General
- Target 2026-06-27_be76173781b971dc5b9a90906f0aaef7_akira_amadey_elex_glassworm_plugx
- Size 5.3MB
- Sample260629-dwyrjsb16t
- SHA256 3e452fbf060d7fe4ace217eced08909ba11c3cbd91477f1b4a6123f18300196e
Score
10/10
Malware Config
Targets
-
- Target 2026-06-27_be76173781b971dc5b9a90906f0aaef7_akira_amadey_elex_glassworm_plugx
- Size 5.3MB
- SHA256 3e452fbf060d7fe4ace217eced08909ba11c3cbd91477f1b4a6123f18300196e
Score10/10-
Detects Luca Stealer payload
-
Family: Luca Stealer
Info stealer written in Rust first seen in July 2022.
-
Detect binaries embedding considerable number of MFA browser extension IDs.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects executables using Telegram Chat Bot
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.