2026-08-04_e15a9ab13f8042351653a7abe71280bb_amadey_elex_glassworm_luca-stealer_matanbuchus_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_e15a9ab13f8042351653a7abe71280bb_amadey_elex_glassworm_luca-stealer_matanbuchus_njrat_remcos_smoke-loader
Size 1.2MB
Sample260804-fs2eda1hna
SHA256 5c2d19273fb967604f9b26e8a09feb478b8f8da98471c0a561bd4ec85680aee2
MD5 e15a9ab13f8042351653a7abe71280bb
SHA1 b901f412e5ea36db0fc867512cbb73f0260a0568
SHA512 9e7519790fd9cd006e51ddbb5d5244ffed99616d0e0ea3afe75f390f74dbfdca3d1826370ead2070e6e5fe46101e877f6799aed0a39632770346c999d00bb43e
SSDEEP 24576:b1mXj495+FPaibuVBczDl8LUn7HkxjR7SyIzkQ8:Izo+FSAuVKzDqon7HklQI
TLSH
T1DC45BE1179D2C032E1730531D5B9DAB2597DBD200B7089DBA3D8BE2EBA711C2A634F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_e15a9ab13f8042351653a7abe71280bb_amadey_elex_glassworm_luca-stealer_matanbuchus_njrat_remcos_smoke-loader

File Explorer

2026-08-04_e15a9ab13f8042351653a7abe71280bb_amadey_elex_glassworm_luca-stealer_matanbuchus_njrat_remcos_smoke-loader

.exe 1.2MB

2026-08-04_e15a9ab13f8042351653a7abe71280bb_amadey_elex_glassworm_luca-stealer_matanbuchus_njrat_remcos_smoke-loader

IMPHASH 96ad112daaa8350b6e84b3e0e519e5bc
SHA256 5c2d19273fb967604f9b26e8a09feb478b8f8da98471c0a561bd4ec85680aee2
MD5 e15a9ab13f8042351653a7abe71280bb
SHA1 b901f412e5ea36db0fc867512cbb73f0260a0568
SHA512 9e7519790fd9cd006e51ddbb5d5244ffed99616d0e0ea3afe75f390f74dbfdca3d1826370ead2070e6e5fe46101e877f6799aed0a39632770346c999d00bb43e
SSDEEP 24576:b1mXj495+FPaibuVBczDl8LUn7HkxjR7SyIzkQ8:Izo+FSAuVKzDqon7HklQI
TLSH
T1DC45BE1179D2C032E1730531D5B9DAB2597DBD200B7089DBA3D8BE2EBA711C2A634F67
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69161

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BuildAgent\work\5a15121f7d684e23\setupexe\Stardust\setupexe.pdb

msi

ord175 ord169 ord70 ord141 ord190 ord88

comctl32

ord17

psapi

GetModuleFileNameExW

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW WTSEnumerateProcessesW

secur32

LsaEnumerateLogonSessions LsaGetLogonSessionData

kernel32

HeapFree GetCurrentProcess GetTempPathW WaitForSingleObject DuplicateHandle OpenProcess GetVersion GetLastError OutputDebugStringW LoadLibraryA CloseHandle HeapAlloc GetProcAddress LocalFree GetProcessHeap FreeLibrary CreateFileW UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualQuery GetModuleFileNameW GetVersionExW CreateToolhelp32Snapshot MultiByteToWideChar Process32NextW Process32FirstW LoadLibraryW GetCurrentProcessId OpenMutexW CompareStringW GetCommandLineW GetUserDefaultUILanguage FormatMessageW DeleteFileW VerSetConditionMask VerifyVersionInfoW lstrlenW WideCharToMultiByte LCMapStringW LockResource LoadResource SizeofResource WriteFile LoadLibraryExW FindResourceExA SetFilePointerEx FindClose ExpandEnvironmentStringsW MoveFileExW HeapReAlloc HeapSize GetTempFileNameW CreateDirectoryW GetFileAttributesW GetModuleFileNameA ProcessIdToSessionId EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType GetACP GetModuleHandleExW ExitProcess GetStdHandle RaiseException RtlUnwind GetStartupInfoW FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW FindFirstFileExA SetStdHandle FlushFileBuffers GetConsoleCP GetConsoleMode WriteConsoleW IsDebuggerPresent InitializeSListHead GetCurrentThreadId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer GetCPInfo GetLocaleInfoW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW

user32

LoadStringW MessageBoxW MessageBoxExW EndDialog SetWindowTextW SetDlgItemTextW IsDlgButtonChecked SetDlgItemTextA DialogBoxParamW EnableWindow GetDlgItem

advapi32

LsaNtStatusToWinError LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey EqualSid CopySid ConvertStringSidToSidW OpenProcessToken RegOpenKeyExW ConvertSidToStringSidW GetLengthSid DuplicateTokenEx RegQueryValueExW LookupAccountNameW GetTokenInformation

shell32

SHGetFolderPathW CommandLineToArgvW

ole32

StringFromGUID2

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_e15a9ab13f8042351653a7abe71280bb_amadey_elex_glassworm_luca-stealer_matanbuchus_njrat_remcos_smoke-loader

msi

comctl32

psapi

wtsapi32

secur32

kernel32

user32

advapi32

shell32

ole32

generic