2026-08-06_2ca6e6ade28be4bc8a05de1f089c3bd2_amadey_elex_glassworm_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-06_2ca6e6ade28be4bc8a05de1f089c3bd2_amadey_elex_glassworm_luca-stealer_lynx_njrat
Size 2.9MB
Sample260806-httf9swanc
SHA256 51a8629a3250d32d5df02e7e9ab9aa2de4c42745dc424e4663fc1cae44f3dfa2
MD5 2ca6e6ade28be4bc8a05de1f089c3bd2
SHA1 aa4a0116d5eadc80df6cfb9286f3612cb815a2b7
SHA512 5607d8c186f0b7773dd3ad01ccfc2268c30b4ae96f407864bee838cc42759be260fe304c25d678af2ffa493a8b41ee1cd277500ba4fc17f52955154fee35c7ab
SSDEEP 49152:7a29ynEtqWUMszrOWiDa1QAqrSdVceTFbOGnLquGuQcDkQJA785MP0he7FJHw:umyEx4YSfqQJA785Mshe7FK
TLSH
T148E5B02275438035D3A100F2563DBF76A66C99341B7144E363D85FBE96B05C22B3EBAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-06_2ca6e6ade28be4bc8a05de1f089c3bd2_amadey_elex_glassworm_luca-stealer_lynx_njrat

.exe 2.9MB

2026-08-06_2ca6e6ade28be4bc8a05de1f089c3bd2_amadey_elex_glassworm_luca-stealer_lynx_njrat

IMPHASH 8815df09fbf7e2a4e70ff92b626b8e27
SHA256 51a8629a3250d32d5df02e7e9ab9aa2de4c42745dc424e4663fc1cae44f3dfa2
MD5 2ca6e6ade28be4bc8a05de1f089c3bd2
SHA1 aa4a0116d5eadc80df6cfb9286f3612cb815a2b7
SHA512 5607d8c186f0b7773dd3ad01ccfc2268c30b4ae96f407864bee838cc42759be260fe304c25d678af2ffa493a8b41ee1cd277500ba4fc17f52955154fee35c7ab
SSDEEP 49152:7a29ynEtqWUMszrOWiDa1QAqrSdVceTFbOGnLquGuQcDkQJA785MP0he7FJHw:umyEx4YSfqQJA785Mshe7FK
TLSH
T148E5B02275438035D3A100F2563DBF76A66C99341B7144E363D85FBE96B05C22B3EBAE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

6a:65:25:1c:71:1a:20:e0:32:ea:65:00:e8:6a:ea:8a:65:38:ed:64:20:20:65:24:19:84:d0:e5:e8:9b:7b:90

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Chains

Jul 5, 2026

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Serial Number

32:7a:0e:dc:4e:6f:47:da:bd:74:9f:6e

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 9, 2023 - Oct 9, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1740416

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Webhost\05-07-2026\WindowsBuilds\UEMS_AGENT_FRAMEWORK\13891550\uems_agent_fw\Native_Src\native\ONPR_x86\dcuploadlogs.pdb

winhttp

WinHttpCloseHandle WinHttpSendRequest WinHttpCrackUrl WinHttpReadData WinHttpSetOption WinHttpWriteData WinHttpQueryDataAvailable WinHttpQueryOption WinHttpReceiveResponse WinHttpConnect WinHttpOpenRequest WinHttpOpen WinHttpAddRequestHeaders WinHttpSetCredentials WinHttpSetStatusCallback WinHttpQueryHeaders

shlwapi

StrStrIA SHDeleteKeyA SHDeleteKeyW StrTrimW StrTrimA PathFindExtensionA StrStrA PathIsDirectoryA PathRenameExtensionA PathFileExistsW

wsock32

WSAGetLastError WSAStartup closesocket htons socket WSACleanup inet_addr ioctlsocket bind gethostbyname

wtsapi32

WTSQuerySessionInformationW WTSEnumerateSessionsA WTSQuerySessionInformationA WTSEnumerateSessionsW WTSFreeMemory

userenv

LoadUserProfileA CreateEnvironmentBlock UnloadUserProfile DestroyEnvironmentBlock

psapi

GetModuleFileNameExA

iphlpapi

GetIfTable2 GetIfEntry2 GetAdaptersInfo FreeMibTable SendARP

secur32

GetUserNameExA GetUserNameExW

netapi32

NetWkstaGetInfo DsGetDcNameW NetApiBufferFree NetServerGetInfo DsGetDcNameA NetGetJoinInformation NetWkstaUserGetInfo

dcagentlibxml2

xmlTextReaderRead xmlTextReaderGetAttribute xmlTextReaderValue xmlFreeDoc xmlDocGetRootElement xmlCleanupParser xmlParseFile xmlNewParserCtxt xmlFreeParserCtxt xmlCtxtUseOptions xmlFreeTextReader xmlNewTextReaderFilename xmlStrcmp xmlTextReaderDepth xmlTextReaderName xmlNodeListGetString xmlParseMemory xmlFree xmlTextReaderAttributeCount

crypt32

CertGetNameStringA CertNameToStrW CertVerifyTimeValidity CertDeleteCertificateFromStore CertCreateCertificateContext CertFreeCertificateContext CryptStringToBinaryA CryptMsgClose CryptMsgGetParam CertCloseStore CertFindCertificateInStore CryptQueryObject CertEnumCertificatesInStore CertGetNameStringW CryptVerifyDetachedMessageSignature CryptVerifyMessageSignature CertOpenStore CertAddCertificateContextToStore CertAddStoreToCollection CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CryptGetMessageCertificates CryptMsgUpdate CryptMsgOpenToDecode CryptDecodeObject CryptEncodeObjectEx PFXVerifyPassword PFXImportCertStore

mpr

WNetCancelConnection2W WNetAddConnection2W WNetCancelConnection2A

wintrust

WinVerifyTrust

imagehlp

ImageGetCertificateData ImageGetCertificateHeader

kernel32

GetFullPathNameW SetFileAttributesW SetFileInformationByHandle GetFinalPathNameByHandleW SetFileTime GetTempPathW AreFileApisANSI DeviceIoControl CreateDirectoryExW GetFileAttributesExW GetDiskFreeSpaceExW MoveFileExW CreateHardLinkW FindFirstFileExW GetLocaleInfoEx GetStringTypeW ReadFile SizeofResource CreateNamedPipeA HeapFree GetCurrentProcess WriteFile InitializeCriticalSectionEx WaitForSingleObject DisconnectNamedPipe OpenProcess HeapSize ProcessIdToSessionId Sleep CopyFileA GetLastError LockResource DeleteFileA HeapReAlloc CloseHandle CreateThread FindResourceExW LoadResource FindResourceW HeapAlloc DecodePointer HeapDestroy DeleteCriticalSection GetCurrentProcessId GetProcessHeap WideCharToMultiByte CreateDirectoryA FindFirstFileA FindNextFileA FindClose SetCurrentDirectoryA CreateToolhelp32Snapshot MultiByteToWideChar GetFileInformationByHandleEx Process32Next SystemTimeToTzSpecificLocalTime CreateProcessA GetCurrentThreadId GetLocalTime ReleaseMutex CreateMutexA SuspendThread ResumeThread GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GetTimeZoneInformation CreateFileA GetFileSize RemoveDirectoryA SetEvent OpenEventW TerminateProcess GetExitCodeProcess GetTickCount GetComputerNameExW GetVersionExA CreateSymbolicLinkW GetModuleHandleA GetProcAddress LoadLibraryA SetDllDirectoryA Process32First ExpandEnvironmentStringsA SetCurrentDirectoryW GetCurrentDirectoryA GetCurrentDirectoryW DeleteFileW FileTimeToLocalFileTime FindFirstFileW FindNextFileW GetFileAttributesA GetFileAttributesW GetFileAttributesExA GetFileInformationByHandle SetFilePointer SetLastError ConnectNamedPipe GetProcessTimes CreateProcessW GetSystemDirectoryA GetSystemDirectoryW Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetModuleFileNameA LoadLibraryW lstrlenA GetEnvironmentVariableA GetEnvironmentVariableW CreateFileW SetPriorityClass GetPriorityClass GetSystemInfo QueryDosDeviceA MoveFileA GetLocaleInfoA K32GetProcessMemoryInfo GlobalAlloc GlobalFree LocalFree FormatMessageA FormatMessageW GetSystemFirmwareTable GetFileSizeEx InitializeCriticalSectionAndSpinCount CreateTimerQueue CreateTimerQueueTimer DeleteTimerQueue LoadLibraryExW SetDllDirectoryW CreateDirectoryW FlushFileBuffers CopyFileW lstrcmpW GetNativeSystemInfo CompareFileTime LoadLibraryExA QueryPerformanceCounter QueryPerformanceFrequency LocalAlloc GetModuleHandleW GetVersion SetEnvironmentVariableW GetFullPathNameA GetModuleFileNameW EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx CompareStringEx FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer GetCPInfo InitOnceExecuteOnce CreateEventExW WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait IsDebuggerPresent OutputDebugStringW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetTickCount64 TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetDriveTypeW GetFileType PeekNamedPipe ExitThread FreeLibraryAndExitThread GetConsoleMode ReadConsoleW FreeLibrary GetStdHandle WriteConsoleW DuplicateHandle GetCommandLineA GetCommandLineW SetFilePointerEx GetCurrentThread GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP SetStdHandle SetEndOfFile SetConsoleCtrlHandler CreatePipe IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW FileTimeToSystemTime lstrcmpiA

user32

wsprintfW GetLastInputInfo MessageBoxW UnregisterClassW UnregisterClassA wsprintfA MessageBoxA

advapi32

FreeSid QueryServiceConfigW CreateServiceA ChangeServiceConfig2A ChangeServiceConfigW QueryServiceStatus OpenServiceW OpenSCManagerW CryptGetHashParam RegEnumValueW LookupPrivilegeNameA LookupAccountSidW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegOpenKeyA RegEnumKeyA RegDeleteValueW RegDeleteValueA RegCreateKeyExW RegCreateKeyExA DeleteService CryptDestroyHash CryptHashData CryptCreateHash CryptEncrypt CryptDeriveKey RegEnumKeyW RegOpenCurrentUser AbortSystemShutdownA InitiateSystemShutdownW RegQueryValueExA RegDeleteKeyA LogonUserA LookupPrivilegeValueA LookupAccountNameA RevertToSelf ImpersonateLoggedOnUser GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority AdjustTokenPrivileges CreateProcessAsUserA CreateProcessAsUserW StartServiceA QueryServiceStatusEx OpenServiceA OpenSCManagerA ControlService CloseServiceHandle CryptGetUserKey CryptDestroyKey CryptGenKey CryptReleaseContext CryptAcquireContextA RegSetValueExA RegQueryInfoKeyA RegEnumValueA RegOpenKeyExA RegEnumKeyExA RegCloseKey ConvertSidToStringSidA IsValidSid LookupAccountSidA OpenProcessToken GetTokenInformation GetLengthSid LookupAccountNameW ConvertSidToStringSidW RegDeleteKeyExW RegEnumKeyExW RegQueryInfoKeyW RegRenameKey RegCopyTreeW StartServiceW

shell32

SHGetFolderPathA ShellExecuteExW ShellExecuteA SHCreateDirectoryExA SHCreateDirectoryExW SHGetSpecialFolderPathA ShellExecuteExA SHFileOperationA

ole32

CoCreateGuid StringFromGUID2 OleRun CoInitialize CoSetProxyBlanket CoCreateInstance CoInitializeSecurity CoInitializeEx CoUninitialize

oleaut32

VariantTimeToSystemTime VariantInit VariantChangeType GetErrorInfo SetErrorInfo CreateErrorInfo SysAllocString VariantClear SafeArrayAccessData SafeArrayGetLBound SafeArrayGetUBound SysAllocStringByteLen SysStringLen SysFreeString SystemTimeToVariantTime

odbc32

ord72 ord41 ord39 ord20 ord49 ord19 ord48 ord18 ord36 ord43 ord16 ord31 ord13 ord12 ord11 ord29 ord9 ord8 ord26 ord4 ord3 ord2 ord1

gdiplus

GdipLoadImageFromFile GdiplusShutdown GdiplusStartup GdipFree GdipLoadImageFromFileICM GdipDisposeImage GdipSaveImageToFile GdipGetImageEncodersSize GdipGetImageEncoders GdipAlloc GdipCloneImage

ws2_32

getnameinfo inet_pton

msi

ord224

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_2ca6e6ade28be4bc8a05de1f089c3bd2_amadey_elex_glassworm_luca-stealer_lynx_njrat

winhttp

shlwapi

wsock32

wtsapi32

userenv

psapi

iphlpapi

secur32

netapi32

dcagentlibxml2

crypt32

mpr

wintrust

imagehlp

kernel32

user32

advapi32

shell32

ole32

oleaut32

odbc32

gdiplus

ws2_32

msi

generic