2026-07-22_b6211ae356ec814ee873909ffa5b32ef_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-07-22_b6211ae356ec814ee873909ffa5b32ef_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample260722-3c8vvaswbs
SHA256 13df596bcd1c3e10b7741cb059178622ef9953695e8ac8bb6ed7541742302280
MD5 b6211ae356ec814ee873909ffa5b32ef
SHA1 b2aa3c3820ef9e0e5db2cdf14ad863c8619cb7e9
SHA512 dc6bc295f2dac0df953804b16047fa74d394f8f349016101e2f81c4f2e064f979280b8fe8dd9531d26fea312e00ae1c62ff4d4790e236a8ee6543bd654a4e2b3
SSDEEP 98304:2Lgh3V8TVb2KeXoPa7Xw4GMKnFhquSpazziUUM0dVrwvJpG:2slKeXW+w4unWuXzziS0d
TLSH
T14A1612A3E7C190F2F1B525FF65AA9F76493D1DA1233450CB73E1A7A009708D26631EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_b6211ae356ec814ee873909ffa5b32ef_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-07-22_b6211ae356ec814ee873909ffa5b32ef_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-07-22_b6211ae356ec814ee873909ffa5b32ef_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 6e694d6a770e8df3e6841d8cd1857dde
SHA256 13df596bcd1c3e10b7741cb059178622ef9953695e8ac8bb6ed7541742302280
MD5 b6211ae356ec814ee873909ffa5b32ef
SHA1 b2aa3c3820ef9e0e5db2cdf14ad863c8619cb7e9
SHA512 dc6bc295f2dac0df953804b16047fa74d394f8f349016101e2f81c4f2e064f979280b8fe8dd9531d26fea312e00ae1c62ff4d4790e236a8ee6543bd654a4e2b3
SSDEEP 98304:2Lgh3V8TVb2KeXoPa7Xw4GMKnFhquSpazziUUM0dVrwvJpG:2slKeXW+w4unWuXzziS0d
TLSH
T14A1612A3E7C190F2F1B525FF65AA9F76493D1DA1233450CB73E1A7A009708D26631EA3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9841

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcess GetCurrentProcessId SetUnhandledExceptionFilter Sleep MultiByteToWideChar LocalFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetProcessHeap GetStdHandle IsDebuggerPresent FindClose ReadFile GetFileType InitializeCriticalSection GetConsoleMode FlushFileBuffers TlsSetValue CreateEventW TlsAlloc HeapSize LoadLibraryW GetCPInfo TlsFree SetFilePointer GetFileAttributesW CompareStringW GetStringTypeW LCMapStringW InitializeCriticalSectionAndSpinCount GetOEMCP SetStdHandle FreeEnvironmentStringsW IsProcessorFeaturePresent FindNextFileW VirtualAlloc GetConsoleCP GetCommandLineA ResetEvent GetVersionExW ReleaseMutex CreateFileA OutputDebugStringW EncodePointer VirtualFree lstrlenW LoadLibraryA GetModuleHandleExW GetLocaleInfoW GetFullPathNameW UnmapViewOfFile ExpandEnvironmentStringsW CreateProcessW

user32

TranslateMessage ShowWindow MessageBoxW GetWindowLongW GetWindowRect PostMessageW IsWindow LoadCursorW GetParent SetWindowTextW SetTimer LoadIconW SetFocus SetForegroundWindow GetSysColor PeekMessageW EndPaint BeginPaint ScreenToClient InvalidateRect EnableMenuItem GetWindow UpdateWindow SystemParametersInfoW MessageBoxA CharUpperW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_b6211ae356ec814ee873909ffa5b32ef_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic