2026-07-02_211c983a29944b105c801af3c31c603f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-07-02_211c983a29944b105c801af3c31c603f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample260702-wsqwmsgw7k
SHA256 4503986d89aaceab8981b562ad78e32c9e744ab77012fe1129e2d1ec1abafc6c
MD5 211c983a29944b105c801af3c31c603f
SHA1 07f83d4685304651de53ce5326353565010ad209
SHA512 015d7eaee7f86636b3280e1478daebb774827499fdf6f14fc225c858bbc3254bc72908a2593446c947e34bff9d1bc6d256ff47f5962db89ac16f07d333d5274f
SSDEEP 98304:WVrwvJpGEGO1LgiziAMe3ftMGvix9Bif7TSIEJuKgL:WGGO1MMMePeOixif7+IEJu
TLSH
T12F1612BDBB41E0B7F5DA007495F996F61AE82A34173890CB8F94186907F40D3FB3664A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-02_211c983a29944b105c801af3c31c603f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-07-02_211c983a29944b105c801af3c31c603f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-07-02_211c983a29944b105c801af3c31c603f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 92a74f0fe0c2a02aa93099155cb7fe15
SHA256 4503986d89aaceab8981b562ad78e32c9e744ab77012fe1129e2d1ec1abafc6c
MD5 211c983a29944b105c801af3c31c603f
SHA1 07f83d4685304651de53ce5326353565010ad209
SHA512 015d7eaee7f86636b3280e1478daebb774827499fdf6f14fc225c858bbc3254bc72908a2593446c947e34bff9d1bc6d256ff47f5962db89ac16f07d333d5274f
SSDEEP 98304:WVrwvJpGEGO1LgiziAMe3ftMGvix9Bif7TSIEJuKgL:WGGO1MMMePeOixif7+IEJu
TLSH
T12F1612BDBB41E0B7F5DA007495F996F61AE82A34173890CB8F94186907F40D3FB3664A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4180237

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter Sleep GetTickCount MultiByteToWideChar HeapFree HeapAlloc LeaveCriticalSection GetProcessHeap CreateFileW GetStartupInfoW FindClose ReadFile GetFileType HeapReAlloc TlsSetValue TlsAlloc HeapSize WriteConsoleW LoadLibraryExW GetCPInfo TlsFree SetFilePointer GetFileAttributesW CompareStringW GetStringTypeW LCMapStringW GetModuleFileNameA GetOEMCP SetStdHandle FreeEnvironmentStringsW FindNextFileW VirtualAlloc GetConsoleCP GetCommandLineA DecodePointer ResetEvent GetVersionExW OutputDebugStringW EncodePointer VirtualFree lstrlenW LoadLibraryA GetModuleHandleExW CreateDirectoryW GetFullPathNameW LoadResource GetExitCodeProcess ExpandEnvironmentStringsW

user32

TranslateMessage LoadStringW DefWindowProcW PostQuitMessage GetWindowLongW GetMessageW GetDlgItem GetDC PostMessageW SendMessageW GetClientRect SetWindowPos GetParent EndDialog SetFocus GetSysColor PeekMessageW ScreenToClient KillTimer InvalidateRect RegisterClassW GetWindow UpdateWindow SystemParametersInfoW GetKeyState MessageBoxA CharUpperW ClientToScreen

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-02_211c983a29944b105c801af3c31c603f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic