2026-08-08_8b176a64e3e69b426305ae8f6ec62654_amadey_elex_glassworm_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_8b176a64e3e69b426305ae8f6ec62654_amadey_elex_glassworm_luca-stealer_lynx_njrat
Size 1.1MB
Sample260808-dp8m6sbd69
SHA256 dbf3d16b8000841c82963456ca698a137d90064fb22c5553ffe2bd0ffdc954d5
MD5 8b176a64e3e69b426305ae8f6ec62654
SHA1 1e3bf947af02b0230e242b3bc57f455dd7b2955d
SHA512 6a741f944b9156c49aa766a33b7605807c6dcc69af1c8f59e00cb3ebe0ae99915c4587cfaa57fe85891ab73d9d4c80f5f40c3a554aa1874904a446d3fcf2a83c
SSDEEP 24576:rE0zmFniO/1dJ0YLajyeGD0+g9gGpOXbiFRyOsufqoPtjw/:4ympdv+cDrVBiIOZfU/
TLSH
T18835BF1371869031D5B000B75A2AEB717A3CA9250B61C4EBE3E489FD51F06D1BA3F76E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-08_8b176a64e3e69b426305ae8f6ec62654_amadey_elex_glassworm_luca-stealer_lynx_njrat

.exe 1.1MB

2026-08-08_8b176a64e3e69b426305ae8f6ec62654_amadey_elex_glassworm_luca-stealer_lynx_njrat

IMPHASH 6ab48a187aad5ffcc8bd06f0bbe7ca32
SHA256 dbf3d16b8000841c82963456ca698a137d90064fb22c5553ffe2bd0ffdc954d5
MD5 8b176a64e3e69b426305ae8f6ec62654
SHA1 1e3bf947af02b0230e242b3bc57f455dd7b2955d
SHA512 6a741f944b9156c49aa766a33b7605807c6dcc69af1c8f59e00cb3ebe0ae99915c4587cfaa57fe85891ab73d9d4c80f5f40c3a554aa1874904a446d3fcf2a83c
SSDEEP 24576:rE0zmFniO/1dJ0YLajyeGD0+g9gGpOXbiFRyOsufqoPtjw/:4ympdv+cDrVBiIOZfU/
TLSH
T18835BF1371869031D5B000B75A2AEB717A3CA9250B61C4EBE3E489FD51F06D1BA3F76E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

f5:db:9b:06:72:1b:81:a8:ba:11:14:0c:dd:db:5b:ab:51:82:47:fb:67:9e:38:72:3c:9e:6e:68:56:85:b7:25

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Chains

Jul 9, 2026

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Serial Number

24:bb:11:9c:e7:e7:1d:59:89:e0:c6:f6

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 21, 2025 - Oct 9, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

546000

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Webhost\10-07-2026\WindowsBuilds\UEMS_CONFIGURATIONS\13942762\uems_config\Native_Src\native\ONPR_Win32\dcconfigexec.pdb

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA CreateProcessAsUserW OpenProcessToken ImpersonateLoggedOnUser RevertToSelf LogonUserW RegEnumKeyExA RegEnumValueA RegQueryInfoKeyA RegSetValueExA CryptAcquireContextA CryptReleaseContext CryptGenKey CryptDestroyKey CryptGetUserKey CloseServiceHandle ControlService CreateProcessAsUserA GetTokenInformation LookupAccountSidA LookupPrivilegeValueA LookupPrivilegeNameA LogonUserA CryptGetHashParam RegSetValueExW RegQueryValueExW RegOpenKeyExW RegOpenKeyA RegEnumKeyA RegDeleteValueW RegDeleteValueA RegDeleteKeyA RegCreateKeyExA QueryServiceStatus CryptCreateHash CryptHashData CryptDestroyHash OpenServiceW OpenSCManagerW

mpr

WNetOpenEnumW WNetEnumResourceW WNetCancelConnection2W WNetAddConnection2W

crypt32

PFXImportCertStore CertGetNameStringA CertNameToStrW CertVerifyTimeValidity CertDeleteCertificateFromStore CertEnumCertificatesInStore CertVerifyCertificateChainPolicy PFXVerifyPassword CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertAddStoreToCollection CertAddCertificateContextToStore CertOpenStore CertCreateCertificateContext CryptStringToBinaryA CertCloseStore CertFindCertificateInStore CertFreeCertificateContext

shlwapi

StrStrIA StrTrimA PathFindExtensionA

wtsapi32

WTSQuerySessionInformationA WTSEnumerateSessionsA WTSFreeMemory

userenv

UnloadUserProfile DestroyEnvironmentBlock CreateEnvironmentBlock LoadUserProfileA

wsock32

WSAStartup inet_addr WSACleanup gethostbyname ioctlsocket WSAGetLastError

dcagentlibxml2

xmlCleanupParser xmlDocGetRootElement xmlFree xmlParseMemory xmlFreeDoc xmlNodeListGetString

netapi32

DsGetDcNameA NetApiBufferFree NetGetJoinInformation

iphlpapi

GetAdaptersInfo

winhttp

WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpSetCredentials WinHttpReceiveResponse WinHttpQueryHeaders WinHttpSetStatusCallback WinHttpQueryOption WinHttpCloseHandle WinHttpOpen WinHttpSetOption WinHttpCrackUrl WinHttpReadData WinHttpWriteData WinHttpQueryDataAvailable WinHttpConnect

msi

ord88 ord169 ord141

kernel32

OutputDebugStringW GetCPInfo CompareStringEx GetACP RaiseException RtlUnwind LCMapStringEx TlsAlloc LeaveCriticalSection EnterCriticalSection GetFileInformationByHandleEx MoveFileExW GetOEMCP TlsGetValue TlsSetValue IsValidCodePage TlsFree LoadLibraryExW SetEndOfFile SetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetFileAttributesExW SetFilePointerEx GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW FindFirstFileExW GetLocaleInfoEx LCMapStringW GetStringTypeW GetFileType GetConsoleMode ReadConsoleW GetModuleHandleExW InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter ExitProcess CompareStringW GetCommandLineA EncodePointer UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable GetStdHandle AcquireSRWLockExclusive ReleaseSRWLockExclusive GetModuleFileNameW QueryPerformanceCounter GetEnvironmentVariableA CreateFileA DeleteFileA FindClose FindFirstFileA GetFileSize ReadFile WriteFile DecodePointer CloseHandle GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection GetSystemTime FindResourceExW GetModuleFileNameA GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW SystemTimeToTzSpecificLocalTime SystemTimeToFileTime GetTimeZoneInformation MultiByteToWideChar WideCharToMultiByte GetVersionExW GetCommandLineW SetCurrentDirectoryW GetCurrentDirectoryW SetFilePointer WaitForSingleObject GetCurrentProcess TerminateProcess GetExitCodeProcess LoadLibraryW LocalFree GetCurrentThreadId GetLocalTime GlobalAlloc SetVolumeLabelW FindNextFileA RemoveDirectoryA ReleaseMutex CreateMutexA Sleep OpenProcess GetTickCount GetComputerNameExW GetVersionExA FreeLibrary GetModuleHandleA LoadLibraryA CreateToolhelp32Snapshot Process32First Process32Next SetCurrentDirectoryA GetCurrentDirectoryA GetCurrentProcessId CreateProcessA ProcessIdToSessionId GetSystemFirmwareTable CreateFileW FindFirstFileW FindNextFileW GetFileAttributesA CreateThread GetSystemInfo CopyFileA FlushFileBuffers ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeA lstrlenA GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount lstrcmpW GlobalFree FormatMessageA FormatMessageW CreateDirectoryA CreateDirectoryW DeleteFileW GetFileAttributesExA CopyFileW GetNativeSystemInfo GetFileSizeEx LoadLibraryExA SetLastError WriteConsoleW

user32

EnumDisplaySettingsW SystemParametersInfoW EnumDisplayDevicesW ChangeDisplaySettingsExW wsprintfW

ole32

CoSetProxyBlanket CoInitialize CoCreateInstance CoInitializeEx CoUninitialize CoInitializeSecurity

shell32

SHGetDesktopFolder SHGetSpecialFolderLocation CommandLineToArgvW SHCreateDirectoryExW SHCreateDirectoryExA

oleaut32

VariantInit VariantClear SafeArrayGetLBound SafeArrayGetUBound SysAllocStringByteLen SysStringLen SysFreeString SysAllocString SafeArrayAccessData

ws2_32

getnameinfo inet_pton

odbc32

ord39 ord20 ord49 ord19 ord48 ord72 ord18 ord36 ord43 ord16 ord31 ord41 ord12 ord11 ord29 ord9 ord8 ord26 ord4 ord3 ord2 ord1 ord13

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_8b176a64e3e69b426305ae8f6ec62654_amadey_elex_glassworm_luca-stealer_lynx_njrat

advapi32

mpr

crypt32

shlwapi

wtsapi32

userenv

wsock32

dcagentlibxml2

netapi32

iphlpapi

winhttp

msi

kernel32

user32

ole32

shell32

oleaut32

ws2_32

odbc32

generic