2026-08-01_e055dc440f5a8c66f8f2247de667aa1e_amadey_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_e055dc440f5a8c66f8f2247de667aa1e_amadey_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
Size 4.8MB
Sample260802-efbgracf93
SHA256 021d1bf2cfaa30518213ff4a2d9d2610337d6b81039d8b35ac514c074b9ea9cc
MD5 e055dc440f5a8c66f8f2247de667aa1e
SHA1 bad1a7025dae58152311a56b411b1337941a2f1c
SHA512 aca2797c1792a8cf55942a65f5731060c933faf17d88f160da5a257b7fb8dd291832f07d573257e2e3fa5bdc79892ea7edc6cc710f09dc64a62d7bac78886506
SSDEEP 98304:nSM3qe4Hwy/Gnly5xPJiAAEMTZZd4PNOL/cAAquyb688qTo+pXG:n34sOVcAA7ZsNOL/DAsb6BqTo+pW
TLSH
T112360120F912C136E5A642319DBCAFBB84ADB7251B7418C773C40F2E5A705E31E36A67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_e055dc440f5a8c66f8f2247de667aa1e_amadey_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-08-01_e055dc440f5a8c66f8f2247de667aa1e_amadey_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

.exe 4.8MB

2026-08-01_e055dc440f5a8c66f8f2247de667aa1e_amadey_elex_glassworm_luca-stealer_medusalocker_njrat_remcos

IMPHASH 0c9ce77099e2e4ef4eda6522544a4517
SHA256 021d1bf2cfaa30518213ff4a2d9d2610337d6b81039d8b35ac514c074b9ea9cc
MD5 e055dc440f5a8c66f8f2247de667aa1e
SHA1 bad1a7025dae58152311a56b411b1337941a2f1c
SHA512 aca2797c1792a8cf55942a65f5731060c933faf17d88f160da5a257b7fb8dd291832f07d573257e2e3fa5bdc79892ea7edc6cc710f09dc64a62d7bac78886506
SSDEEP 98304:nSM3qe4Hwy/Gnly5xPJiAAEMTZZd4PNOL/cAAquyb688qTo+pXG:n34sOVcAA7ZsNOL/DAsb6BqTo+pW
TLSH
T112360120F912C136E5A642319DBCAFBB84ADB7251B7418C773C40F2E5A705E31E36A67
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

875508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\984578\out\Release\360AIOfficeSetup.pdb

kernel32

SetEndOfFile GetDiskFreeSpaceExW SetFileAttributesW DeleteFileW MoveFileExW GetVolumeInformationW GetCurrentProcess lstrcmpA lstrcmpiW GetModuleHandleExW GlobalSize GlobalLock GlobalUnlock GetVersionExW GetVersion InterlockedIncrement GetCommandLineW CreateToolhelp32Snapshot MapViewOfFile GetModuleHandleA LoadLibraryW CreateFileMappingW UnmapViewOfFile InterlockedCompareExchange FindNextFileW FindFirstFileW GetFileAttributesExW GetPrivateProfileStringW GetPrivateProfileIntW FindResourceExW FindResourceW OutputDebugStringW FindClose WriteConsoleW SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetFileType ExitProcess ExitThread RtlUnwind UnregisterWaitEx SetFilePointer ReadFile WriteFile GetFileSizeEx SizeofResource LoadResource GetCurrentThreadId GetProcessHeap HeapDestroy LockResource GetModuleFileNameW DeleteCriticalSection InitializeCriticalSection LocalFree GetUserDefaultLCID GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetTimeFormatW GetDateFormatW SetThreadAffinityMask LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes TerminateProcess CreateSemaphoreW Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList DuplicateHandle FreeLibraryAndExitThread GetCurrentThread UnregisterWait RegisterWaitForSingleObject DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue ReleaseSemaphore GetProcessAffinityMask GlobalMemoryStatus GetStdHandle GetFileInformationByHandle GetSystemWindowsDirectoryW FreeResource lstrcmpiA InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW GetACP MulDiv CreateDirectoryW GetCurrentDirectoryW SetFileTime GetFileAttributesW VerifyVersionInfoW VerSetConditionMask ReleaseMutex HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread QueryPerformanceFrequency QueryPerformanceCounter GetCPInfo FormatMessageW TryEnterCriticalSection GetStringTypeW IsDebuggerPresent SetFilePointerEx SystemTimeToFileTime HeapSize DeviceIoControl HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError GetLastError RaiseException CloseHandle InterlockedDecrement GlobalFree GlobalAlloc Process32NextW GetCurrentProcessId Process32FirstW CreateFileW

user32

GetWindowLongW DestroyWindow IsWindow CharUpperW CreateWindowExW GetDesktopWindow DrawTextW GetSysColor ClientToScreen GetAsyncKeyState EmptyClipboard SetClipboardData UnionRect IntersectRect SetCursor EqualRect MonitorFromPoint LoadCursorW PtInRect RegisterClassExW DefWindowProcW PostMessageW GetWindowThreadProcessId SetForegroundWindow GetForegroundWindow SetActiveWindow BringWindowToTop IsIconic ShowWindow wsprintfW SetWindowLongW AttachThreadInput IsRectEmpty SetWindowTextW EnableWindow SetFocus GetMonitorInfoW MonitorFromWindow LoadImageW GetWindow GetParent MapWindowPoints GetWindowRect GetClientRect GetSystemMetrics KillTimer SetTimer PostQuitMessage SendMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW CharNextW FindWindowW IsClipboardFormatAvailable GetClipboardData CloseClipboard OpenClipboard IsWindowVisible SetWindowPos CallWindowProcW RegisterClassW UpdateLayeredWindow MoveWindow IsZoomed GetFocus GetKeyState SetCapture ReleaseCapture GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect SetWindowRgn InvalidateRect GetCursorPos ScreenToClient OffsetRect

advapi32

EnumServicesStatusW RegEnumKeyExA RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegSetValueExW RegQueryInfoKeyW RegEnumKeyExW GetTokenInformation OpenProcessToken OpenSCManagerW CloseServiceHandle RegOpenKeyW RegQueryValueExW

shell32

SHGetPathFromIDListW ord165 SHGetSpecialFolderPathW SHBrowseForFolderW ShellExecuteW CommandLineToArgvW SHGetFolderPathW

ole32

CoTaskMemAlloc CoTaskMemFree CoCreateInstance CoUninitialize OleUninitialize OleInitialize CoTaskMemRealloc CoInitialize CreateStreamOnHGlobal CoInitializeEx CoCreateGuid

oleaut32

SysAllocStringLen VariantInit SysStringLen VarUI4FromStr SysFreeString SysAllocString VariantClear

shlwapi

SHGetValueA PathIsRelativeW SHSetValueA StrStrIA StrTrimA SHSetValueW PathIsDirectoryW StrCmpNIW ord176 StrCmpIW SHGetValueW PathRemoveFileSpecW PathFindFileNameW PathCombineW PathAppendW StrStrIW PathFileExistsW

version

VerQueryValueW

gdiplus

GdipStringFormatGetGenericTypographic GdipDeleteStringFormat GdipDrawString GdipMeasureString GdipDeleteFont GdipCloneStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipDisposeImage GdipCloneImage GdipFree GdipAlloc GdipSetPathGradientPresetBlend GdipCreateFontFromLogfontA GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdiplusStartup GdiplusShutdown GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipCreatePath GdipDeletePath GdipAddPathPath GdipCreateRegionPath GdipDeleteRegion GdipCreateFontFromDC GdipDeleteBrush GdipCreatePathGradientFromPath GdipCloneBrush GdipSetPathGradientWrapMode GdipSetPathGradientFocusScales GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetPixelOffsetMode GdipFillRegion GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCreateLineBrushFromRect GdipSetLineBlend GdipCreatePen1 GdipCreatePen2 GdipDeletePen GdipLoadImageFromFile GdipImageRotateFlip GdipSetWorldTransform GdipDrawArc GdipDrawImageRect GdipClosePathFigure GdipAddPathLine ord1 GdipAddPathRectangle GdipAddPathEllipse GdipCreateSolidFill GdipCreateLineBrushFromRectI GdipSetPenDashStyle GdipSetPenDashArray GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipTranslateWorldTransform GdipRotateWorldTransform GdipGetWorldTransform GdipDrawLineI GdipDrawRectangleI GdipDrawEllipse GdipDrawPath GdipFillEllipse GdipFillPath GdipDrawImageRectRectI GdipSetClipPath GdipResetClip

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

winmm

timeKillEvent timeSetEvent

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext

iphlpapi

GetAdaptersInfo

wininet

InternetCrackUrlW InternetOpenW InternetCloseHandle InternetConnectW InternetSetOptionW HttpOpenRequestW HttpSendRequestW HttpQueryInfoW

gdi32

CreateFontIndirectW GetStockObject GetObjectW DeleteObject CreateRectRgnIndirect GetWindowOrgEx RestoreDC SaveDC ExtSelectClipRgn CreateCompatibleDC DeleteDC SelectObject SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor CreateDIBSection GetObjectA SetWindowOrgEx CreateRoundRectRgn BitBlt GetDeviceCaps

msimg32

AlphaBlend

generic

count=32, id=241, version=40116,

count=194, id=243, version=40116,

count=40, id=242, version=40116,

count=12, id=260, version=27051,

count=1, productName=Unmarked objects (old),

count=6, id=261, version=27034,

count=4, id=261, version=27024,

count=4, id=199, version=41118,

count=28, id=259, version=26706,

count=103, id=261, version=27051,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=10, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=40, id=260, version=26706,

count=134, id=261, version=26706,

count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=47, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=663, id=1, productName=Unmarked objects,

count=1, id=261, version=28106,

count=30, id=261, version=27048,

count=16, id=260, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,