2026-07-30_2c5394c295a0783c4e61230c493e5959_amadey_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader_wapomi

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_2c5394c295a0783c4e61230c493e5959_amadey_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader_wapomi
Size 1.0MB
Sample260730-js8egafj91
SHA256 eb463864cb3e22603ad9bd4fda22533dd611760a91fd36607dd1963ab7a832fa
MD5 2c5394c295a0783c4e61230c493e5959
SHA1 b19748461f21ec68b0400472a3379e70a30982b5
SHA512 514c0af6023da9adba3c92321a7a41ff6c6c889d3af21cc35c417edfaa93b2e20ce26d1e8ea59e9f691301c10f135b8f0cedd01542438a2c1ff772a03436c752
SSDEEP 24576:RfoM0Y7ScPlZ0aNZUZboX+sZTTXbdbhw:N/NyAZUZEPTTrdq
TLSH
T179358C217442C43BE2B151B1C468FBFC856E7E24CB2681D3A3E43E6B79346D26E35672
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_2c5394c295a0783c4e61230c493e5959_amadey_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader_wapomi

File Explorer

2026-07-30_2c5394c295a0783c4e61230c493e5959_amadey_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader_wapomi

.exe 1.0MB

2026-07-30_2c5394c295a0783c4e61230c493e5959_amadey_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader_wapomi

IMPHASH 8787a5fdb5d62ae4029379e0f06a0dd8
SHA256 eb463864cb3e22603ad9bd4fda22533dd611760a91fd36607dd1963ab7a832fa
MD5 2c5394c295a0783c4e61230c493e5959
SHA1 b19748461f21ec68b0400472a3379e70a30982b5
SHA512 514c0af6023da9adba3c92321a7a41ff6c6c889d3af21cc35c417edfaa93b2e20ce26d1e8ea59e9f691301c10f135b8f0cedd01542438a2c1ff772a03436c752
SSDEEP 24576:RfoM0Y7ScPlZ0aNZUZboX+sZTTXbdbhw:N/NyAZUZEPTTrdq
TLSH
T179358C217442C43BE2B151B1C468FBFC856E7E24CB2681D3A3E43E6B79346D26E35672
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1073152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildslave\unity\build\artifacts\UnityCrashHandler\release_Win32_VS2019\UnityCrashHandler32.pdb

user32

EndDialog GetDlgItem SendDlgItemMessageA SetWindowTextW AdjustWindowRect SendMessageW DialogBoxParamA SetWindowPos OffsetRect UnionRect SetForegroundWindow InflateRect GetWindowLongA GetIconInfo LoadImageA CreateIconFromResourceEx LookupIconIdFromDirectoryEx

kernel32

DuplicateHandle VirtualProtect GetVersionExW UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation SignalObjectAndWait CreateTimerQueue WriteConsoleW GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapQueryInformation HeapSize HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapFree HeapAlloc FreeLibraryAndExitThread GetConsoleCP GetConsoleMode SetConsoleCtrlHandler GetFileType SetStdHandle GetModuleHandleExW ExitProcess InterlockedFlushSList InterlockedPushEntrySList CloseHandle RaiseException GetCurrentThread OpenThread GetThreadTimes EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount TryEnterCriticalSection DeleteCriticalSection WaitForSingleObjectEx SwitchToThread CreateThread GetCurrentThreadId SetThreadPriority GetThreadPriority FreeLibrary GetModuleFileNameA GetModuleFileNameW GetProcAddress LoadLibraryA LoadLibraryW MultiByteToWideChar WideCharToMultiByte GetCurrentProcess SuspendThread ResumeThread TlsGetValue TlsSetValue GetThreadContext GetLastError SetLastError CreateEventW CreateFileW DeleteFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW FlushFileBuffers InterlockedPopEntrySList GetFileAttributesA GetFileAttributesW ReadFile SetFilePointerEx WriteFile GetEnvironmentVariableA GetCurrentDirectoryA OutputDebugStringA GetSystemTime ReadProcessMemory VerSetConditionMask GetSystemTimeAsFileTime GetCurrentProcessId GetModuleHandleW WaitForSingleObject LocalFree FormatMessageW VerifyVersionInfoW CreateToolhelp32Snapshot Thread32First Thread32Next GetStdHandle GetFileSize GetTempPathW SetEvent WaitForMultipleObjectsEx TerminateProcess GetExitCodeProcess CreateProcessW GetProcessId GetThreadId OpenProcess CopyFileExW AllocConsole SetErrorMode GetCommandLineW InitializeCriticalSection CreateEventA TerminateThread GetExitCodeThread GetModuleHandleA LoadLibraryExW LoadResource LockResource SizeofResource FindResourceA EnumResourceNamesA GetFileSizeEx IsDebuggerPresent QueryPerformanceCounter QueryPerformanceFrequency ReleaseSemaphore TlsAlloc TlsFree VirtualAlloc VirtualFree VirtualQuery RtlUnwind GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo DecodePointer EncodePointer GetTickCount GetStringTypeW InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent QueryDepthSList UnregisterWaitEx ResetEvent Sleep

shell32

SHCreateDirectoryExW CommandLineToArgvW

ole32

CoInitializeEx CoTaskMemFree CoCreateGuid

psapi

GetModuleFileNameExW

advapi32

GetUserNameA

wininet

InternetOpenA InternetCloseHandle HttpQueryInfoA HttpSendRequestA HttpOpenRequestA InternetConnectA InternetCrackUrlA

gdi32

GetObjectA

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

Name

.text

Size

422KB

Virtual Size

421KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

107KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

472KB

Virtual Size

471KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

�P� �u�

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_2c5394c295a0783c4e61230c493e5959_amadey_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader_wapomi

user32

kernel32

shell32

ole32

psapi

advapi32

wininet

gdi32

version

generic