2026-06-04_4435ab33adf00dd95bda85952164be55_amadey_blankgrabber_elex_glassworm_luca-stealer_magniber_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-04_4435ab33adf00dd95bda85952164be55_amadey_blankgrabber_elex_glassworm_luca-stealer_magniber_njrat_smoke-loader
Size 22.4MB
Sample260604-egsseshx2w
SHA256 20e3444434839ad0d686f16b756b5dc82d5809e613d2121840862c5395cfa91b
MD5 4435ab33adf00dd95bda85952164be55
SHA1 822c43684c9cae4cb1617af2bac7f38ca35ebde3
SHA512 3de79c9b476b22481430e0f208f6a48fc3cec275017f8ea41b9c34c87a14603fe826f2e2d34b73778a223079ada0634d817e1b0b882090f74d32b42f7fe1c79d
SSDEEP 196608:gNvigCY4DVSVU7gX7RBf91pwshTAI30QGtApL/vP5aQxMH8lZC03H9kVB9Omkngk:86G5nrvGtaDPHXDP3ODcBS0yO
TLSH
T164374B6123C0D059E27199F31B9F8CCB0315E3691BA26BC751887A689E7BEC16D35F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-06-04_4435ab33adf00dd95bda85952164be55_amadey_blankgrabber_elex_glassworm_luca-stealer_magniber_njrat_smoke-loader

File Explorer

2026-06-04_4435ab33adf00dd95bda85952164be55_amadey_blankgrabber_elex_glassworm_luca-stealer_magniber_njrat_smoke-loader

.exe 22.4MB

2026-06-04_4435ab33adf00dd95bda85952164be55_amadey_blankgrabber_elex_glassworm_luca-stealer_magniber_njrat_smoke-loader

IMPHASH 7bb2df66ed2835f66f96c48b2c8a6aaf
SHA256 20e3444434839ad0d686f16b756b5dc82d5809e613d2121840862c5395cfa91b
MD5 4435ab33adf00dd95bda85952164be55
SHA1 822c43684c9cae4cb1617af2bac7f38ca35ebde3
SHA512 3de79c9b476b22481430e0f208f6a48fc3cec275017f8ea41b9c34c87a14603fe826f2e2d34b73778a223079ada0634d817e1b0b882090f74d32b42f7fe1c79d
SSDEEP 196608:gNvigCY4DVSVU7gX7RBf91pwshTAI30QGtApL/vP5aQxMH8lZC03H9kVB9Omkngk:86G5nrvGtaDPHXDP3ODcBS0yO
TLSH
T164374B6123C0D059E27199F31B9F8CCB0315E3691BA26BC751887A689E7BEC16D35F23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

25:d7:a2:aa:3b:35:ea:95:c8:a5:83:2c:3a:16:b0:77:bb:df:05:d0:3e:e4:df:a1:66:9f:f3:e1:df:0e:54:69

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=1636032,CN=Intel Corporation,O=Intel Corporation,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Dec 29, 2025

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

Serial Number

d7:e0:90:13:b0:ef:6d:db:fb:ae:33:e5:4a:9a:fa:dd

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 21, 2025 - Aug 21, 2026

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

16157909

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Work\v35\Players\MediaCenter\Release\Media Center 35.pdb

oleaut32

SysFreeString RegisterActiveObject RevokeActiveObject GetErrorInfo CreateErrorInfo VariantClear VariantChangeType VariantInit SysAllocString OleCreatePropertyFrame LoadTypeLibEx

imm32

ImmGetCompositionStringW ImmReleaseContext ImmGetContext

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection EnterCriticalSection TryEnterCriticalSection DeleteCriticalSection InitializeCriticalSection InitializeCriticalSectionEx ReleaseSRWLockExclusive SetEvent ReleaseSRWLockShared WaitForSingleObject AcquireSRWLockExclusive AcquireSRWLockShared InitializeSRWLock ResetEvent CreateEventW CreateMutexW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar WideCharToMultiByte

api-ms-win-core-normalization-l1-1-0

NormalizeString

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-com-l1-1-0

CoGetMalloc CoFreeUnusedLibraries CoRegisterClassObject CoGetClassObject CoInitializeEx CoCreateGuid CLSIDFromString CoTaskMemFree CoUninitialize CoTaskMemAlloc FreePropVariantArray CoCreateInstance

api-ms-win-core-registry-l1-1-0

RegDeleteValueW RegEnumValueW RegSetValueExW RegEnumKeyExW RegCloseKey RegQueryValueExW RegCreateKeyExW RegOpenKeyExW

api-ms-win-core-handle-l1-1-0

SetHandleInformation CloseHandle

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW LoadLibraryExW GetProcAddress FreeLibrary GetModuleHandleW

api-ms-win-core-sysinfo-l1-1-0

GetWindowsDirectoryW GetVersionExW GetLocalTime GetSystemDirectoryW GetSystemInfo GetVersion GlobalMemoryStatusEx GetSystemDirectoryA

api-ms-win-core-file-l1-1-0

GetVolumeInformationW CreateFileW RemoveDirectoryW GetFileAttributesW DeleteFileW GetFileTime SetFileTime GetLongPathNameW GetLogicalDrives FlushFileBuffers ReadFile GetDiskFreeSpaceExW GetDriveTypeW GetLogicalDriveStringsW SetFilePointer SetEndOfFile GetFileSize FindFirstFileExW FindClose FindNextFileW SetFileAttributesW WriteFile

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW MoveFileW

api-ms-win-core-errorhandling-l1-1-0

RaiseException GetLastError SetErrorMode

srvcli

NetShareEnum

netutils

NetApiBufferFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-heap-l2-1-0

LocalFree GlobalAlloc GlobalFree LocalAlloc

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock GlobalSize GlobalLock

api-ms-win-core-registry-l2-1-0

RegEnumKeyW RegDeleteKeyW

api-ms-win-core-io-l1-1-0

DeviceIoControl GetOverlappedResult

api-ms-win-core-string-obsolete-l1-1-0

lstrlenA lstrlenW

api-ms-win-core-processthreads-l1-1-0

TerminateProcess GetCurrentThread GetCurrentThreadId SetThreadPriority GetCurrentProcessId SetPriorityClass CreateProcessW GetCurrentProcess GetThreadPriority ResumeThread TerminateThread GetThreadId GetExitCodeProcess

api-ms-win-core-namedpipe-l1-1-0

ConnectNamedPipe SetNamedPipeHandleState DisconnectNamedPipe CreateNamedPipeW CreatePipe

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW GetStdHandle GetEnvironmentVariableW GetEnvironmentVariableA SearchPathW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-localization-l1-2-0

GetThreadLocale

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot

api-ms-win-core-kernel32-legacy-l1-1-2

Process32Next Process32First

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-core-datetime-l1-1-0

GetDateFormatW GetTimeFormatW

api-ms-win-core-memory-l1-1-0

CreateFileMappingW MapViewOfFile UnmapViewOfFile

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics EnumDisplaySettingsExW EnumDisplayMonitors SystemParametersInfoW GetMonitorInfoW

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-core-psapi-l1-1-0

K32GetProcessMemoryInfo

api-ms-win-core-privateprofile-l1-1-0

GetPrivateProfileStringW WritePrivateProfileStringW

api-ms-win-core-file-l2-1-0

ReadDirectoryChangesW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory RoActivateInstance

gdi32

CreateSolidBrush CreateRectRgn LineTo CreateEllipticRgn Ellipse DeleteObject MoveToEx DeleteDC SelectObject RestoreDC SaveDC GetDeviceCaps CreateDCW EndDoc AbortDoc EndPage StartPage StartDocW CreatePen LPtoDP DPtoLP SetMapMode GetMapMode

kernel32

LoadLibraryExA VirtualQuery HeapSize GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetFileSizeEx GetConsoleOutputCP WriteConsoleW HeapQueryInformation IsBadStringPtrW Wow64DisableWow64FsRedirection GetConsoleMode SetFilePointerEx HeapReAlloc SetStdHandle LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetOEMCP GetACP IsValidCodePage HeapAlloc HeapFree FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetFileInformationByHandle Wow64RevertWow64FsRedirection ExitThread CreateThread CreateDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW SetEnvironmentVariableW GetFullPathNameW GetModuleHandleExW ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InterlockedPushEntrySList RtlUnwind GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead IsProcessorFeaturePresent GetSystemTimeAsFileTime LCMapStringEx SetProcessWorkingSetSize GetCPInfo CompareStringEx EncodePointer SleepConditionVariableSRW WakeAllConditionVariable TryAcquireSRWLockExclusive QueryPerformanceFrequency QueryPerformanceCounter GetStringTypeW WritePrivateProfileSectionW FreeLibraryAndExitThread

user32

MessageBeep DispatchMessageW TranslateMessage GetDC ReleaseDC ExitWindowsEx GetMessageW PostThreadMessageW GetCursor RegisterHotKey UnregisterHotKey InsertMenuW GetSystemMenu CreateCursor CreateIconFromResource DrawIcon DestroyCursor CopyIcon DrawIconEx EmptyClipboard SetClipboardData RegisterClipboardFormatW GetMessagePos CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW SetCursor ShowCursor MapVirtualKeyExW GetKeyboardLayout VkKeyScanExW SendInput GetKeyState MapVirtualKeyW SetWindowPlacement GetWindowPlacement ChangeDisplaySettingsExW DisplayConfigGetDeviceInfo QueryDisplayConfig GetDisplayConfigBufferSizes MonitorFromRect SetCursorPos GetCursorPos ScreenToClient GetWindowTextW GetWindowTextLengthW LoadCursorW WindowFromPoint IsWindowVisible GetWindow GetClassNameW FindWindowExW WaitMessage EnumChildWindows EnumWindows FindWindowW GetDoubleClickTime ValidateRect LoadImageW ChangeClipboardChain SetClipboardViewer CreateWindowExW DestroyIcon FlashWindowEx PeekMessageW DefWindowProcW EndPaint BeginPaint GetGUIThreadInfo GetFocus KillTimer SetTimer SetForegroundWindow AttachThreadInput GetForegroundWindow LockSetForegroundWindow ReleaseCapture SetCapture GetCapture GetDesktopWindow GetLastActivePopup SetParent GetParent SetWindowRgn UpdateWindow InvalidateRect RedrawWindow ClientToScreen GetClientRect GetWindowRect PostMessageW SetWindowLongW GetWindowLongW SetWindowPos SetWindowTextW ShowWindow IsWindowEnabled EnableWindow IsIconic IsZoomed DestroyWindow IsWindow RegisterClassW GetClassInfoW UnregisterClassW MsgWaitForMultipleObjects GetWindowThreadProcessId RegisterWindowMessageW SendMessageW CloseClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard MessageBoxW

advapi32

RegRenameKey

ole32

DoDragDrop MkParseDisplayName CreateBindCtx CreateClassMoniker GetRunningObjectTable OleInitialize OleUninitialize ReleaseStgMedium CoInitialize RevokeDragDrop RegisterDragDrop

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorDacl InitializeSecurityDescriptor

api-ms-win-core-processthreads-l1-1-1

OpenProcess

wintrust

WinVerifyTrust

api-ms-win-core-com-l2-1-1

CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-mm-time-l1-1-0

timeGetDevCaps timeBeginPeriod timeEndPeriod

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-04_4435ab33adf00dd95bda85952164be55_amadey_blankgrabber_elex_glassworm_luca-stealer_magniber_njrat_smoke-loader

PE Signature issue

oleaut32

imm32

api-ms-win-core-synch-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-normalization-l1-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-com-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

srvcli

netutils

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-localization-l1-2-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-2

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-largeinteger-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

gdi32

kernel32

user32

advapi32

ole32

api-ms-win-security-base-l1-1-0

api-ms-win-core-processthreads-l1-1-1

wintrust

api-ms-win-core-com-l2-1-1

api-ms-win-core-io-l1-1-1

api-ms-win-mm-time-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

generic