2026-05-28_a8a3fa8bd646348cb3327cfdb13eee69_amadey_elex_glassworm_luca-stealer_magniber_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-28_a8a3fa8bd646348cb3327cfdb13eee69_amadey_elex_glassworm_luca-stealer_magniber_njrat
Size 1.1MB
Sample260528-mfsp2aev5s
SHA256 9736917e5131695b4c5ccf378746e0741255bd5abb729584e17f2bc8f8c86d0b
MD5 a8a3fa8bd646348cb3327cfdb13eee69
SHA1 276b72a5965a7b490cbbc85dfa529989751529fe
SHA512 9d7e2cb8119b70e85124ae0bbb70db2dd790d1983fc30a1911f1e2717c51eb804067a980235d5514cb81c1ca54695b5a6a1b0b88740e22647e0164d6683b6e8a
SSDEEP 24576:JnNC3T+3NSA5IvsgqRMiIreN/2gQ5/rrAIBJC:JnNC3T+B2sAygHA
TLSH
T18B35BF11B9D140F1EAE2203145AAD73BAE7D75284324A9DBA3D42E75CE313C0A73E75E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-28_a8a3fa8bd646348cb3327cfdb13eee69_amadey_elex_glassworm_luca-stealer_magniber_njrat

File Explorer

2026-05-28_a8a3fa8bd646348cb3327cfdb13eee69_amadey_elex_glassworm_luca-stealer_magniber_njrat

.exe 1.1MB

2026-05-28_a8a3fa8bd646348cb3327cfdb13eee69_amadey_elex_glassworm_luca-stealer_magniber_njrat

IMPHASH dec6ce05469dcecb59b9df7a03b2df98
SHA256 9736917e5131695b4c5ccf378746e0741255bd5abb729584e17f2bc8f8c86d0b
MD5 a8a3fa8bd646348cb3327cfdb13eee69
SHA1 276b72a5965a7b490cbbc85dfa529989751529fe
SHA512 9d7e2cb8119b70e85124ae0bbb70db2dd790d1983fc30a1911f1e2717c51eb804067a980235d5514cb81c1ca54695b5a6a1b0b88740e22647e0164d6683b6e8a
SSDEEP 24576:JnNC3T+3NSA5IvsgqRMiIreN/2gQ5/rrAIBJC:JnNC3T+B2sAygHA
TLSH
T18B35BF11B9D140F1EAE2203145AAD73BAE7D75284324A9DBA3D42E75CE313C0A73E75E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

54509

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW HeapCreate HeapDestroy ExitProcess OpenProcess WaitForSingleObject TerminateProcess CloseHandle CreateToolhelp32Snapshot Process32FirstW Process32NextW FormatMessageW LocalFree Beep InitializeSListHead IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetCurrentProcess GetStdHandle WriteFile GetModuleFileNameW GetProcAddress FreeLibrary GetModuleHandleExW EnterCriticalSection DeleteCriticalSection LeaveCriticalSection HeapFree GetLastError SetLastError GetCurrentThread HeapAlloc EnumSystemLocalesW LoadLibraryExW CompareStringW TlsAlloc TlsFree TlsGetValue TlsSetValue GetDateFormatW GetLocaleInfoW GetTempPathW GetTimeFormatW GetUserDefaultLCID InitializeCriticalSectionAndSpinCount IsValidLocale LCMapStringW OutputDebugStringW GetFileType SetStdHandle GetOEMCP GetACP GetCPInfo IsValidCodePage GetCommandLineA GetCommandLineW FindFirstFileExW FindNextFileW FindClose MultiByteToWideChar GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte SetEnvironmentVariableW SetConsoleCtrlHandler GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc ReadFile ReadConsoleW SetFilePointerEx WriteConsoleW CreateFileW InterlockedFlushSList InterlockedPushEntrySList RtlUnwind EncodePointer RaiseException InitializeCriticalSection DuplicateHandle CreatePipe CreateProcessW LoadLibraryW CreateThread GetVersionExW MulDiv GetFileSize GlobalFree GlobalAlloc DeleteFileW GetCurrentDirectoryW CreateDirectoryW SetFileAttributesW SetFilePointer SystemTimeToFileTime FileTimeToSystemTime Sleep GetModuleHandleA LoadLibraryA GetSystemDirectoryA VerSetConditionMask VerifyVersionInfoA QueryPerformanceFrequency SleepEx GetTickCount ExpandEnvironmentStringsA FormatMessageA CreateFileA GetFileSizeEx UnregisterWait RegisterWaitForSingleObject GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime GetDriveTypeW DecodePointer GetFullPathNameW SetCurrentDirectoryW GetFileAttributesExW GetTimeZoneInformation SetEndOfFile

user32

FindWindowW GetWindow GetWindowLongW GetWindowTextW GetPropW SetWindowLongW SetPropW SendMessageW GetClientRect IsZoomed IsIconic DestroyWindow GetParent RemovePropW CallWindowProcW FillRect GetIconInfo DrawStateW InvalidateRect MoveWindow ShowWindow MessageBoxW DefWindowProcW GetWindowTextLengthW SetFocus UnregisterClassW SystemParametersInfoW LoadIconW LoadCursorW RegisterClassExW IsWindowEnabled EnableWindow GetSystemMetrics CreateWindowExW CreateAcceleratorTableW SetForegroundWindow BringWindowToTop GetMessageW TranslateAcceleratorW IsDialogMessageW TranslateMessage DispatchMessageW DestroyAcceleratorTable GetForegroundWindow GetWindowThreadProcessId IsWindowVisible EnumWindows SetWindowPos SetWindowTextW RedrawWindow SetClassLongW GetDC ReleaseDC GetSysColor GetSysColorBrush SetRect DrawTextW GetWindowRect ValidateRect MapWindowPoints ScreenToClient UpdateWindow BeginPaint ReleaseCapture EndPaint SetCapture GetAsyncKeyState PostMessageW SetScrollPos InflateRect GetWindowDC GetFocus FrameRect DrawFocusRect PeekMessageW GetClassNameW SetActiveWindow DestroyIcon MsgWaitForMultipleObjects GetActiveWindow RegisterClassW AdjustWindowRectEx DefFrameProcW EnumChildWindows GetCursorPos TrackPopupMenu GetKeyState IsChild SetMenu DestroyMenu EnableMenuItem GetMenuItemInfoW SetMenuItemInfoW DrawIconEx GetMenuItemCount GetSubMenu GetMenu ModifyMenuW AppendMenuW CreateMenu CreatePopupMenu RegisterWindowMessageW CreateIconFromResourceEx CreateIconFromResource CharLowerW

advapi32

RegCreateKeyExW RegCloseKey RegSetValueExW RegOpenKeyExW RegQueryInfoKeyW RegDeleteKeyW RegQueryValueExW CreateProcessAsUserW RegDeleteValueW RegEnumValueW CryptAcquireContextA CryptGenRandom CryptReleaseContext CryptCreateHash CryptHashData CryptGetHashParam CryptDestroyHash

ole32

CoInitialize RevokeDragDrop OleUninitialize OleInitialize

shell32

ShellExecuteExW Shell_NotifyIconW

ws2_32

closesocket WSACleanup WSAStartup socket recv WSAGetLastError send ntohs getsockopt WSASetLastError setsockopt getpeername getsockname htons bind WSAIoctl connect select __WSAFDIsSet accept listen getaddrinfo freeaddrinfo htonl ioctlsocket gethostname ntohl

crypt32

CertFreeCertificateContext CertOpenStore CryptStringToBinaryA CertFindCertificateInStore CertCloseStore CertEnumCertificatesInStore CertCreateCertificateChainEngine CertGetCertificateChain CertGetNameStringA CertFreeCertificateChainEngine CertFreeCertificateChain CryptQueryObject CertAddCertificateContextToStore

gdiplus

GdipDeleteFont GdipDeleteGraphics GdipDeletePath GdipDeleteMatrix GdipDeletePen GdipDeleteStringFormat GdipFree

gdi32

GetObjectType GetObjectW DeleteObject IntersectClipRect GetStockObject CreateFontIndirectW SelectObject GetTextExtentPoint32W SetTextColor SetBkColor ExcludeClipRect CreateRectRgn SelectClipRgn CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteDC CreateSolidBrush CreateDCW CreateRectRgnIndirect GetClipRgn ExtSelectClipRgn GetDeviceCaps GetPixel SetPixel SetBkMode LineTo MoveToEx CreatePen CreateBitmap CreateDIBSection GetDIBits SetStretchBltMode SetBrushOrgEx StretchBlt CreateFontW

comctl32

CreateStatusWindowW InitCommonControlsEx ImageList_Replace ImageList_Add ImageList_ReplaceIcon ImageList_Remove ImageList_AddMasked ImageList_Destroy ImageList_Create

Name

.code

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text

Size

865KB

Virtual Size

865KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

121KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

452B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

42KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-28_a8a3fa8bd646348cb3327cfdb13eee69_amadey_elex_glassworm_luca-stealer_magniber_njrat

kernel32

user32

advapi32

ole32

shell32

ws2_32

crypt32

gdiplus

gdi32

comctl32

generic