2026-07-10_445550a102751be1da068d8ccbe4a41b_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_445550a102751be1da068d8ccbe4a41b_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos
Size 2.7MB
Sample260710-2p86psdw2j
SHA256 81923543e1a222294125b55d67941edcf57b355cf523e6f4d3057140400be766
MD5 445550a102751be1da068d8ccbe4a41b
SHA1 708e21166ca2a1372165898b9442ccf7e1f85278
SHA512 d2397b066f53aedf3e5a472ba55d1e8fb28b70419d40ade145c7ad36d21256d71b5291fd730f062a4d010764ba8b2edb97941ea62ed88f3dd274996e3a67b3cc
SSDEEP 49152:r6WhVIuuUrFxNp4+2oanSWdu6J+yWkWB3j2Q0eEnfwKGEDtThZP:rFVIExNi+2ru6J+yZ78IVZ
TLSH
T1A0D59E2EBD55C032D56201B05929CBABE22DAE35076204CBBFE8793DD9745C25B33B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-07-10_445550a102751be1da068d8ccbe4a41b_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos

File Explorer

2026-07-10_445550a102751be1da068d8ccbe4a41b_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos

.exe 2.7MB

2026-07-10_445550a102751be1da068d8ccbe4a41b_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos

IMPHASH adb9533ee5d558c1c16cfda172ccca4b
SHA256 81923543e1a222294125b55d67941edcf57b355cf523e6f4d3057140400be766
MD5 445550a102751be1da068d8ccbe4a41b
SHA1 708e21166ca2a1372165898b9442ccf7e1f85278
SHA512 d2397b066f53aedf3e5a472ba55d1e8fb28b70419d40ade145c7ad36d21256d71b5291fd730f062a4d010764ba8b2edb97941ea62ed88f3dd274996e3a67b3cc
SSDEEP 49152:r6WhVIuuUrFxNp4+2oanSWdu6J+yWkWB3j2Q0eEnfwKGEDtThZP:rFVIExNi+2ru6J+yZ78IVZ
TLSH
T1A0D59E2EBD55C032D56201B05929CBABE22DAE35076204CBBFE8793DD9745C25B33B1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

92:e6:a2:52:3f:b9:77:e6:30:db:89:88:a4:e0:f2:51:28:ee:ac:1e:81:2f:4f:fe:a6:e9:5f:1b:e3:81:b1:74:82:ab:13:37:c2:4d:f7:6d:2f:99:8b:b2:5d:8a:31:a0

Digest Algorithm

sha384

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=02096520,CN=Sophos Ltd,OU=Endpoint Security Group,O=Sophos Ltd,L=Abingdon,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Apr 13, 2026

SERIALNUMBER=02096520,CN=Sophos Ltd,OU=Endpoint Security Group,O=Sophos Ltd,L=Abingdon,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert G5 CS RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Subject

CN=DigiCert G5 CS RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

01:02:62:e1:62:24:ca:6d:fe:f5:84:f8:c6:30:48:db

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2021 - Feb 10, 2036

Subject

SERIALNUMBER=02096520,CN=Sophos Ltd,OU=Endpoint Security Group,O=Sophos Ltd,L=Abingdon,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

07:d9:61:4b:c5:83:39:77:d4:e7:47:15:2b:ee:a1:64

Issuer

CN=DigiCert G5 CS RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 15, 2025 - Jul 14, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

210048

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

SophosSetup.pdb

shell32

CommandLineToArgvW

kernel32

HeapSize HeapReAlloc GetCommandLineW SetEnvironmentVariableW CreateFileW WriteFile OutputDebugStringW GetLastError GetSystemDirectoryW LoadResource LockResource SizeofResource FindResourceW ReOpenFile GetProcessHeap HeapSetInformation GetCurrentProcessId SetDllDirectoryW FindClose CloseHandle FreeLibrary LocalFree WaitForSingleObject TerminateProcess GetExitCodeProcess OpenProcess CreateDirectoryW GetVolumeInformationW GetTempPathW GetCurrentProcess GetModuleHandleW GetProcAddress CreateProcessW InitializeProcThreadAttributeList UpdateProcThreadAttribute LoadLibraryExW GetEnvironmentVariableW LoadLibraryExA SetSearchPathMode OutputDebugStringA ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetCurrentThreadId GetConsoleMode WriteConsoleW FlushFileBuffers GetFileInformationByHandle SetEndOfFile SetFilePointer DeviceIoControl MoveFileExW ReplaceFileW GetFileInformationByHandleEx FindFirstFileW GetFileAttributesW GetModuleFileNameW GetStdHandle FileTimeToSystemTime Sleep FreeEnvironmentStringsW DeleteProcThreadAttributeList FormatMessageW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation GetConsoleOutputCP RaiseException GetSystemInfo VirtualProtect VirtualQuery WakeAllConditionVariable SleepConditionVariableSRW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW FormatMessageA GetLocaleInfoEx FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetStringTypeW TryAcquireSRWLockExclusive WaitForSingleObjectEx GetExitCodeThread WakeConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW ExitProcess HeapAlloc HeapFree GetFileType SetStdHandle GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetFilePointerEx

Name

.text

Size

332KB

Virtual Size

331KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

213KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_445550a102751be1da068d8ccbe4a41b_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos

shell32

kernel32

generic