2026-07-05_3039c46761a3f3bdeba1449184391790_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-05_3039c46761a3f3bdeba1449184391790_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 2.7MB
Sample260705-trhsjady9w
SHA256 485d7924141bdc5865e8dc9c2e2f3736840c35564ef9764145c15b6037b41daf
MD5 3039c46761a3f3bdeba1449184391790
SHA1 bd0e945e0cb29c9e3d5bf738987a7311a7ccfb0d
SHA512 358786c64a41164afc31a6dcb9013f2f3d523f1ccfd61b612bdaf4d80f6d814df02b13fa0ff3b6f0af34a5486a49a028b6238ad70f473abbc1d256ec29bdedd9
SSDEEP 49152:bxaLOLtsUEl4L8ZR3wayynZS9YPITIbjl2B7Ulw:brLt0l4L8fwayynZoeko
TLSH
T143D5AF127746ACB3E4720530E37F97FBC63D99205325C5DBA3D01A6889282D3773AB96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_3039c46761a3f3bdeba1449184391790_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-07-05_3039c46761a3f3bdeba1449184391790_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 2.7MB

2026-07-05_3039c46761a3f3bdeba1449184391790_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH e4c49217fdb313737750301a77e2e52e
SHA256 485d7924141bdc5865e8dc9c2e2f3736840c35564ef9764145c15b6037b41daf
MD5 3039c46761a3f3bdeba1449184391790
SHA1 bd0e945e0cb29c9e3d5bf738987a7311a7ccfb0d
SHA512 358786c64a41164afc31a6dcb9013f2f3d523f1ccfd61b612bdaf4d80f6d814df02b13fa0ff3b6f0af34a5486a49a028b6238ad70f473abbc1d256ec29bdedd9
SSDEEP 49152:bxaLOLtsUEl4L8ZR3wayynZS9YPITIbjl2B7Ulw:brLt0l4L8fwayynZoeko
TLSH
T143D5AF127746ACB3E4720530E37F97FBC63D99205325C5DBA3D01A6889282D3773AB96
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

816284

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

version

GetFileVersionInfoExW GetFileVersionInfoSizeExW VerQueryValueW

userenv

CreateEnvironmentBlock

wtsapi32

WTSQueryUserToken

kernel32

K32GetModuleFileNameExW SetFilePointer WriteFile SetEndOfFile FlushFileBuffers GetFileSize ReadFile CopyFileW DeleteFileW CreateFileA CreateDirectoryW FindFirstFileW FindNextFileW FindClose GetFileAttributesA CreateDirectoryA WTSGetActiveConsoleSessionId GetCurrentProcess GetProcessId GetFileAttributesW CreateToolhelp32Snapshot Process32FirstW Process32NextW TerminateProcess FindResourceW GetModuleHandleW SizeofResource LoadResource LockResource GetCurrentProcessId Sleep ExitProcess GetTempPathW GetComputerNameA GetSystemDirectoryW IsWow64Process MultiByteToWideChar GetModuleHandleA GetCommandLineW lstrcmpiW GetModuleFileNameA lstrlenA lstrcatA DeleteFileA MoveFileA ReadConsoleInputW SetConsoleMode SetStdHandle GetProcessHeap CreateFileW TlsFree TlsSetValue TlsGetValue CreateWaitableTimerW VerifyVersionInfoW VerSetConditionMask SetLastError GetQueuedCompletionStatus SetWaitableTimer CreateIoCompletionPort PostQueuedCompletionStatus GetSystemTimeAsFileTime SleepEx SetEvent QueueUserAPC TerminateThread WaitForMultipleObjects CreateEventW DeleteCriticalSection InitializeCriticalSectionAndSpinCount CloseHandle WaitForSingleObject LeaveCriticalSection EnterCriticalSection GetLastError TlsAlloc LocalFree WideCharToMultiByte FormatMessageW FormatMessageA GetFullPathNameW SetEnvironmentVariableW FreeEnvironmentStringsW PeekNamedPipe GetFileInformationByHandle GetDriveTypeW GetExitCodeThread GetEnvironmentStringsW SystemTimeToTzSpecificLocalTime MoveFileExW HeapSize OpenProcess FileTimeToSystemTime WriteConsoleW GetModuleFileNameW GetCurrentDirectoryW QueryPerformanceCounter QueryPerformanceFrequency RaiseException TryEnterCriticalSection GetCurrentThreadId SwitchToThread GetTickCount GetProcAddress EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead GetStdHandle GetFileType FreeLibrary LoadLibraryA GlobalMemoryStatus FlushConsoleInputBuffer GetSystemTime SystemTimeToFileTime ReleaseSemaphore InitializeCriticalSection CreateSemaphoreW SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree DuplicateHandle InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateTimerQueue LoadLibraryW RtlUnwind ExitThread GetModuleHandleExW SetConsoleCtrlHandler GetConsoleCP HeapFree HeapAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetFilePointerEx GetConsoleMode ReadConsoleW IsValidCodePage GetACP GetOEMCP HeapReAlloc GetTimeZoneInformation FindFirstFileExW GetCommandLineA

user32

SetTimer DispatchMessageW TranslateMessage GetMessageW MessageBoxA GetUserObjectInformationW GetProcessWindowStation

advapi32

ConvertSidToStringSidA RegGetValueW RegOpenKeyExA RegGetValueA DeregisterEventSource RegisterEventSourceA ReportEventA RegSetValueExA StartServiceCtrlDispatcherW StartServiceW OpenServiceW CloseServiceHandle OpenSCManagerW CreateServiceW SetServiceStatus RegisterServiceCtrlHandlerW RegDeleteKeyExW RegOpenKeyExW LookupAccountNameA RegCreateKeyExW GetUserNameW LsaOpenPolicy CreateProcessAsUserW SetTokenInformation DuplicateTokenEx GetTokenInformation OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW RegSetValueExW RegCreateKeyW

shell32

ShellExecuteExW CommandLineToArgvW

ws2_32

connect WSACleanup WSAStartup freeaddrinfo getaddrinfo WSAGetLastError WSASocketW WSASend WSARecv select shutdown ioctlsocket closesocket WSASetLastError recv getsockopt setsockopt send

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_3039c46761a3f3bdeba1449184391790_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

version

userenv

wtsapi32

kernel32

user32

advapi32

shell32

ws2_32

generic