2026-07-15_523b419a8594b4ec03e88b2a965ad5c1_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-15_523b419a8594b4ec03e88b2a965ad5c1_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos
Size 2.7MB
Sample260716-aba8zagw2q
SHA256 77fc8d086fa993c1616e53018a62013454f318e21ef5f05e1b31ab1c6f964d6d
MD5 523b419a8594b4ec03e88b2a965ad5c1
SHA1 27f8051aa31aee4b92948b5ab74a8bf61632c1f7
SHA512 719538e74eafbbf546f4c0d95a59ed6375d86456d57c85d7fca56d777465697df25cc91232bf5656baa53f03d2c1005780018a94a83222216f831158ec057d0a
SSDEEP 49152:y6WhVIuuUrFxNp4+2oanSWdu6J+yWkWB3j2Q0eEnfwKGEDtThZs:yFVIExNi+2ru6J+yZ78IVW
TLSH
T1C1D59E2EBD55C032D56201B05929CBABE22DAE35076204CBBFE8793DD9745C25B33B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-07-15_523b419a8594b4ec03e88b2a965ad5c1_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos

File Explorer

2026-07-15_523b419a8594b4ec03e88b2a965ad5c1_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos

.exe 2.7MB

2026-07-15_523b419a8594b4ec03e88b2a965ad5c1_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos

IMPHASH adb9533ee5d558c1c16cfda172ccca4b
SHA256 77fc8d086fa993c1616e53018a62013454f318e21ef5f05e1b31ab1c6f964d6d
MD5 523b419a8594b4ec03e88b2a965ad5c1
SHA1 27f8051aa31aee4b92948b5ab74a8bf61632c1f7
SHA512 719538e74eafbbf546f4c0d95a59ed6375d86456d57c85d7fca56d777465697df25cc91232bf5656baa53f03d2c1005780018a94a83222216f831158ec057d0a
SSDEEP 49152:y6WhVIuuUrFxNp4+2oanSWdu6J+yWkWB3j2Q0eEnfwKGEDtThZs:yFVIExNi+2ru6J+yZ78IVW
TLSH
T1C1D59E2EBD55C032D56201B05929CBABE22DAE35076204CBBFE8793DD9745C25B33B1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

92:e6:a2:52:3f:b9:77:e6:30:db:89:88:a4:e0:f2:51:28:ee:ac:1e:81:2f:4f:fe:a6:e9:5f:1b:e3:81:b1:74:82:ab:13:37:c2:4d:f7:6d:2f:99:8b:b2:5d:8a:31:a0

Digest Algorithm

sha384

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=02096520,CN=Sophos Ltd,OU=Endpoint Security Group,O=Sophos Ltd,L=Abingdon,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Apr 13, 2026

SERIALNUMBER=02096520,CN=Sophos Ltd,OU=Endpoint Security Group,O=Sophos Ltd,L=Abingdon,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert G5 CS RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Subject

CN=DigiCert G5 CS RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

01:02:62:e1:62:24:ca:6d:fe:f5:84:f8:c6:30:48:db

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2021 - Feb 10, 2036

Subject

SERIALNUMBER=02096520,CN=Sophos Ltd,OU=Endpoint Security Group,O=Sophos Ltd,L=Abingdon,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

07:d9:61:4b:c5:83:39:77:d4:e7:47:15:2b:ee:a1:64

Issuer

CN=DigiCert G5 CS RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 15, 2025 - Jul 14, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

210048

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

SophosSetup.pdb

shell32

CommandLineToArgvW

kernel32

HeapSize HeapReAlloc GetCommandLineW SetEnvironmentVariableW CreateFileW WriteFile OutputDebugStringW GetLastError GetSystemDirectoryW LoadResource LockResource SizeofResource FindResourceW ReOpenFile GetProcessHeap HeapSetInformation GetCurrentProcessId SetDllDirectoryW FindClose CloseHandle FreeLibrary LocalFree WaitForSingleObject TerminateProcess GetExitCodeProcess OpenProcess CreateDirectoryW GetVolumeInformationW GetTempPathW GetCurrentProcess GetModuleHandleW GetProcAddress CreateProcessW InitializeProcThreadAttributeList UpdateProcThreadAttribute LoadLibraryExW GetEnvironmentVariableW LoadLibraryExA SetSearchPathMode OutputDebugStringA ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetCurrentThreadId GetConsoleMode WriteConsoleW FlushFileBuffers GetFileInformationByHandle SetEndOfFile SetFilePointer DeviceIoControl MoveFileExW ReplaceFileW GetFileInformationByHandleEx FindFirstFileW GetFileAttributesW GetModuleFileNameW GetStdHandle FileTimeToSystemTime Sleep FreeEnvironmentStringsW DeleteProcThreadAttributeList FormatMessageW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation GetConsoleOutputCP RaiseException GetSystemInfo VirtualProtect VirtualQuery WakeAllConditionVariable SleepConditionVariableSRW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW FormatMessageA GetLocaleInfoEx FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetStringTypeW TryAcquireSRWLockExclusive WaitForSingleObjectEx GetExitCodeThread WakeConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW ExitProcess HeapAlloc HeapFree GetFileType SetStdHandle GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetFilePointerEx

Name

.text

Size

332KB

Virtual Size

331KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

213KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-15_523b419a8594b4ec03e88b2a965ad5c1_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos

shell32

kernel32

generic