2026-08-08_b45d73c2850527875faa31327246ac21_amadey_elex_glassworm_luca-stealer_lynx_metamorfo_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_b45d73c2850527875faa31327246ac21_amadey_elex_glassworm_luca-stealer_lynx_metamorfo_njrat
Size 1.2MB
Sample260808-ddn5dsbc94
SHA256 ea196b87299981009af5b91311e4a23f4e900454226bf76105b4352f13dc47ac
MD5 b45d73c2850527875faa31327246ac21
SHA1 64e523b07e9d74c02d6ad3d502990ace089bd8dc
SHA512 54ebf2605ca15f6727b0da14a977834a6332b855737f0c15c8c649c0c9806eb19ccc77fb558e480bd08efd81c94cb9ed29447e90e1e617a1390bd24e33efa34a
SSDEEP 24576:RbtyXQ1r2sMJHGiku3ZmAnVpDabpduiLyHPtnERP8y:TyXWrM13ZVVuLyu8y
TLSH
T17B45BF12798B8030D3A020F15B69FB71A77C99BC1764C4F7A3D4997C52A05C2AAFE71E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-08_b45d73c2850527875faa31327246ac21_amadey_elex_glassworm_luca-stealer_lynx_metamorfo_njrat

.exe 1.2MB

2026-08-08_b45d73c2850527875faa31327246ac21_amadey_elex_glassworm_luca-stealer_lynx_metamorfo_njrat

IMPHASH 2875fbce855597d3e2ce85fe4b2fe827
SHA256 ea196b87299981009af5b91311e4a23f4e900454226bf76105b4352f13dc47ac
MD5 b45d73c2850527875faa31327246ac21
SHA1 64e523b07e9d74c02d6ad3d502990ace089bd8dc
SHA512 54ebf2605ca15f6727b0da14a977834a6332b855737f0c15c8c649c0c9806eb19ccc77fb558e480bd08efd81c94cb9ed29447e90e1e617a1390bd24e33efa34a
SSDEEP 24576:RbtyXQ1r2sMJHGiku3ZmAnVpDabpduiLyHPtnERP8y:TyXWrM13ZVVuLyu8y
TLSH
T17B45BF12798B8030D3A020F15B69FB71A77C99BC1764C4F7A3D4997C52A05C2AAFE71E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

eb:5e:33:55:3f:80:c1:68:59:74:22:0a:d8:a8:d3:d8:c1:1c:8e:24:8d:2c:c3:79:e2:5b:4f:bd:db:24:9c:1b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Chains

Jul 9, 2026

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Serial Number

44:85:59:e8:d5:9f:e0:56:29:9e:6e:8f

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 11, 2023 - Oct 9, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

668576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Webhost\10-07-2026\WindowsBuilds\INVENTORY_MGMT\13942668\inv_mgmt\Native_Src\native\ONPR_Win32\dcappcontrol.pdb

advapi32

RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegDeleteTreeW CloseServiceHandle ControlService OpenSCManagerW OpenServiceW QueryServiceStatusEx RegCloseKey ImpersonateLoggedOnUser RevertToSelf RegEnumKeyExA RegEnumValueA RegOpenKeyExA RegQueryInfoKeyA RegQueryValueExA RegSetValueExA StartServiceW CryptGetHashParam CryptAcquireContextA CryptReleaseContext CryptDestroyKey CryptCreateHash CryptHashData CryptDestroyHash CryptGenKey CryptGetUserKey DeregisterEventSource RegisterEventSourceA ReportEventA RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegOpenKeyA QueryServiceStatus LogonUserA LookupPrivilegeNameA LookupPrivilegeValueA LookupAccountSidA GetTokenInformation CreateProcessAsUserA CreateProcessAsUserW OpenProcessToken

userenv

UnloadUserProfile LoadUserProfileA CreateEnvironmentBlock DestroyEnvironmentBlock RefreshPolicyEx

netapi32

NetGetJoinInformation DsGetDcNameW NetApiBufferFree DsGetDcNameA

wsock32

WSAStartup WSACleanup WSAGetLastError

shlwapi

StrStrIA PathFindExtensionA StrTrimA

wtsapi32

WTSFreeMemory WTSEnumerateSessionsA WTSQuerySessionInformationA

iphlpapi

GetAdaptersInfo

winhttp

WinHttpSetStatusCallback WinHttpOpen WinHttpQueryDataAvailable WinHttpQueryOption WinHttpSetOption WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpReadData WinHttpCloseHandle WinHttpSendRequest WinHttpCrackUrl WinHttpSetCredentials WinHttpReceiveResponse WinHttpConnect WinHttpWriteData WinHttpQueryHeaders

dcagentlibxml2

xmlFree xmlParseMemory xmlCleanupParser xmlNodeListGetString xmlTextReaderRead xmlFreeDoc xmlTextReaderAttributeCount xmlTextReaderDepth xmlTextReaderName xmlTextReaderValue xmlTextReaderGetAttribute xmlStrcmp xmlNewTextReaderFilename xmlDocGetRootElement xmlFreeTextReader

crypt32

PFXVerifyPassword PFXImportCertStore CertGetNameStringA CertNameToStrW CertVerifyTimeValidity CertDeleteCertificateFromStore CertEnumCertificatesInStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertAddStoreToCollection CertAddCertificateContextToStore CertOpenStore CryptStringToBinaryA CertCreateCertificateContext CertFreeCertificateContext CertFindCertificateInStore CertCloseStore

activeds

ord3 ord9 ord13

rpcrt4

UuidToStringW RpcStringFreeW

kernel32

GetCommandLineW IsDebuggerPresent OutputDebugStringW RaiseException ReleaseSRWLockExclusive CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale AcquireSRWLockExclusive EnumSystemLocalesW GetConsoleOutputCP GetCPInfo CompareStringEx GetCommandLineA LCMapStringEx ExitProcess LeaveCriticalSection EnterCriticalSection SetFilePointerEx SetStdHandle SetEndOfFile WakeAllConditionVariable IsValidCodePage GetACP UnhandledExceptionFilter GetFileInformationByHandleEx SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlUnwind GetModuleHandleExW MoveFileExW TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer GetFileType GetConsoleMode ReadConsoleW GetUserDefaultLCID FindFirstFileExW GetLocaleInfoEx GetStringTypeW GetModuleFileNameW GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SleepConditionVariableSRW QueryPerformanceCounter LoadLibraryExA DecodePointer GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount DeleteCriticalSection FindResourceExW LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar CreateFileW ReadFile CloseHandle GetCurrentProcess FreeLibrary GetProcAddress LoadLibraryW LocalFree FormatMessageW InitializeCriticalSectionEx IsWow64Process GetFileAttributesW GetFileSize GetWindowsDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile GetStdHandle WriteFile Sleep FormatMessageA GetModuleHandleW GetFileAttributesExW WideCharToMultiByte GetCurrentThreadId GetLocalTime GetEnvironmentVariableA SetCurrentDirectoryA GetCurrentDirectoryA CreateFileA DeleteFileA FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW GetFileAttributesA WaitForSingleObject TerminateProcess GetExitCodeProcess CreateThread CreateProcessA OpenProcess GetSystemInfo GetSystemTime GetVersionExA GetModuleHandleA LoadLibraryA CopyFileA SystemTimeToTzSpecificLocalTime GetTimeZoneInformation RemoveDirectoryA ReleaseMutex CreateMutexA GetTickCount GetComputerNameExW SetDllDirectoryA SystemTimeToFileTime CreateToolhelp32Snapshot Process32First Process32Next CreateDirectoryA GetFileSizeEx CreateTimerQueue CreateTimerQueueTimer DeleteTimerQueue GlobalAlloc GlobalFree CreateDirectoryW DeleteFileW FlushFileBuffers GetFileAttributesExA GetCurrentProcessId CopyFileW lstrlenA SetCurrentDirectoryW SetFilePointer ProcessIdToSessionId GetSystemFirmwareTable ConnectNamedPipe DisconnectNamedPipe lstrcmpW CreateNamedPipeA GetSystemTimeAsFileTime SetLastError GetModuleFileNameA GetNativeSystemInfo WriteConsoleW

user32

wsprintfW

shell32

SHCreateDirectoryExA SHCreateDirectoryExW

ole32

StringFromGUID2 CoCreateGuid CoUninitialize CoInitializeEx CoCreateInstance CoInitializeSecurity CoSetProxyBlanket

oleaut32

SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData SysAllocStringByteLen SysAllocString VariantClear VariantInit SysFreeString SysStringLen

odbc32

ord11 ord9 ord29 ord12 ord13 ord8 ord72 ord41 ord39 ord20 ord49 ord19 ord48 ord18 ord36 ord43 ord16 ord26 ord4 ord3 ord2 ord1 ord31

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_b45d73c2850527875faa31327246ac21_amadey_elex_glassworm_luca-stealer_lynx_metamorfo_njrat

advapi32

userenv

netapi32

wsock32

shlwapi

wtsapi32

iphlpapi

winhttp

dcagentlibxml2

crypt32

activeds

rpcrt4

kernel32

user32

shell32

ole32

oleaut32

odbc32

generic