2026-07-11_b0ded831d25dcd72f5724a39359f9b1f_amadey_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-11_b0ded831d25dcd72f5724a39359f9b1f_amadey_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
Size 4.8MB
Sample260711-ps9v7act7v
SHA256 ce62a1dee1deced1d43330c65ee558e1d58bc2e1ec788ec1d2abdfff1a5ddfeb
MD5 b0ded831d25dcd72f5724a39359f9b1f
SHA1 344d6e22cf681aee8af5b5a13c78d728a88dfd8f
SHA512 b195e51628923bcc93a9b1a5bd522b3474eba8327900a70f6459f2f47522baadc956339a5588f13229a0472fbe4443bcbe43471571726f6067799667dffa57f6
SSDEEP 49152:RmeKQV3FoNwwwwsw/e5tGzGyOMlBGkbWa1WHunXey62l1YjbSpRR/sKYgDsS+nTm:RmeKQRFseTCbWq/nXxlISxpwHrz1mX
TLSH
T13F36F131F9628172E5A21270DE7C9BAF856CFB250B3549CB73D40E2E1A609C31A35F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-11_b0ded831d25dcd72f5724a39359f9b1f_amadey_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-07-11_b0ded831d25dcd72f5724a39359f9b1f_amadey_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

.exe 4.8MB

2026-07-11_b0ded831d25dcd72f5724a39359f9b1f_amadey_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

IMPHASH 2b4c2f4102cdec6f121a8ef9f0dd88dc
SHA256 ce62a1dee1deced1d43330c65ee558e1d58bc2e1ec788ec1d2abdfff1a5ddfeb
MD5 b0ded831d25dcd72f5724a39359f9b1f
SHA1 344d6e22cf681aee8af5b5a13c78d728a88dfd8f
SHA512 b195e51628923bcc93a9b1a5bd522b3474eba8327900a70f6459f2f47522baadc956339a5588f13229a0472fbe4443bcbe43471571726f6067799667dffa57f6
SSDEEP 49152:RmeKQV3FoNwwwwsw/e5tGzGyOMlBGkbWa1WHunXey62l1YjbSpRR/sKYgDsS+nTm:RmeKQRFseTCbWq/nXxlISxpwHrz1mX
TLSH
T13F36F131F9628172E5A21270DE7C9BAF856CFB250B3549CB73D40E2E1A609C31A35F67
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

935524

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\955884\out\Release\DataRecoverySetup.pdb

kernel32

OpenProcess SetEndOfFile GetDiskFreeSpaceExW SetFileAttributesW DeleteFileW MoveFileExW GetVolumeInformationW GetFileAttributesExW GetCurrentProcess OpenThread lstrcmpA lstrcmpiW GetModuleHandleExW CreateToolhelp32Snapshot Process32FirstW Process32NextW GlobalSize GlobalLock GlobalUnlock GetThreadLocale SetThreadLocale SystemTimeToFileTime GetModuleHandleA GetVersionExW GetVersion InterlockedIncrement GetCommandLineW InitializeCriticalSection GetCurrentProcessId GetUserDefaultLCID ReadFile GetFileSizeEx InterlockedDecrement GetExitCodeThread LoadLibraryW UnmapViewOfFile GetFileSize InterlockedCompareExchange FindNextFileW WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetFileType ExitProcess ExitThread RtlUnwind FindFirstFileW UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList GetPrivateProfileStringW GetPrivateProfileIntW FindResourceExW FindResourceW OutputDebugStringW GlobalFree FormatMessageW GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetTimeFormatW GetDateFormatW SetThreadAffinityMask LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetNativeSystemInfo GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes TerminateProcess CreateSemaphoreW Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection DeviceIoControl HeapFree HeapReAlloc HeapAlloc SetLastError GetLastError RaiseException CloseHandle DuplicateHandle FreeLibraryAndExitThread GetCurrentThread UnregisterWait RegisterWaitForSingleObject DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue ReleaseSemaphore GetProcessAffinityMask GlobalMemoryStatus GetStdHandle GetFileInformationByHandle GetSystemWindowsDirectoryW FreeResource lstrcmpiA InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW GetACP MulDiv CreateDirectoryW GetCurrentDirectoryW SetFileTime GetFileAttributesW VerifyVersionInfoW VerSetConditionMask ReleaseMutex HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime QueryPerformanceFrequency QueryPerformanceCounter GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread LCMapStringW CompareStringW TryEnterCriticalSection GetStringTypeW IsDebuggerPresent GetLongPathNameW GlobalAlloc GetLocalTime FindClose SetFilePointer WriteFile SizeofResource LoadResource GetCurrentThreadId GetProcessHeap HeapSize HeapDestroy LocalFree LockResource SetFilePointerEx GetModuleFileNameW DeleteCriticalSection SetEnvironmentVariableW CreateFileW

user32

InvalidateRect GetCursorPos ScreenToClient OffsetRect IsRectEmpty PtInRect LoadCursorW MonitorFromPoint EqualRect SetCursor CharUpperW UnionRect SetClipboardData EmptyClipboard GetWindowLongW DestroyWindow wsprintfW RegisterClassExW DefWindowProcW PostMessageW SetWindowRgn GetUpdateRect EndPaint BeginPaint ReleaseDC GetDC ReleaseCapture SetCapture GetKeyState GetFocus IsZoomed MoveWindow UpdateLayeredWindow RegisterClassW CreateWindowExW GetWindowThreadProcessId SetForegroundWindow GetForegroundWindow SetActiveWindow BringWindowToTop IsIconic ShowWindow IsWindow AttachThreadInput GetAsyncKeyState ClientToScreen GetSysColor DrawTextW GetDesktopWindow SetWindowLongW IntersectRect CallWindowProcW LoadImageW GetSystemMetrics KillTimer SetTimer GetMonitorInfoW MonitorFromWindow GetWindow GetParent MapWindowPoints GetWindowRect GetClientRect SetWindowTextW EnableWindow SetFocus PostQuitMessage SendMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW CharNextW FindWindowW IsClipboardFormatAvailable GetClipboardData CloseClipboard OpenClipboard IsWindowVisible SetWindowPos MessageBoxW

gdi32

SetTextColor GetObjectA SelectObject SetStretchBltMode StretchBlt GetObjectW CreateDIBSection SetWindowOrgEx DeleteObject DeleteDC CreateCompatibleDC SetBkMode BitBlt CreateRoundRectRgn CreateFontIndirectW GetStockObject GetDeviceCaps CreateRectRgnIndirect GetWindowOrgEx RestoreDC SaveDC ExtSelectClipRgn SetBkColor

advapi32

RegQueryInfoKeyW RegEnumKeyExW GetTokenInformation OpenProcessToken RegSetValueExW RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey RegEnumKeyExA

shell32

SHGetSpecialFolderPathW ord165 SHGetPathFromIDListW SHGetFolderPathW ShellExecuteW CommandLineToArgvW SHBrowseForFolderW

ole32

CreateStreamOnHGlobal CoTaskMemFree CoUninitialize CoInitializeEx CoCreateInstance CoCreateGuid CoInitialize CoTaskMemRealloc OleInitialize OleUninitialize CoTaskMemAlloc

oleaut32

SysStringLen SysAllocStringLen SysFreeString VariantClear VarUI4FromStr SysAllocString

shlwapi

SHSetValueA SHGetValueA PathIsRelativeW StrTrimA PathFileExistsW StrStrIA SHSetValueW PathRemoveBackslashW StrCmpNIW StrStrIW PathAppendW PathCombineW PathFindFileNameW PathRemoveFileSpecW SHGetValueW PathIsPrefixW PathIsDirectoryW PathCanonicalizeW StrCmpIW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW

gdiplus

GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipCloneStringFormat GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipMeasureString GdipDrawString GdipDeleteFont GdipDeleteGraphics GdipBitmapUnlockBits GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipResetClip GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipSetClipPath GdipGetPropertyItemSize GdipGetPropertyItem GdipCreatePath GdipDeletePath GdipAddPathPath GdipCreateRegionPath GdipDeleteRegion GdipCloneBrush GdipDeleteBrush GdipCreatePathGradientFromPath GdipSetPathGradientPresetBlend GdipSetPathGradientWrapMode GdipSetPathGradientFocusScales GdipCreateFromHDC GdipSetSmoothingMode GdipSetPixelOffsetMode GdipFillRegion GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCreateLineBrushFromRect GdipSetLineBlend GdipCreatePen1 GdipCreatePen2 GdipDeletePen GdipLoadImageFromFile GdipImageRotateFlip GdipSetWorldTransform GdipDrawArc GdipDrawImageRect GdipClosePathFigure GdipAddPathLine ord1 GdipAddPathRectangle GdipAddPathEllipse GdipCreateSolidFill GdipCreateLineBrushFromRectI GdipSetPenDashStyle GdipSetPenDashArray GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipTranslateWorldTransform GdipRotateWorldTransform GdipGetWorldTransform GdipDrawLineI GdipDrawRectangleI GdipDrawEllipse GdipDrawPath GdipFillEllipse GdipFillPath GdipDrawImageRectRectI GdipImageSelectActiveFrame

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

winmm

timeSetEvent timeKillEvent

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext

crypt32

CryptStringToBinaryA

iphlpapi

GetAdaptersInfo

wininet

InternetCrackUrlW InternetOpenW InternetCloseHandle InternetConnectW HttpSendRequestW InternetSetOptionW HttpOpenRequestW HttpQueryInfoW

msimg32

AlphaBlend

generic

count=31, id=241, version=40116,

count=192, id=243, version=40116,

count=39, id=242, version=40116,

count=12, id=260, version=27051,

count=1, productName=Unmarked objects (old),

count=6, id=261, version=27034,

count=4, id=261, version=27024,

count=4, id=199, version=41118,

count=28, id=259, version=26706,

count=103, id=261, version=27051,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=12, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=40, id=260, version=26706,

count=136, id=261, version=26706,

count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=674, id=1, productName=Unmarked objects,

count=1, id=261, version=28106,

count=1, id=260, version=27048,

count=25, id=261, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,