2026-08-04_8fcfa789af19f12019997bfbf5e5acd8_amadey_elex_glassworm_luca-stealer_magniber_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_8fcfa789af19f12019997bfbf5e5acd8_amadey_elex_glassworm_luca-stealer_magniber_njrat_smoke-loader
Size 2.2MB
Sample260804-g29b1sshjc
SHA256 d5c2d944984be7708e91d6957cd9ea12b03d9367507f4c6b308281acd545b64e
MD5 8fcfa789af19f12019997bfbf5e5acd8
SHA1 bfe5d77cd2dbd65659028c4a528186a4ce635300
SHA512 8b1d891cfd2210598f22bc806523e0c8656f7cfa0aabae9b54fda5e4f34f5b7eed576f782ba68742ee597aec932b18764ee4a7cc2bbfc9784a43990bb1f32333
SSDEEP 49152:neQ13ERvk6gRLc0opI0NmryLMJb5+Pl6bJTIZ5jdgp:ecERvkDR+KyeslgJTIZ5Bgp
TLSH
T1DBB5BF317105C036E59342F1A87DEFAE969C9E340BA658D7E3D43E6A99301C33B35A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_8fcfa789af19f12019997bfbf5e5acd8_amadey_elex_glassworm_luca-stealer_magniber_njrat_smoke-loader

File Explorer

2026-08-04_8fcfa789af19f12019997bfbf5e5acd8_amadey_elex_glassworm_luca-stealer_magniber_njrat_smoke-loader

.exe 2.2MB

2026-08-04_8fcfa789af19f12019997bfbf5e5acd8_amadey_elex_glassworm_luca-stealer_magniber_njrat_smoke-loader

IMPHASH eebfbb73330864d76576c61a4b688ae8
SHA256 d5c2d944984be7708e91d6957cd9ea12b03d9367507f4c6b308281acd545b64e
MD5 8fcfa789af19f12019997bfbf5e5acd8
SHA1 bfe5d77cd2dbd65659028c4a528186a4ce635300
SHA512 8b1d891cfd2210598f22bc806523e0c8656f7cfa0aabae9b54fda5e4f34f5b7eed576f782ba68742ee597aec932b18764ee4a7cc2bbfc9784a43990bb1f32333
SSDEEP 49152:neQ13ERvk6gRLc0opI0NmryLMJb5+Pl6bJTIZ5jdgp:ecERvkDR+KyeslgJTIZ5Bgp
TLSH
T1DBB5BF317105C036E59342F1A87DEFAE969C9E340BA658D7E3D43E6A99301C33B35A1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

903571

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\JenkinsWorkspace\workspace\client_build_installer\client\build\working_directory\RelWithDebInfo\UbisoftGameLauncher.pdb

discord-rpc.x86

Discord_Shutdown Discord_UpdatePresence Discord_Initialize

steam_api

SteamAPI_RegisterCallback SteamAPI_UnregisterCallResult SteamAPI_UnregisterCallback SteamInternal_FindOrCreateUserInterface SteamInternal_CreateInterface SteamInternal_ContextInit SteamAPI_GetHSteamUser SteamAPI_RunCallbacks SteamAPI_Shutdown SteamInternal_SteamAPI_Init SteamAPI_RegisterCallResult

shell32

ShellExecuteExW CommandLineToArgvW

advapi32

RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyW RegCloseKey GetTokenInformation LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken CreateProcessAsUserW

user32

DispatchMessageW TranslateMessage AllowSetForegroundWindow PostMessageW GetSystemMetrics RegisterRawInputDevices GetRawInputData GetAsyncKeyState DestroyWindow CreateWindowExW RegisterClassExW DefWindowProcW PeekMessageW WaitMessage PostQuitMessage GetQueueStatus MsgWaitForMultipleObjectsEx SetTimer

kernel32

ReadConsoleW GetConsoleMode SetEnvironmentVariableW GetFileType GetConsoleOutputCP LoadLibraryExW FreeLibrary FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetStdHandle GetTimeFormatW CompareStringW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FlushFileBuffers SetStdHandle IsValidCodePage GetACP GetOEMCP GetCommandLineA WriteConsoleW TlsFree TlsSetValue TlsGetValue TlsAlloc InterlockedPushEntrySList RtlUnwind GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent WakeAllConditionVariable InitializeSListHead GetCPInfo LCMapStringEx DecodePointer CloseHandle GetLastError CreateIoCompletionPort GetQueuedCompletionStatus OpenProcess IsProcessInJob CreateJobObjectW AssignProcessToJobObject SetInformationJobObject QueryInformationJobObject CreateToolhelp32Snapshot Process32FirstW Process32NextW GetEnvironmentStringsW FreeEnvironmentStringsW IsDebuggerPresent DebugBreak OutputDebugStringW SetLastError HeapAlloc HeapFree GetProcessHeap GetCurrentProcess TerminateProcess GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW WideCharToMultiByte SearchPathW CreateFileW GetFullPathNameW GetModuleFileNameW LoadLibraryW WaitForSingleObject Sleep GetModuleHandleExA GetExitCodeProcess OpenThread ResumeThread CreateProcessA CreateProcessW GetProcessId GetVersionExW GetNativeSystemInfo VirtualProtect IsWow64Process GetExitCodeThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAllocEx VirtualProtectEx WriteProcessMemory VirtualFreeEx ReadFile WriteFile GetOverlappedResult ResetEvent CreateEventW GetFileInformationByHandleEx HeapSize CreateThread FindClose FindNextFileW GetFileSizeEx SetEndOfFile SetFilePointerEx GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentProcessId ExitProcess LocalFree GetTimeZoneInformation GetLocaleInfoW GetTickCount OutputDebugStringA SetEvent WaitForMultipleObjectsEx RaiseException MultiByteToWideChar InitializeCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount TryEnterCriticalSection DeleteCriticalSection GetSystemTimeAsFileTime LoadLibraryA EncodePointer InitializeCriticalSectionEx GetStringTypeW InitOnceComplete InitOnceBeginInitialize QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive SleepConditionVariableSRW FormatMessageA GetLocaleInfoEx SetCurrentDirectoryW FindFirstFileExW

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

317KB

Virtual Size

317KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

193KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

608KB

Virtual Size

612KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_8fcfa789af19f12019997bfbf5e5acd8_amadey_elex_glassworm_luca-stealer_magniber_njrat_smoke-loader

discord-rpc.x86

steam_api

shell32

advapi32

user32

kernel32

generic