2026-08-01_35d8dcd2ffd91e1a9a232e2d86aa0491_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_35d8dcd2ffd91e1a9a232e2d86aa0491_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos
Size 2.7MB
Sample260802-bdawnaar8w
SHA256 0a79f33eb3b95a688822d5f3c99fec4bb29a6aab7a2cf2365aa80638096e7af5
MD5 35d8dcd2ffd91e1a9a232e2d86aa0491
SHA1 33e1385a8809fc8f233793502ee75bf0dd1b5d4b
SHA512 bc1a4a316146c5723cab4fcecae3d2d97737d8ce8fdb4ad4f15fc7814079bc716db56245f1f9213133c016e6df1aa76c9c1678db99a65a2e5fb1f22378246965
SSDEEP 49152:b6WhVIuuUrFxNp4+2oanSWdu6J+yWkWB3j2Q0eEnfwKGEDtThZk:bFVIExNi+2ru6J+yZ78IV+
TLSH
T16CD59E2EBD55C032D56201B05929CBABE22DAE35076204CBBFE8793DD9745C25B33B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-08-01_35d8dcd2ffd91e1a9a232e2d86aa0491_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos

File Explorer

2026-08-01_35d8dcd2ffd91e1a9a232e2d86aa0491_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos

.exe 2.7MB

2026-08-01_35d8dcd2ffd91e1a9a232e2d86aa0491_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos

IMPHASH adb9533ee5d558c1c16cfda172ccca4b
SHA256 0a79f33eb3b95a688822d5f3c99fec4bb29a6aab7a2cf2365aa80638096e7af5
MD5 35d8dcd2ffd91e1a9a232e2d86aa0491
SHA1 33e1385a8809fc8f233793502ee75bf0dd1b5d4b
SHA512 bc1a4a316146c5723cab4fcecae3d2d97737d8ce8fdb4ad4f15fc7814079bc716db56245f1f9213133c016e6df1aa76c9c1678db99a65a2e5fb1f22378246965
SSDEEP 49152:b6WhVIuuUrFxNp4+2oanSWdu6J+yWkWB3j2Q0eEnfwKGEDtThZk:bFVIExNi+2ru6J+yZ78IV+
TLSH
T16CD59E2EBD55C032D56201B05929CBABE22DAE35076204CBBFE8793DD9745C25B33B1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

92:e6:a2:52:3f:b9:77:e6:30:db:89:88:a4:e0:f2:51:28:ee:ac:1e:81:2f:4f:fe:a6:e9:5f:1b:e3:81:b1:74:82:ab:13:37:c2:4d:f7:6d:2f:99:8b:b2:5d:8a:31:a0

Digest Algorithm

sha384

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=02096520,CN=Sophos Ltd,OU=Endpoint Security Group,O=Sophos Ltd,L=Abingdon,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Apr 13, 2026

SERIALNUMBER=02096520,CN=Sophos Ltd,OU=Endpoint Security Group,O=Sophos Ltd,L=Abingdon,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert G5 CS RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Subject

CN=DigiCert G5 CS RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

01:02:62:e1:62:24:ca:6d:fe:f5:84:f8:c6:30:48:db

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2021 - Feb 10, 2036

Subject

SERIALNUMBER=02096520,CN=Sophos Ltd,OU=Endpoint Security Group,O=Sophos Ltd,L=Abingdon,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

07:d9:61:4b:c5:83:39:77:d4:e7:47:15:2b:ee:a1:64

Issuer

CN=DigiCert G5 CS RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 15, 2025 - Jul 14, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

210048

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

SophosSetup.pdb

shell32

CommandLineToArgvW

kernel32

HeapSize HeapReAlloc GetCommandLineW SetEnvironmentVariableW CreateFileW WriteFile OutputDebugStringW GetLastError GetSystemDirectoryW LoadResource LockResource SizeofResource FindResourceW ReOpenFile GetProcessHeap HeapSetInformation GetCurrentProcessId SetDllDirectoryW FindClose CloseHandle FreeLibrary LocalFree WaitForSingleObject TerminateProcess GetExitCodeProcess OpenProcess CreateDirectoryW GetVolumeInformationW GetTempPathW GetCurrentProcess GetModuleHandleW GetProcAddress CreateProcessW InitializeProcThreadAttributeList UpdateProcThreadAttribute LoadLibraryExW GetEnvironmentVariableW LoadLibraryExA SetSearchPathMode OutputDebugStringA ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetCurrentThreadId GetConsoleMode WriteConsoleW FlushFileBuffers GetFileInformationByHandle SetEndOfFile SetFilePointer DeviceIoControl MoveFileExW ReplaceFileW GetFileInformationByHandleEx FindFirstFileW GetFileAttributesW GetModuleFileNameW GetStdHandle FileTimeToSystemTime Sleep FreeEnvironmentStringsW DeleteProcThreadAttributeList FormatMessageW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation GetConsoleOutputCP RaiseException GetSystemInfo VirtualProtect VirtualQuery WakeAllConditionVariable SleepConditionVariableSRW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW FormatMessageA GetLocaleInfoEx FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetStringTypeW TryAcquireSRWLockExclusive WaitForSingleObjectEx GetExitCodeThread WakeConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW ExitProcess HeapAlloc HeapFree GetFileType SetStdHandle GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetFilePointerEx

Name

.text

Size

332KB

Virtual Size

331KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

213KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_35d8dcd2ffd91e1a9a232e2d86aa0491_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos

shell32

kernel32

generic