2026-08-08_582f77b52e7f9df075e47b14d5b5804e_amadey_elex_glassworm_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_582f77b52e7f9df075e47b14d5b5804e_amadey_elex_glassworm_luca-stealer_lynx_njrat
Size 1.1MB
Sample260808-d4fwpsswbx
SHA256 01cc59b80f7a29d3a4ac5d025a3665c396063675697a93c491015a866c4188ce
MD5 582f77b52e7f9df075e47b14d5b5804e
SHA1 3394b2e8bbd27a826d3f47611b86281543966ede
SHA512 2d8ba15ae7040ae25e679e6e642a6b1afff7fbef140b32661de5716c836a9f43d5d3672750770ee699cbd577f5b20e867e23539935e446670051f8fccf2962f0
SSDEEP 24576:Q4wec8h6mgQ6igQ3vS9nsCtfcGbNdyOQ1GPBum5VrH:zwQ6igf7BQNcrH
TLSH
T10045AE22B552C031D67000F15AA8EB757B7CAA790B6184FBB3C08D7DA5A02D1A73E75E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-08_582f77b52e7f9df075e47b14d5b5804e_amadey_elex_glassworm_luca-stealer_lynx_njrat

.exe 1.1MB

2026-08-08_582f77b52e7f9df075e47b14d5b5804e_amadey_elex_glassworm_luca-stealer_lynx_njrat

IMPHASH 6368a59bbeda1703d89fa74789037537
SHA256 01cc59b80f7a29d3a4ac5d025a3665c396063675697a93c491015a866c4188ce
MD5 582f77b52e7f9df075e47b14d5b5804e
SHA1 3394b2e8bbd27a826d3f47611b86281543966ede
SHA512 2d8ba15ae7040ae25e679e6e642a6b1afff7fbef140b32661de5716c836a9f43d5d3672750770ee699cbd577f5b20e867e23539935e446670051f8fccf2962f0
SSDEEP 24576:Q4wec8h6mgQ6igQ3vS9nsCtfcGbNdyOQ1GPBum5VrH:zwQ6igf7BQNcrH
TLSH
T10045AE22B552C031D67000F15AA8EB757B7CAA790B6184FBB3C08D7DA5A02D1A73E75E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

d1:85:d8:53:b5:40:de:66:ca:fa:06:0b:d8:f1:0c:0b:6b:ee:6c:c4:ce:b6:a0:7b:29:2d:ac:b3:19:a4:bd:59

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Chains

Jul 9, 2026

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Serial Number

24:bb:11:9c:e7:e7:1d:59:89:e0:c6:f6

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 21, 2025 - Oct 9, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

627952

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Webhost\10-07-2026\WindowsBuilds\UEMS_AGENT_FRAMEWORK\13942691\uems_agent_fw\Native_Src\native\ONPR_x86\UEMSMdmEnroll.pdb

advapi32

ImpersonateLoggedOnUser RevertToSelf RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyExA RegEnumValueA RegOpenKeyExA RegQueryInfoKeyA RegQueryValueExA RegSetValueExA QueryServiceStatus OpenServiceW OpenSCManagerW RegOpenKeyA RegEnumKeyA LogonUserA LookupPrivilegeNameA LookupPrivilegeValueA LookupAccountSidW LookupAccountSidA CryptAcquireContextA CryptReleaseContext CryptGenKey CryptDestroyKey CryptGetUserKey CloseServiceHandle ControlService GetTokenInformation CreateProcessAsUserA OpenProcessToken CreateProcessAsUserW CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash

wtsapi32

WTSEnumerateSessionsA WTSQuerySessionInformationA WTSQuerySessionInformationW WTSEnumerateSessionsW WTSFreeMemory

netapi32

NetGetJoinInformation DsGetDcNameA NetApiBufferFree

secur32

GetUserNameExA

shlwapi

StrStrIA StrTrimA PathFindExtensionA

winhttp

WinHttpCrackUrl WinHttpSetStatusCallback WinHttpOpenRequest WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSetCredentials WinHttpSendRequest WinHttpAddRequestHeaders WinHttpQueryDataAvailable WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpWriteData WinHttpSetOption WinHttpQueryOption

iphlpapi

GetAdaptersInfo

wsock32

WSAGetLastError WSACleanup WSAStartup

userenv

CreateEnvironmentBlock UnloadUserProfile LoadUserProfileA LoadUserProfileW DestroyEnvironmentBlock

crypt32

PFXVerifyPassword PFXImportCertStore CertGetNameStringA CertNameToStrW CertVerifyTimeValidity CertDeleteCertificateFromStore CertEnumCertificatesInStore CertFindCertificateInStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertAddStoreToCollection CertAddCertificateContextToStore CertCloseStore CertOpenStore CryptStringToBinaryA CertCreateCertificateContext CertFreeCertificateContext

dcagentlibxml2

xmlFreeDoc xmlDocGetRootElement xmlCleanupParser xmlNodeListGetString xmlParseMemory xmlFree

kernel32

GetStartupInfoW InitializeSListHead ExitProcess IsDebuggerPresent SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCommandLineW UnhandledExceptionFilter GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP GetCPInfo CompareStringEx LCMapStringEx RaiseException EncodePointer LeaveCriticalSection EnterCriticalSection SetFilePointerEx SetStdHandle SetEndOfFile IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW GetCommandLineA ReadConsoleW GetConsoleMode RtlUnwind SetUnhandledExceptionFilter GetFileInformationByHandleEx MoveFileExW OutputDebugStringW TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW AreFileApisANSI GetFileAttributesExW DecodePointer GetLastError HeapDestroy HeapAlloc GetFileType HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection CloseHandle GetCurrentProcess GetModuleHandleW GetProcAddress DeleteFileW MultiByteToWideChar WideCharToMultiByte GetCurrentThreadId GetLocalTime GetEnvironmentVariableA CreateDirectoryA CreateDirectoryW CreateFileA CreateFileW DeleteFileA FindClose FindFirstFileA FindFirstFileW FindNextFileA FlushFileBuffers GetFileAttributesA GetFileAttributesExA GetFileSize ReadFile WriteFile Sleep GetCurrentProcessId GetTickCount FindResourceExW FreeLibrary GetModuleHandleA LoadResource LockResource SizeofResource FindResourceW LoadLibraryA CopyFileW SystemTimeToTzSpecificLocalTime RemoveDirectoryA ReleaseMutex WaitForSingleObject CreateMutexA TerminateProcess GetExitCodeProcess OpenProcess GetComputerNameExW GetVersionExA SystemTimeToFileTime CreateToolhelp32Snapshot Process32First Process32Next GetFileSizeEx InitializeCriticalSectionAndSpinCount CreateTimerQueue CreateTimerQueueTimer DeleteTimerQueue CopyFileA SetCurrentDirectoryA GetCurrentDirectoryA FindNextFileW GetFileAttributesW CreateThread CreateProcessA GetSystemInfo GetSystemTime LoadLibraryW GetTimeZoneInformation GlobalAlloc GlobalFree LocalFree FormatMessageA FormatMessageW GetSystemTimeAsFileTime SetCurrentDirectoryW SetFilePointer ProcessIdToSessionId GetSystemFirmwareTable lstrlenA GetModuleFileNameA GetNativeSystemInfo ConnectNamedPipe DisconnectNamedPipe lstrcmpW CreateNamedPipeA LoadLibraryExA GetCurrentDirectoryW SetLastError CreateProcessW QueryPerformanceCounter GetModuleFileNameW WTSGetActiveConsoleSessionId Process32FirstW Process32NextW FindFirstFileExW GetLocaleInfoEx GetStringTypeW FreeEnvironmentStringsW SetEnvironmentVariableW HeapReAlloc WriteConsoleW

user32

wsprintfW

shell32

SHCreateDirectoryExW CommandLineToArgvW SHCreateDirectoryExA

ole32

CoInitializeSecurity CoInitializeEx CoUninitialize CoCreateInstance CoSetProxyBlanket

oleaut32

SysAllocString VariantInit VariantClear SafeArrayAccessData SafeArrayGetLBound SafeArrayGetUBound SysAllocStringByteLen SysStringLen SysFreeString

odbc32

ord41 ord39 ord20 ord49 ord19 ord9 ord72 ord48 ord18 ord36 ord43 ord16 ord31 ord13 ord12 ord11 ord29 ord4 ord8 ord26 ord3 ord2 ord1

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_582f77b52e7f9df075e47b14d5b5804e_amadey_elex_glassworm_luca-stealer_lynx_njrat

advapi32

wtsapi32

netapi32

secur32

shlwapi

winhttp

iphlpapi

wsock32

userenv

crypt32

dcagentlibxml2

kernel32

user32

shell32

ole32

oleaut32

odbc32

generic