2026-07-05_174840cccdc1a6ce6c0caeb1047cf702_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-07-05_174840cccdc1a6ce6c0caeb1047cf702_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample260705-ts9yeahw8n
SHA256 bee5995aa5707cf04df25c2a2cd7d387d5489b8b2f94b29c3c782ae95dfdc2be
MD5 174840cccdc1a6ce6c0caeb1047cf702
SHA1 21e50330557b2a0183ff9162e0e4b48e3a3a5783
SHA512 da31ae035e5e0055764091aada675c46e9f46d8ce87a0bf7e721a434be08dc5cbca34287748bbdf12b468acb2e708525a80e2d951097e9c36191d4f8e4b34475
SSDEEP 49152:c6LzMgZBMCH0WDOvBY9Fd45Dz0t5mHxfu0xyi0OXFz9wvJpGVb:F2CHZkBY9Fd45/0j8kjiVrwvJpG
TLSH
T13116CFAD664280E3E391303C93E6663A1BBDDB987F30A3CF5F8CD56157A80D16930667
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_174840cccdc1a6ce6c0caeb1047cf702_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-07-05_174840cccdc1a6ce6c0caeb1047cf702_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-07-05_174840cccdc1a6ce6c0caeb1047cf702_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH d4f2294ba27e6fc1249ea212e109bf42
SHA256 bee5995aa5707cf04df25c2a2cd7d387d5489b8b2f94b29c3c782ae95dfdc2be
MD5 174840cccdc1a6ce6c0caeb1047cf702
SHA1 21e50330557b2a0183ff9162e0e4b48e3a3a5783
SHA512 da31ae035e5e0055764091aada675c46e9f46d8ce87a0bf7e721a434be08dc5cbca34287748bbdf12b468acb2e708525a80e2d951097e9c36191d4f8e4b34475
SSDEEP 49152:c6LzMgZBMCH0WDOvBY9Fd45Dz0t5mHxfu0xyi0OXFz9wvJpGVb:F2CHZkBY9Fd45/0j8kjiVrwvJpG
TLSH
T13116CFAD664280E3E391303C93E6663A1BBDDB987F30A3CF5F8CD56157A80D16930667
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

8116

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError GetCurrentThreadId CloseHandle UnhandledExceptionFilter Sleep WideCharToMultiByte SetLastError HeapAlloc LocalFree DeleteCriticalSection LeaveCriticalSection WriteFile WaitForSingleObject ExitProcess GetStartupInfoW GetCommandLineW ReadFile RaiseException FormatMessageW GetFileType FlushFileBuffers TlsSetValue CreateEventW TlsAlloc HeapSetInformation HeapSize WriteConsoleW GetCPInfo SetFilePointer GetFileAttributesW CompareStringW GetStringTypeW RtlUnwind LCMapStringW GetModuleFileNameA InitializeCriticalSectionAndSpinCount GetEnvironmentStringsW SetStdHandle FindNextFileW FindFirstFileW DeleteFileW LocalAlloc SetEndOfFile GetFileSize EncodePointer lstrlenW LoadLibraryA GetLocaleInfoW CreateDirectoryW GetFullPathNameW UnmapViewOfFile GetExitCodeProcess

user32

TranslateMessage LoadStringW ShowWindow DestroyWindow ReleaseDC DefWindowProcW MessageBoxW GetDC GetWindowRect EnableWindow IsWindow LoadCursorW GetParent LoadIconW SetForegroundWindow PeekMessageW EndPaint ScreenToClient RegisterClassW GetWindow GetWindowTextW UpdateWindow GetKeyState CharUpperW ClientToScreen

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_174840cccdc1a6ce6c0caeb1047cf702_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic