2026-07-30_2baa76480c342eb4dcd3a04f22c90433_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-07-30_2baa76480c342eb4dcd3a04f22c90433_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample260730-2kzfpsydrb
SHA256 a489d4b02c82aed33367165d4497e6751760df33b5646a3ecd2b2482c0d952d4
MD5 2baa76480c342eb4dcd3a04f22c90433
SHA1 d719f55e048434aff31e7f93f7429e4b599c5549
SHA512 c2df0661a50c8e3a9641bbde99cc7abca1e8ef2aba182a117bb77ae799f8b999eea795c386b015f8ec8a7362d372d0a343da5ca31753cc2e45d2b96f4611bf21
SSDEEP 98304:sVrwvJpGWxtW317wTceeZx2cNnN+ScXM4j5jzXnGW9i:syI317YcmWnNhSM4j5j7nGr
TLSH
T121161261BB808077EDD60475A1AF5B368AAD6AF54334F4E7738448785E600D2AF32F4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_2baa76480c342eb4dcd3a04f22c90433_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-07-30_2baa76480c342eb4dcd3a04f22c90433_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-07-30_2baa76480c342eb4dcd3a04f22c90433_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH f14869ad83ecf61f0ec4ba785c434327
SHA256 a489d4b02c82aed33367165d4497e6751760df33b5646a3ecd2b2482c0d952d4
MD5 2baa76480c342eb4dcd3a04f22c90433
SHA1 d719f55e048434aff31e7f93f7429e4b599c5549
SHA512 c2df0661a50c8e3a9641bbde99cc7abca1e8ef2aba182a117bb77ae799f8b999eea795c386b015f8ec8a7362d372d0a343da5ca31753cc2e45d2b96f4611bf21
SSDEEP 98304:sVrwvJpGWxtW317wTceeZx2cNnN+ScXM4j5jzXnGW9i:syI317YcmWnNhSM4j5j7nGr
TLSH
T121161261BB808077EDD60475A1AF5B368AAD6AF54334F4E7738448785E600D2AF32F4B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9059

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcessId SetUnhandledExceptionFilter QueryPerformanceCounter GetProcAddress CloseHandle TerminateProcess Sleep GetTickCount FreeLibrary MultiByteToWideChar SetLastError HeapFree LocalFree LeaveCriticalSection WaitForSingleObject CreateFileW GetStdHandle GetStartupInfoW IsDebuggerPresent GetCommandLineW RaiseException GetACP FormatMessageW GetFileType InitializeCriticalSection FlushFileBuffers CreateEventW TlsAlloc WriteConsoleW LoadLibraryW LoadLibraryExW GetFileAttributesW CompareStringW RtlUnwind LCMapStringW InitializeCriticalSectionAndSpinCount GetOEMCP SetStdHandle FreeEnvironmentStringsW IsProcessorFeaturePresent FindNextFileW FindFirstFileW DeleteFileW VirtualAlloc GetConsoleCP DecodePointer SetEndOfFile GetVersionExW ReleaseMutex CreateFileA OutputDebugStringW GetFileSize EncodePointer VirtualFree lstrlenW LoadLibraryA GetFullPathNameW LoadResource GetExitCodeProcess CreateProcessW

user32

TranslateMessage LoadStringW ShowWindow DestroyWindow ReleaseDC DefWindowProcW MessageBoxW PostQuitMessage GetWindowLongW GetMessageW GetDlgItem GetDC GetWindowRect SendMessageW IsWindow LoadCursorW GetParent SetWindowTextW SetTimer GetSysColor EndPaint ScreenToClient SetCursor RegisterClassW SystemParametersInfoW GetKeyState MessageBoxA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_2baa76480c342eb4dcd3a04f22c90433_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic