General
- Target 2026-07-02_9e35fe60c046405ba3d510ff3d3184aa_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop_wannacry
- Size 7.1MB
- Sample260702-yn636sav8l
- SHA256 d1094f8d55d04904c311df5ed44e3b4f291a4a7a1d93613b793f1f1baa97f62e
- MD5 9e35fe60c046405ba3d510ff3d3184aa
- SHA1 7d0026bed505c07d6a5d7f2f8e45be08a68fe176
- SHA512 3e18129582184551dd9b3cc2071f64d86641ced75ff069efaaabfc97691e41150c3ede1b07ce7069bf1db4bbf1f4fa74b9f0b2925a7a962103694f0dc0721c0b
- SSDEEP 98304:H9Yt5N04OzxQeMjLsAAa/7JNzJwjI5klUigKYkBEvHPILz1p/kjRm4OWL22ImljE:6tn04PeGZF6bUpMBF1p/kjRm4OWi2bg
- TLSH T1607623163DF9C237D2E345308EADEBA075B6B6680F31484733D81A2D1F366D1A72A61D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_9e35fe60c046405ba3d510ff3d3184aa_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_9e35fe60c046405ba3d510ff3d3184aa_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remc.exe
Resource
win11ltsc2024-20260629-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-02_9e35fe60c046405ba3d510ff3d3184aa_amadey_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop_wannacry
- Size 7.1MB
- SHA256 d1094f8d55d04904c311df5ed44e3b4f291a4a7a1d93613b793f1f1baa97f62e
- MD5 9e35fe60c046405ba3d510ff3d3184aa
- SHA1 7d0026bed505c07d6a5d7f2f8e45be08a68fe176
- SHA512 3e18129582184551dd9b3cc2071f64d86641ced75ff069efaaabfc97691e41150c3ede1b07ce7069bf1db4bbf1f4fa74b9f0b2925a7a962103694f0dc0721c0b
- SSDEEP 98304:H9Yt5N04OzxQeMjLsAAa/7JNzJwjI5klUigKYkBEvHPILz1p/kjRm4OWL22ImljE:6tn04PeGZF6bUpMBF1p/kjRm4OWi2bg
- TLSH T1607623163DF9C237D2E345308EADEBA075B6B6680F31484733D81A2D1F366D1A72A61D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1