General
- Target 2026-07-30_d938aa400bd6722d453a191dce929b2d_amadey_elex_glassworm_hijackloader_kwampirs_luca-stealer_mafia_njrat_smoke-loader
- Size 2.2MB
- Sample260730-dbhvla1xbv
- SHA256 1950829da4dff9b8659a9d8be2638dfb1cd5263cb133ce442053e79a3ebf0db4
- MD5 d938aa400bd6722d453a191dce929b2d
- SHA1 297132507cae6f9e72cf64c0f24a1468d70708f2
- SHA512 fbe1ea7abae445cd4a8d3853b5fc6de442cd49f2368b52f4dd0cee8bb762c6e9f7fb2ddc6ae4576edf08a7ed3793a82bc472a0a7b73bcb3843f90bc5548d0dd7
- SSDEEP 49152:Y+7SE4TLTCC5fUWUKQYUD7wB96KKkShqzU0LyTKS:H7SES+C5Ddcc9JShOpS
- TLSH T1B1B5AE12B7C1C1B3D4560170697997BA5B39BD260B20A5C7B3DC276E5F302D0AF7A38A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_d938aa400bd6722d453a191dce929b2d_amadey_elex_glassworm_hijackloader_kwampirs_luca-stealer.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_d938aa400bd6722d453a191dce929b2d_amadey_elex_glassworm_hijackloader_kwampirs_luca-stealer.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-30_d938aa400bd6722d453a191dce929b2d_amadey_elex_glassworm_hijackloader_kwampirs_luca-stealer_mafia_njrat_smoke-loader
- Size 2.2MB
- SHA256 1950829da4dff9b8659a9d8be2638dfb1cd5263cb133ce442053e79a3ebf0db4
- MD5 d938aa400bd6722d453a191dce929b2d
- SHA1 297132507cae6f9e72cf64c0f24a1468d70708f2
- SHA512 fbe1ea7abae445cd4a8d3853b5fc6de442cd49f2368b52f4dd0cee8bb762c6e9f7fb2ddc6ae4576edf08a7ed3793a82bc472a0a7b73bcb3843f90bc5548d0dd7
- SSDEEP 49152:Y+7SE4TLTCC5fUWUKQYUD7wB96KKkShqzU0LyTKS:H7SES+C5Ddcc9JShOpS
- TLSH T1B1B5AE12B7C1C1B3D4560170697997BA5B39BD260B20A5C7B3DC276E5F302D0AF7A38A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application