2026-06-26_de4ddfe6f37df3e94791963fc451a686_amadey_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-26_de4ddfe6f37df3e94791963fc451a686_amadey_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader
Size 5.6MB
Sample260629-nvex6acs21
SHA256 7a74be0879c8a2378678947c4c865c2860501cdc5edfd7da7070f18680724907
MD5 de4ddfe6f37df3e94791963fc451a686
SHA1 8edda437b0630463c7036b62c9bc2cebf6846931
SHA512 ff6e623d1febf91785ca114bb20059590994e5b400ce02cc63f14def29466f09327e787facaa4c8ef78c15886d4f0927aae4e04cb957995d212ad1fea53fc480
SSDEEP 98304:K2O5N1rCRa2SdbZDNqF2zWEPppb6GDRXtt1WKgUSnfoFewJx:CZ0aZb9UE/vRX31LgU0f5
TLSH
T148461222714785E2D6D29C328677FEE67379033A1B0198F766E72DC029210F1BA39B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-26_de4ddfe6f37df3e94791963fc451a686_amadey_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader

File Explorer

2026-06-26_de4ddfe6f37df3e94791963fc451a686_amadey_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader

.exe 5.6MB

2026-06-26_de4ddfe6f37df3e94791963fc451a686_amadey_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader

IMPHASH a353a96da712760de632e466a34de7c6
SHA256 7a74be0879c8a2378678947c4c865c2860501cdc5edfd7da7070f18680724907
MD5 de4ddfe6f37df3e94791963fc451a686
SHA1 8edda437b0630463c7036b62c9bc2cebf6846931
SHA512 ff6e623d1febf91785ca114bb20059590994e5b400ce02cc63f14def29466f09327e787facaa4c8ef78c15886d4f0927aae4e04cb957995d212ad1fea53fc480
SSDEEP 98304:K2O5N1rCRa2SdbZDNqF2zWEPppb6GDRXtt1WKgUSnfoFewJx:CZ0aZb9UE/vRX31LgU0f5
TLSH
T148461222714785E2D6D29C328677FEE67379033A1B0198F766E72DC029210F1BA39B57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4290514

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

K32EnumProcessModules K32GetModuleFileNameExA CreateFileA FindClose OutputDebugStringA GetLastError DeviceIoControl GetCurrentProcess LoadLibraryA MultiByteToWideChar DeleteFileA GetFileSize SetFilePointer WriteFile CreateMutexA GetModuleFileNameA lstrcpyA CopyFileA Module32Next Module32First Process32Next Process32First CreateToolhelp32Snapshot WideCharToMultiByte GetPrivateProfileStringA GetProcAddress GetModuleHandleA HeapSize WriteConsoleW DeleteFileW GetProcessHeap SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA GetFullPathNameW GetCurrentDirectoryW WriteProcessMemory VirtualProtectEx VirtualAllocEx GetTickCount OpenProcess CreateThread GetCurrentProcessId SetEndOfFile SetStdHandle GetFileAttributesExW FlushFileBuffers GetStringTypeW GetTimeZoneInformation LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapReAlloc Sleep DecodePointer HeapAlloc HeapFree GetConsoleCP ReadConsoleW GetConsoleMode GetACP ExitProcess SetFilePointerEx GetModuleHandleExW FreeLibraryAndExitThread ExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW CreateFileW EncodePointer LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind RaiseException InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetStartupInfoW IsDebuggerPresent CloseHandle IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetModuleHandleW CreateEventW ResetEvent SetEvent VerifyVersionInfoW VerSetConditionMask GetEnvironmentVariableA WaitForMultipleObjects PeekNamedPipe ReadFile GetFileType GetStdHandle WaitForSingleObjectEx MoveFileExA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx QueryPerformanceFrequency GetSystemDirectoryA FreeLibrary QueryPerformanceCounter SetLastError FormatMessageW GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers WriteConsoleW SetStdHandle IsProcessorFeaturePresent DecodePointer GetCommandLineA RaiseException HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringW GetStringTypeW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapSize WriteFile RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc VirtualQuery LocalAlloc LocalFree GetModuleFileNameW ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

LoadIconA LoadCursorA SetWindowLongA GetWindowLongA InflateRect GetSysColorBrush GetCursorPos GetClientRect SetForegroundWindow SetActiveWindow GetDlgItemTextA MessageBoxA GetMessageA TranslateMessage DispatchMessageA SendMessageA PostMessageA DefWindowProcA PostQuitMessage RegisterClassExA CreateWindowExA DestroyWindow ShowWindow MoveWindow CreateDialogParamA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu UpdateWindow SetDlgItemTextA CharUpperBuffW

gdi32

CreateFontA

advapi32

CryptEncrypt CryptDestroyKey LookupPrivilegeValueA GetTokenInformation AdjustTokenPrivileges OpenProcessToken CryptDestroyHash CryptHashData CryptImportKey CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptCreateHash

shell32

SHGetFolderPathA ShellExecuteA Shell_NotifyIconA

shlwapi

PathAppendA StrStrIA

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

iphlpapi

GetAdaptersInfo

ws2_32

send WSACloseEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError recv bind connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSASetLastError WSAIoctl WSAStartup WSACleanup __WSAFDIsSet select accept htonl listen getaddrinfo freeaddrinfo recvfrom sendto ioctlsocket gethostname WSACreateEvent

wldap32

ord27 ord32 ord33 ord26 ord79 ord22 ord41 ord50 ord60 ord30 ord200 ord301 ord211 ord46 ord217 ord35 ord143

Name

.text

Size

461KB

Virtual Size

460KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

300B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.5Fy

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.GG

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.0Sk

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-26_de4ddfe6f37df3e94791963fc451a686_amadey_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader

kernel32

user32

gdi32

advapi32

shell32

shlwapi

version

iphlpapi

ws2_32

wldap32

generic