2026-07-05_2ce0177b5b76a78c30a19b7acaefddc2_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-05_2ce0177b5b76a78c30a19b7acaefddc2_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 2.7MB
Sample260705-vs6fnaet6s
SHA256 8687e6aba43abf43385c4574b6000f945d4f6a2801a8af5c624ccf35bcd0bb88
MD5 2ce0177b5b76a78c30a19b7acaefddc2
SHA1 3e6321e53d8cdbbedd74c36248144478a744212b
SHA512 95b58322642185511d807c6f7bdc6c27158ae3d44a053c0b4e86dc3359e2aa114c2183af4b4a72848ff4fb054b912ce54688320630bf47a43e60a5f11e6149fa
SSDEEP 49152:p9TTNgUr3sz6NVFlAC+9ye298Dt4QnsYPtTFqjl2B7Ulw:pTgUbsz6NhAC+9ye297Fko
TLSH
T144D5AE127746ACB3E4720930E37F97FBC62D99205725C5C7A3D016688D282D3B73AB96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_2ce0177b5b76a78c30a19b7acaefddc2_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-07-05_2ce0177b5b76a78c30a19b7acaefddc2_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 2.7MB

2026-07-05_2ce0177b5b76a78c30a19b7acaefddc2_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 50be66ecf275572b24ae1059022f4fb9
SHA256 8687e6aba43abf43385c4574b6000f945d4f6a2801a8af5c624ccf35bcd0bb88
MD5 2ce0177b5b76a78c30a19b7acaefddc2
SHA1 3e6321e53d8cdbbedd74c36248144478a744212b
SHA512 95b58322642185511d807c6f7bdc6c27158ae3d44a053c0b4e86dc3359e2aa114c2183af4b4a72848ff4fb054b912ce54688320630bf47a43e60a5f11e6149fa
SSDEEP 49152:p9TTNgUr3sz6NVFlAC+9ye298Dt4QnsYPtTFqjl2B7Ulw:pTgUbsz6NhAC+9ye297Fko
TLSH
T144D5AE127746ACB3E4720930E37F97FBC62D99205725C5C7A3D016688D282D3B73AB96
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

816710

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

version

GetFileVersionInfoExW GetFileVersionInfoSizeExW VerQueryValueW

userenv

CreateEnvironmentBlock

wtsapi32

WTSQueryUserToken

kernel32

K32GetModuleFileNameExW SetFilePointer WriteFile SetEndOfFile FlushFileBuffers GetFileSize ReadFile CopyFileW DeleteFileW CreateFileA CreateDirectoryW FindFirstFileW FindNextFileW FindClose GetFileAttributesA CreateDirectoryA WTSGetActiveConsoleSessionId GetCurrentProcess GetProcessId GetFileAttributesW CreateToolhelp32Snapshot Process32FirstW Process32NextW TerminateProcess FindResourceW GetModuleHandleW SizeofResource LoadResource LockResource GetCurrentProcessId Sleep ExitProcess GetTempPathW GetComputerNameA GetSystemDirectoryW IsWow64Process MultiByteToWideChar GetModuleHandleA GetCommandLineW lstrcmpiW GetModuleFileNameA lstrlenA lstrcatA DeleteFileA MoveFileA ReadConsoleInputW SetConsoleMode SetStdHandle GetProcessHeap CreateFileW TlsFree TlsSetValue TlsGetValue CreateWaitableTimerW VerifyVersionInfoW VerSetConditionMask SetLastError GetQueuedCompletionStatus SetWaitableTimer CreateIoCompletionPort PostQueuedCompletionStatus GetSystemTimeAsFileTime SleepEx SetEvent QueueUserAPC TerminateThread WaitForMultipleObjects CreateEventW DeleteCriticalSection InitializeCriticalSectionAndSpinCount CloseHandle WaitForSingleObject LeaveCriticalSection EnterCriticalSection GetLastError TlsAlloc LocalFree WideCharToMultiByte FormatMessageW FormatMessageA GetFullPathNameW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW PeekNamedPipe GetFileInformationByHandle GetDriveTypeW GetExitCodeThread SystemTimeToTzSpecificLocalTime GetCommandLineA MoveFileExW HeapSize OpenProcess FileTimeToSystemTime WriteConsoleW GetModuleFileNameW GetCurrentDirectoryW QueryPerformanceCounter QueryPerformanceFrequency RaiseException TryEnterCriticalSection GetCurrentThreadId SwitchToThread GetTickCount GetProcAddress EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead GetStdHandle GetFileType FreeLibrary LoadLibraryA GlobalMemoryStatus FlushConsoleInputBuffer GetSystemTime SystemTimeToFileTime ReleaseSemaphore InitializeCriticalSection CreateSemaphoreW SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree DuplicateHandle InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateTimerQueue LoadLibraryW RtlUnwind ExitThread GetModuleHandleExW SetConsoleCtrlHandler GetConsoleCP HeapFree HeapAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetFilePointerEx GetConsoleOutputCP GetConsoleMode ReadConsoleW IsValidCodePage GetACP GetOEMCP HeapReAlloc GetTimeZoneInformation FindFirstFileExW

user32

DispatchMessageW TranslateMessage GetMessageW SetTimer MessageBoxA GetUserObjectInformationW GetProcessWindowStation

advapi32

ConvertSidToStringSidA RegGetValueW RegOpenKeyExA RegGetValueA DeregisterEventSource RegisterEventSourceA ReportEventA RegSetValueExA StartServiceCtrlDispatcherW StartServiceW OpenServiceW CloseServiceHandle OpenSCManagerW CreateServiceW SetServiceStatus RegisterServiceCtrlHandlerW RegDeleteKeyExW RegOpenKeyExW LookupAccountNameA RegCreateKeyExW GetUserNameW LsaOpenPolicy CreateProcessAsUserW SetTokenInformation DuplicateTokenEx GetTokenInformation OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW RegSetValueExW RegCreateKeyW

shell32

ShellExecuteExW CommandLineToArgvW

ws2_32

WSACleanup WSAStartup freeaddrinfo getaddrinfo WSAGetLastError WSASend WSARecv select shutdown ioctlsocket closesocket setsockopt getsockopt WSASetLastError recv connect WSASocketW send

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_2ce0177b5b76a78c30a19b7acaefddc2_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

version

userenv

wtsapi32

kernel32

user32

advapi32

shell32

ws2_32

generic