6b784535a1d482582e9fd7c639c1f4ec01ad27bc8341de0a9f550608b2f295c3

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 08:44

Target
2026-08-03_ff68e6d9749c2c408e134e52bd261a12_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
Size 10.6MB
Sample260804-knhtpawbpc
SHA256 6b784535a1d482582e9fd7c639c1f4ec01ad27bc8341de0a9f550608b2f295c3
MD5 ff68e6d9749c2c408e134e52bd261a12
SHA1 c9995c67e225976e17fed7024315dbf87f252637
SHA512 e24dbc249db5836012f1f9a243ffd354da7002c89d95f5d21608b191f40e2276a2ee46a0019c19490fecdd86d2407e18801f06c969b475d546a84d78671b83c3
SSDEEP 196608:zSV7Rr+knK5ir9uSrdN4CjCYI/0BdQmsg:qFqknK5irASrL4CjC6bQJg
TLSH
T1BDB6BE23B245C036E55021F1681FAB5A63207E7A13B188CBF5E2AF6D16E46C74B35F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

upx

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/916-0-0x0000000000C10000-0x00000000016B5000-memory.dmp	UPX
behavioral2/memory/916-1-0x0000000000C10000-0x00000000016B5000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/916-0-0x0000000000C10000-0x00000000016B5000-memory.dmp	upx
behavioral2/memory/916-1-0x0000000000C10000-0x00000000016B5000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3624	916	WerFault.exe	86
3644	916	WerFault.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-03_ff68e6d9749c2c408e134e52bd261a12_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_ff68e6d9749c2c408e134e52bd261a12_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe"
1⤵
PID:916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 248
  2⤵
  - Program crash
  PID:3624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 268
  2⤵
  - Program crash
  PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 916 -ip 916
1⤵
PID:2872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 916 -ip 916
1⤵
PID:2728

memory/916-0-0x0000000000C10000-0x00000000016B5000-memory.dmp

Download

memory/916-1-0x0000000000C10000-0x00000000016B5000-memory.dmp

Download