General
- Target 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_wannacry
- Size 3.6MB
- Sample260604-pchf1ae12l
- SHA256 95b8faf6981ba329abba5382be2f35aae5e10e274ff6745b02e3f006e1209ec1
- MD5 e2a88c013bad209916ec4bdad5be4034
- SHA1 da0eabd5e04bb9106076ba1b208548f10c3123bd
- SHA512 293ee840261696da69666b56ba0def0a229c947c9b0d7e8bd390f72d8e6d790e89145941b305cb553d80a1553ae32062ad0ed29ce2d767309db54b22d2767d5a
- SSDEEP 49152:0VZn92IgpYq4T3S9tsgX8zEC8ULgCSA/Bkj0R:CZnTg6JTIOSAD
- TLSH T14D067B1373E44537E1BE663E80B1193D97B5B93B9B36C74F7504B89E49A27828A13323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Resource
win11-20260513-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-04_e2a88c013bad209916ec4bdad5be4034_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_wannacry
- Size 3.6MB
- SHA256 95b8faf6981ba329abba5382be2f35aae5e10e274ff6745b02e3f006e1209ec1
- MD5 e2a88c013bad209916ec4bdad5be4034
- SHA1 da0eabd5e04bb9106076ba1b208548f10c3123bd
- SHA512 293ee840261696da69666b56ba0def0a229c947c9b0d7e8bd390f72d8e6d790e89145941b305cb553d80a1553ae32062ad0ed29ce2d767309db54b22d2767d5a
- SSDEEP 49152:0VZn92IgpYq4T3S9tsgX8zEC8ULgCSA/Bkj0R:CZnTg6JTIOSAD
- TLSH T14D067B1373E44537E1BE663E80B1193D97B5B93B9B36C74F7504B89E49A27828A13323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Drops file in System32 directory