2026-08-01_3f9a75dace53a94cefe33d871576c62d_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-08-01_3f9a75dace53a94cefe33d871576c62d_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample260802-a91lhsar2t
SHA256 c33512fd2d05999bc36f618a28bb52c1aa93882c1cfd85d72ae7fa712b9bd68f
MD5 3f9a75dace53a94cefe33d871576c62d
SHA1 4794275817c26c3d00340f12ed3525de07f6c380
SHA512 47d3a53fb773832505f217b67825282ebe0120a2cc6a6127a90422fedfcc4b9f37a21273654e2935af02aec234a800071e45ea845f1db3d11d8bf435be8112e6
SSDEEP 49152:zBFrjqkjETdpiugOj4TUzx38OvXVm5qoYk0OXFz9wvJpGVb:vrjq7gHTCx3hPV6VrwvJpG
TLSH
T1B3169C71A8F0C022EB99F43FD265A6A73A581E205318D0FFB28106EB7D5C1DD6B39785
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_3f9a75dace53a94cefe33d871576c62d_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-08-01_3f9a75dace53a94cefe33d871576c62d_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-08-01_3f9a75dace53a94cefe33d871576c62d_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 814e544de245d22178f984597a9052cf
SHA256 c33512fd2d05999bc36f618a28bb52c1aa93882c1cfd85d72ae7fa712b9bd68f
MD5 3f9a75dace53a94cefe33d871576c62d
SHA1 4794275817c26c3d00340f12ed3525de07f6c380
SHA512 47d3a53fb773832505f217b67825282ebe0120a2cc6a6127a90422fedfcc4b9f37a21273654e2935af02aec234a800071e45ea845f1db3d11d8bf435be8112e6
SSDEEP 49152:zBFrjqkjETdpiugOj4TUzx38OvXVm5qoYk0OXFz9wvJpGVb:vrjq7gHTCx3hPV6VrwvJpG
TLSH
T1B3169C71A8F0C022EB99F43FD265A6A73A581E205318D0FFB28106EB7D5C1DD6B39785
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

3552425

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentThreadId GetCurrentProcessId GetProcAddress CloseHandle TerminateProcess Sleep MultiByteToWideChar SetLastError HeapFree HeapAlloc LocalFree DeleteCriticalSection EnterCriticalSection WriteFile GetStartupInfoW IsDebuggerPresent GetCommandLineW FindClose SetEvent FormatMessageW GetFileType TlsGetValue GetModuleHandleA HeapReAlloc HeapSetInformation HeapSize LoadLibraryW LoadLibraryExW CreateThread GetCPInfo TlsFree CompareStringW GetStringTypeW RtlUnwind LCMapStringW InitializeCriticalSectionAndSpinCount SetStdHandle FreeEnvironmentStringsW IsProcessorFeaturePresent DeleteFileW VirtualAlloc GetConsoleCP LocalAlloc DecodePointer ResetEvent GetVersionExW ReleaseMutex GetFileSize EncodePointer lstrlenW GetModuleHandleExW CreateDirectoryW GetFullPathNameW ExpandEnvironmentStringsW CreateProcessW

user32

DispatchMessageW ShowWindow DestroyWindow ReleaseDC PostQuitMessage CreateWindowExW GetMessageW GetSystemMetrics GetDC GetWindowRect PostMessageW SendMessageW GetClientRect IsWindow LoadCursorW EndDialog SetTimer SetFocus SetForegroundWindow EndPaint SetCursor KillTimer RegisterClassW UpdateWindow MessageBoxA CharUpperW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_3f9a75dace53a94cefe33d871576c62d_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic