WriteFile WaitForSingleObject GetProcessHeap CreateFileW ExitProcess GetModuleFileNameW GetStartupInfoW IsDebuggerPresent GetCommandLineW ReadFile RaiseException FormatMessageW TlsGetValue GetModuleHandleA InitializeCriticalSection TlsSetValue TlsAlloc HeapSetInformation LoadLibraryW GetCPInfo TlsFree GetFileAttributesW CompareStringW GetStringTypeW LCMapStringW SetStdHandle IsValidCodePage DeleteFileW GetConsoleCP LocalAlloc DecodePointer ReleaseMutex CreateFileA GetFileSize EncodePointer VirtualFree lstrlenW LoadLibraryA GetLocaleInfoW CreateDirectoryW GetFullPathNameW UnmapViewOfFile GetExitCodeProcess ExpandEnvironmentStringsW

user32

TranslateMessage LoadStringW ShowWindow DestroyWindow ReleaseDC DefWindowProcW MessageBoxW PostQuitMessage SetWindowLongW GetWindowLongW GetMessageW GetDlgItem GetWindowRect PostMessageW SendMessageW IsWindow GetParent SetTimer LoadIconW SetForegroundWindow GetSysColor EndPaint BeginPaint SetCursor KillTimer GetWindowTextW UpdateWindow CharUpperW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-04_439906d66bd1388b4e49a09e3958a9ec_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic