2026-07-11_019784051b905b0c81e7b9c4ec8efd72_amadey_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-11_019784051b905b0c81e7b9c4ec8efd72_amadey_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader
Size 4.8MB
Sample260711-rb4nyscv2m
SHA256 81fcdb09bb21cdaae467964b6e56ceb2b1eb9ca381db01da87b31c6bd78c829a
MD5 019784051b905b0c81e7b9c4ec8efd72
SHA1 83bccb05ae2c34e40178cb45127bc069bafec071
SHA512 0d0b53297c038ce273d2f740f0b98e86e992dcc7bbd0b1bed814f55c689812795e9390f1852a3c70ed2662ab51b4364c2c688efdc6d1b407f48e5fc1dcd370d3
SSDEEP 98304:cLjfmTlHanM9fyBAF2jIwdWkJXLyvAzJZK:c/eAcuvdVJuKTK
TLSH
T1E936F131BA43C036E5B641B19E7D9AAF816DB7340B3459CB73C80F2E1E605C35E36A66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-11_019784051b905b0c81e7b9c4ec8efd72_amadey_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

File Explorer

2026-07-11_019784051b905b0c81e7b9c4ec8efd72_amadey_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

.exe 4.8MB

2026-07-11_019784051b905b0c81e7b9c4ec8efd72_amadey_elex_glassworm_luca-stealer_medusalocker_njrat_remcos_smoke-loader

IMPHASH 6e7da919ef5e6a478ed32c4f8945856d
SHA256 81fcdb09bb21cdaae467964b6e56ceb2b1eb9ca381db01da87b31c6bd78c829a
MD5 019784051b905b0c81e7b9c4ec8efd72
SHA1 83bccb05ae2c34e40178cb45127bc069bafec071
SHA512 0d0b53297c038ce273d2f740f0b98e86e992dcc7bbd0b1bed814f55c689812795e9390f1852a3c70ed2662ab51b4364c2c688efdc6d1b407f48e5fc1dcd370d3
SSDEEP 98304:cLjfmTlHanM9fyBAF2jIwdWkJXLyvAzJZK:c/eAcuvdVJuKTK
TLSH
T1E936F131BA43C036E5B641B19E7D9AAF816DB7340B3459CB73C80F2E1E605C35E36A66
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1037542

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\836521\out\Release\SudaSetup.pdb

kernel32

InterlockedDecrement GetFileSizeEx ReadFile SetFilePointerEx GlobalAlloc GlobalFree GetLongPathNameW OpenProcess SetEndOfFile GetDiskFreeSpaceExW SetFileAttributesW DeleteFileW MoveFileExW GetVolumeInformationW GetFileAttributesExW GetCurrentProcess OpenThread lstrcmpA lstrcmpiW GetModuleHandleExW GlobalSize GlobalLock GlobalUnlock GetThreadLocale SetThreadLocale SystemTimeToFileTime GetModuleHandleA GetVersionExW InterlockedIncrement GetCommandLineW GetFileInformationByHandle GetStdHandle SetFileTime GetCurrentDirectoryW CreateDirectoryW GetFileAttributesW GlobalMemoryStatus GetProcessAffinityMask IsProcessorFeaturePresent ReleaseSemaphore MapViewOfFile GetCurrentThreadId LoadLibraryW CreateFileMappingW UnmapViewOfFile InterlockedCompareExchange GetPrivateProfileStringW GetPrivateProfileIntW FindResourceExW FindResourceW OutputDebugStringW SetFilePointer WriteFile SizeofResource LoadResource GetProcessHeap HeapSize HeapDestroy WriteConsoleW SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW GetConsoleMode FindFirstFileW FlushFileBuffers GetTimeZoneInformation FindClose IsValidLocale GetFileType ExitProcess ExitThread RtlUnwind LockResource GetModuleFileNameW DeleteCriticalSection InitializeCriticalSection GetCurrentProcessId GetUserDefaultLCID GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetTimeFormatW GetDateFormatW SetThreadAffinityMask LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes TerminateProcess CreateSemaphoreW Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection DeviceIoControl HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList DuplicateHandle FreeLibraryAndExitThread GetCurrentThread UnregisterWait RegisterWaitForSingleObject DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue GetSystemWindowsDirectoryW FreeResource lstrcmpiA InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW GetACP MulDiv VerifyVersionInfoW VerSetConditionMask ReleaseMutex HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread QueryPerformanceFrequency QueryPerformanceCounter GetCPInfo FormatMessageW TryEnterCriticalSection GetStringTypeW IsDebuggerPresent FindNextFileW GetConsoleCP GetLastError RaiseException CloseHandle GetLocalTime LocalFree Process32NextW Process32FirstW EnumSystemLocalesW CreateToolhelp32Snapshot CreateFileW

user32

BringWindowToTop PostMessageW DefWindowProcW RegisterClassExW CreateWindowExW IsWindow DestroyWindow ShowWindow GetWindowLongW SetWindowLongW AttachThreadInput IsIconic CloseClipboard SetActiveWindow GetForegroundWindow SetForegroundWindow FindWindowW GetWindowThreadProcessId wsprintfW SetWindowPos IsWindowVisible GetDesktopWindow DrawTextW GetSysColor ClientToScreen GetAsyncKeyState EmptyClipboard SetClipboardData UnionRect IntersectRect SetCursor EqualRect MonitorFromPoint SetWindowTextW EnableWindow SetFocus GetMonitorInfoW MonitorFromWindow LoadImageW GetWindow GetParent MapWindowPoints GetWindowRect GetClientRect GetSystemMetrics KillTimer SetTimer PostQuitMessage SendMessageW CharUpperW PeekMessageW DispatchMessageW TranslateMessage GetMessageW CharNextW IsClipboardFormatAvailable GetClipboardData LoadCursorW OpenClipboard CallWindowProcW RegisterClassW UpdateLayeredWindow MoveWindow IsZoomed GetFocus GetKeyState SetCapture ReleaseCapture GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect SetWindowRgn InvalidateRect GetCursorPos ScreenToClient OffsetRect IsRectEmpty PtInRect

advapi32

EnumServicesStatusW RegDeleteKeyW RegEnumKeyExA RegCloseKey RegCreateKeyExW RegQueryInfoKeyW RegEnumKeyExW GetTokenInformation OpenProcessToken OpenSCManagerW RegDeleteValueW CloseServiceHandle RegOpenKeyW RegSetValueExW RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA

shell32

ShellExecuteExW ShellExecuteW SHBrowseForFolderW SHGetSpecialFolderPathW SHGetPathFromIDListW SHFileOperationW CommandLineToArgvW ord165 SHGetFolderPathW

ole32

OleUninitialize OleInitialize CoTaskMemRealloc CreateStreamOnHGlobal CoCreateGuid CoCreateInstance CoInitializeEx CoUninitialize CoInitialize CoTaskMemFree CoTaskMemAlloc

oleaut32

SysFreeString VarUI4FromStr VariantClear SysStringLen SysAllocString SysAllocStringLen

shlwapi

PathAddBackslashW StrStrIW StrCmpNIW StrCmpIW PathFindFileNameW PathCombineW PathAppendW SHDeleteValueW StrTrimA PathCanonicalizeW PathIsDirectoryW PathRemoveFileSpecW SHSetValueA SHGetValueA PathIsPrefixW SHGetValueW StrStrIA PathRemoveExtensionW SHSetValueW StrCpyNW PathFileExistsW PathIsRelativeW PathRemoveBackslashW

version

VerQueryValueW

psapi

GetModuleFileNameExW

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

winmm

timeKillEvent timeSetEvent

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext

crypt32

CryptBinaryToStringA

iphlpapi

GetAdaptersInfo

wininet

InternetConnectW HttpQueryInfoW HttpOpenRequestW InternetSetOptionW InternetCloseHandle InternetCrackUrlW InternetOpenW HttpSendRequestW

msi

ord217 ord173

gdi32

CreateFontIndirectW GetStockObject GetObjectW GetDeviceCaps CreateRectRgnIndirect GetWindowOrgEx RestoreDC SaveDC DeleteObject CreateCompatibleDC DeleteDC SelectObject SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor CreateDIBSection GetObjectA SetWindowOrgEx BitBlt CreateRoundRectRgn ExtSelectClipRgn

gdiplus

GdipMeasureString GdipStringFormatGetGenericTypographic GdipResetClip GdipSetClipPath GdipCreateFontFromDC GdipDeleteStringFormat GdipCloneStringFormat GdipSetStringFormatFlags GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipDrawString GdipCreateFontFromLogfontA GdipDrawImageRectRectI GdipDeleteFont GdipSetStringFormatAlign GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipCreatePath GdipDeletePath GdipAddPathPath GdipCreateRegionPath GdipDeleteRegion GdipCloneBrush GdipDeleteBrush GdipCreatePathGradientFromPath GdipSetPathGradientPresetBlend GdipSetPathGradientWrapMode GdipSetPathGradientFocusScales GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetPixelOffsetMode GdipFillRegion GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCreateLineBrushFromRect GdipSetLineBlend GdipCreatePen1 GdipCreatePen2 GdipDeletePen GdipLoadImageFromFile GdipImageRotateFlip GdipSetWorldTransform GdipDrawArc GdipDrawImageRect GdipClosePathFigure GdipAddPathLine ord1 GdipAddPathRectangle GdipAddPathEllipse GdipCreateSolidFill GdipCreateLineBrushFromRectI GdipSetPenDashStyle GdipSetPenDashArray GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipTranslateWorldTransform GdipRotateWorldTransform GdipGetWorldTransform GdipDrawLineI GdipDrawRectangleI GdipDrawEllipse GdipDrawPath GdipFillEllipse GdipFillPath

msimg32

AlphaBlend

generic

count=31, id=241, version=40116,

count=192, id=243, version=40116,

count=39, id=242, version=40116,

count=1, productName=Unmarked objects (old),

count=6, id=261, version=27034,

count=4, id=261, version=27024,

count=3, id=199, version=41118,

count=29, id=259, version=26706,

count=67, id=261, version=27051,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=12, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=40, id=260, version=26706,

count=134, id=261, version=26706,

count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=47, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=662, id=1, productName=Unmarked objects,

count=1, id=261, version=28106,

count=32, id=260, version=27048,

count=112, id=261, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,