2026-07-14_3b981466ac39254a5327968a03610a20_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-07-14_3b981466ac39254a5327968a03610a20_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample260715-bbp8kagy2n
SHA256 264879dba739ca1b7bf8ca392be1cb07bbfe6e0a9a5d67b07f6fa4b94827cedd
MD5 3b981466ac39254a5327968a03610a20
SHA1 1d7abdef298de628c67416d54b58adb0bb30a680
SHA512 bb4fc12a632e2c0886c3ea5c56457b0e13bbf3e62c671187517c33679f064227811b6f4cefbebdbb3ab21778dedab411998f8d14bbb4ef1c8e086f96f2091fcf
SSDEEP 24576:CA0tUXF2K2iMMfwoiJpGVFp5nOXm+M81GB+5ZFOSCHmhye/RiElaaYlCnp:L0OXFz9wvJpGVb5l+1e+SJe34a
TLSH
T163169E115A4C91F1E0BAF037726E46B639182325239BE0C36294EBD7B7520D1A73E97F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-14_3b981466ac39254a5327968a03610a20_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-07-14_3b981466ac39254a5327968a03610a20_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-07-14_3b981466ac39254a5327968a03610a20_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 05f28e4b0bab3825eca358e57ca04bcd
SHA256 264879dba739ca1b7bf8ca392be1cb07bbfe6e0a9a5d67b07f6fa4b94827cedd
MD5 3b981466ac39254a5327968a03610a20
SHA1 1d7abdef298de628c67416d54b58adb0bb30a680
SHA512 bb4fc12a632e2c0886c3ea5c56457b0e13bbf3e62c671187517c33679f064227811b6f4cefbebdbb3ab21778dedab411998f8d14bbb4ef1c8e086f96f2091fcf
SSDEEP 24576:CA0tUXF2K2iMMfwoiJpGVFp5nOXm+M81GB+5ZFOSCHmhye/RiElaaYlCnp:L0OXFz9wvJpGVb5l+1e+SJe34a
TLSH
T163169E115A4C91F1E0BAF037726E46B639182325239BE0C36294EBD7B7520D1A73E97F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

631966

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError GetCurrentProcess GetTickCount FreeLibrary SetLastError HeapAlloc LocalFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection WriteFile GetStartupInfoW IsDebuggerPresent ReadFile SetEvent GetFileType GetModuleHandleA InitializeCriticalSection HeapReAlloc GetConsoleMode FlushFileBuffers CreateEventW TlsAlloc HeapSize WriteConsoleW LoadLibraryW CreateThread GetCPInfo SetFilePointer CompareStringW GetModuleFileNameA InitializeCriticalSectionAndSpinCount GetOEMCP GetEnvironmentStringsW SetStdHandle FreeEnvironmentStringsW IsValidCodePage VirtualAlloc GetConsoleCP GetCommandLineA ResetEvent ReleaseMutex CreateFileA OutputDebugStringW EncodePointer VirtualFree LoadLibraryA GetModuleHandleExW GetLocaleInfoW GetFullPathNameW LoadResource UnmapViewOfFile GetExitCodeProcess ExpandEnvironmentStringsW

user32

LoadStringW ShowWindow ReleaseDC GetDC GetWindowRect PostMessageW SendMessageW GetClientRect SetWindowPos LoadCursorW EndDialog SetFocus GetSysColor PeekMessageW ScreenToClient KillTimer RegisterClassW EnableMenuItem SystemParametersInfoW GetKeyState

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_3b981466ac39254a5327968a03610a20_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic