2026-07-05_6e8ecb2e0887a5e5e78824dc2aa6769e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-07-05_6e8ecb2e0887a5e5e78824dc2aa6769e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample260705-tkhh7adx3x
SHA256 4c4717793a859153cc3beae227455f3c070a03167b2c9aba15ed6749f530206c
MD5 6e8ecb2e0887a5e5e78824dc2aa6769e
SHA1 ccc37b37e8303d17c2853eb4735cfaee5a25fd13
SHA512 551eec51416f80067ca3a66b85205baef1d1b948ac1299111034ae600ea526a5e36a5d819a4abc520501256921eac6292e8a0f7437a8d24d42d110755b6fdc7f
SSDEEP 98304:wVrwvJpGhRLJE8tauEENOqBrUTNv3wA7dZNo5EgXj1OnwKj1rn7:wDLLFOq1UJv3fdo9Uwkr7
TLSH
T1BE161261E7418032E5A340F9B9EA5677AE2D373063DF90C71EB19AFCD7604C26634A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_6e8ecb2e0887a5e5e78824dc2aa6769e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-07-05_6e8ecb2e0887a5e5e78824dc2aa6769e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-07-05_6e8ecb2e0887a5e5e78824dc2aa6769e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 9b029667247c771f8411f8ac5ebb90a3
SHA256 4c4717793a859153cc3beae227455f3c070a03167b2c9aba15ed6749f530206c
MD5 6e8ecb2e0887a5e5e78824dc2aa6769e
SHA1 ccc37b37e8303d17c2853eb4735cfaee5a25fd13
SHA512 551eec51416f80067ca3a66b85205baef1d1b948ac1299111034ae600ea526a5e36a5d819a4abc520501256921eac6292e8a0f7437a8d24d42d110755b6fdc7f
SSDEEP 98304:wVrwvJpGhRLJE8tauEENOqBrUTNv3wA7dZNo5EgXj1OnwKj1rn7:wDLLFOq1UJv3fdo9Uwkr7
TLSH
T1BE161261E7418032E5A340F9B9EA5677AE2D373063DF90C71EB19AFCD7604C26634A4E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4182488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentThreadId GetCurrentProcessId SetUnhandledExceptionFilter GetModuleHandleW CloseHandle TerminateProcess WideCharToMultiByte SetLastError LocalFree DeleteCriticalSection EnterCriticalSection WriteFile GetProcessHeap ExitProcess GetModuleFileNameW GetStdHandle GetStartupInfoW IsDebuggerPresent FindClose ReadFile RaiseException SetEvent FormatMessageW GetFileType GetModuleHandleA InitializeCriticalSection HeapReAlloc GetConsoleMode FlushFileBuffers TlsSetValue CreateEventW TlsAlloc HeapSetInformation HeapSize WriteConsoleW SetFilePointer RtlUnwind LCMapStringW InitializeCriticalSectionAndSpinCount GetOEMCP SetStdHandle FreeEnvironmentStringsW IsValidCodePage FindFirstFileW DeleteFileW GetCommandLineA DecodePointer ReleaseMutex GetFileSize EncodePointer LoadLibraryA GetLocaleInfoW GetFullPathNameW LoadResource GetExitCodeProcess

user32

TranslateMessage DestroyWindow DefWindowProcW MessageBoxW GetMessageW GetSystemMetrics GetWindowRect PostMessageW SendMessageW SetWindowPos EnableWindow GetParent EndDialog LoadIconW ScreenToClient InvalidateRect EnableMenuItem GetWindow GetWindowTextW SystemParametersInfoW GetKeyState

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_6e8ecb2e0887a5e5e78824dc2aa6769e_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic