2026-08-07_e8444a6034c812fbe327bf067e64a8e9_elex_glassworm_luca-stealer_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_e8444a6034c812fbe327bf067e64a8e9_elex_glassworm_luca-stealer_medusalocker_njrat
Size 795KB
Sample260808-atdrtayzcv
SHA256 978c2bc77c0e351b5789c0b22524c15f1d1793df94ae73ffc314c781ef95795a
MD5 e8444a6034c812fbe327bf067e64a8e9
SHA1 f55713b8c7b8c155a1e3774bab9bef3d22d0a07d
SHA512 413e99bd1dc914ebe6b91a397448ce18f4ac10a6c3a11b287a6aab7b578541769b4fca61853dd289a85d47744009ff86f79ade6acfa8fdd3ed922d1c1610f976
SSDEEP 24576:6zOq8snLQXAJ5JZ7fVzHofudPVcUT9WTTG3StztZqsTq/Ze7PU:6zOq8aLQXAJ5JZ7fVzHofudPVcU2TGwi
TLSH
T143059E223A85C033D67312318D2DE26B15BDB9700E294A8BB7DC5B1E6F705C3F6256A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_e8444a6034c812fbe327bf067e64a8e9_elex_glassworm_luca-stealer_medusalocker_njrat

File Explorer

2026-08-07_e8444a6034c812fbe327bf067e64a8e9_elex_glassworm_luca-stealer_medusalocker_njrat

.exe 795KB

2026-08-07_e8444a6034c812fbe327bf067e64a8e9_elex_glassworm_luca-stealer_medusalocker_njrat

IMPHASH c0e93f7e25fb185b56304b04335cf0f3
SHA256 978c2bc77c0e351b5789c0b22524c15f1d1793df94ae73ffc314c781ef95795a
MD5 e8444a6034c812fbe327bf067e64a8e9
SHA1 f55713b8c7b8c155a1e3774bab9bef3d22d0a07d
SHA512 413e99bd1dc914ebe6b91a397448ce18f4ac10a6c3a11b287a6aab7b578541769b4fca61853dd289a85d47744009ff86f79ade6acfa8fdd3ed922d1c1610f976
SSDEEP 24576:6zOq8snLQXAJ5JZ7fVzHofudPVcUT9WTTG3StztZqsTq/Ze7PU:6zOq8aLQXAJ5JZ7fVzHofudPVcU2TGwi
TLSH
T143059E223A85C033D67312318D2DE26B15BDB9700E294A8BB7DC5B1E6F705C3F6256A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

319034

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

ioctlsocket getsockopt htons inet_addr select socket connect WSACleanup WSAStartup closesocket

shlwapi

PathFileExistsW

psapi

GetProcessImageFileNameW

wininet

HttpQueryInfoW InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile HttpOpenRequestA HttpSendRequestA InternetCrackUrlA

kernel32

CreateMutexA OpenMutexA GetLastError WriteFile ReadFile CreateFileA CreateFileW GetFileTime SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime FindClose FileTimeToLocalFileTime FileTimeToDosDateTime FindFirstFileA GetCurrentThreadId GetPrivateProfileStringW DeleteFileW GetSystemTimeAsFileTime CreateEventA WaitForSingleObjectEx SetEvent GetSystemDirectoryW GetWindowsDirectoryW CopyFileW DecodePointer LockResource HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap GetCurrentProcess RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection ResetEvent Sleep LoadResource SizeofResource FindResourceW FindResourceExW GetTempPathW GetModuleFileNameW LocalFree CreateMutexW GetCommandLineW FlushFileBuffers ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetTempPathA GetTempFileNameA GetShortPathNameW CloseHandle lstrcmpW CreateDirectoryW RemoveDirectoryW SetFileAttributesW FindFirstFileW FindNextFileW MoveFileExW FreeLibrary GetProcAddress DeviceIoControl GetNativeSystemInfo GetLogicalDriveStringsW LoadLibraryW GetModuleHandleW GetDriveTypeW QueryDosDeviceW GetFileAttributesExW GetVersionExW OpenProcess GetCurrentProcessId TerminateProcess GetModuleHandleA CreateProcessW CreateToolhelp32Snapshot Process32FirstW Process32NextW QueryPerformanceCounter GetTickCount GetModuleHandleExW ExitProcess RtlUnwind WaitForSingleObject ReleaseMutex SetEnvironmentVariableA GetFileType ExitThread GetStdHandle GetACP GetConsoleMode ReadConsoleW GetConsoleCP GetDateFormatW GetTimeFormatW IsValidLocale EnumSystemLocalesW SetStdHandle GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore DuplicateHandle VirtualProtect VirtualFree VirtualAlloc LoadLibraryExW WriteConsoleW FreeLibraryAndExitThread GetThreadTimes GetCurrentThread UnregisterWait EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection GetStringTypeW QueryPerformanceFrequency SetLastError CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo GetCurrentDirectoryW GetFileAttributesW GetFullPathNameW SetEndOfFile SetFilePointerEx AreFileApisANSI FormatMessageA UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW OutputDebugStringW GetUserDefaultLCID SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject

user32

wsprintfW

advapi32

ControlService SystemFunction036 SetSecurityDescriptorDacl CryptReleaseContext CryptGenRandom CryptAcquireContextW LookupPrivilegeValueW AdjustTokenPrivileges StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW StartServiceW QueryServiceStatusEx OpenServiceW OpenSCManagerW DeleteService CreateServiceW CloseServiceHandle LookupAccountSidW GetTokenInformation OpenProcessToken InitializeSecurityDescriptor

shell32

SHFileOperationW ShellExecuteExW CommandLineToArgvW SHGetSpecialFolderPathW

ole32

CoCreateInstance CoUninitialize CoInitialize

Name

.text

Size

585KB

Virtual Size

585KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_e8444a6034c812fbe327bf067e64a8e9_elex_glassworm_luca-stealer_medusalocker_njrat

ws2_32

shlwapi

psapi

wininet

kernel32

user32

advapi32

shell32

ole32

generic