2026-08-08_b2aa2eaab54876495adcd5421f0e6b78_amadey_cobalt-strike_elex_glassworm_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_b2aa2eaab54876495adcd5421f0e6b78_amadey_cobalt-strike_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 673KB
Sample260808-lsgymathng
SHA256 b8f10885a1d2bc512fc66a301a4b81e9b6f4d823e62a23b8138dc30a9c915d52
MD5 b2aa2eaab54876495adcd5421f0e6b78
SHA1 d4a0da39ab5862537f1f998c45730af02da083a1
SHA512 532ecca27ebbc2070687b4d548c1994a9dbbc1a07e66dc74302ae6fa2ef0993b15af3adcbebcc0157bb383f03b92ffba5072325c86666bf49dfd0bb9334e67d3
SSDEEP 12288:5XjengCavMb6M87f4fT81S+7MSFaaDWDLxhBWaD9XAl72TaZo10rf0oOoB23s3AR:5zenCvK6mSoXp1DB+72YfROoB1Ql
TLSH
T167E49E61B9C280B3E29214B454B6AB775D3DB925AB10DDC3D3C01EF989206D0EB3B35E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_b2aa2eaab54876495adcd5421f0e6b78_amadey_cobalt-strike_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-08-08_b2aa2eaab54876495adcd5421f0e6b78_amadey_cobalt-strike_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 673KB

2026-08-08_b2aa2eaab54876495adcd5421f0e6b78_amadey_cobalt-strike_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 57e062c08c5b8f086a001b77177ad176
SHA256 b8f10885a1d2bc512fc66a301a4b81e9b6f4d823e62a23b8138dc30a9c915d52
MD5 b2aa2eaab54876495adcd5421f0e6b78
SHA1 d4a0da39ab5862537f1f998c45730af02da083a1
SHA512 532ecca27ebbc2070687b4d548c1994a9dbbc1a07e66dc74302ae6fa2ef0993b15af3adcbebcc0157bb383f03b92ffba5072325c86666bf49dfd0bb9334e67d3
SSDEEP 12288:5XjengCavMb6M87f4fT81S+7MSFaaDWDLxhBWaD9XAl72TaZo10rf0oOoB23s3AR:5zenCvK6mSoXp1DB+72YfROoB1Ql
TLSH
T167E49E61B9C280B3E29214B454B6AB775D3DB925AB10DDC3D3C01EF989206D0EB3B35E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

382538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\roblo\Source\Repos\Discord-Token-Grabber\Release\Token-Disc.pdb

kernel32

VerSetConditionMask VerifyVersionInfoA CreateFileA GetFileSizeEx HeapSize SetEndOfFile DeleteFileW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetStdHandle HeapReAlloc FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect WaitForMultipleObjects FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetConsoleOutputCP ReadConsoleW GetConsoleMode GetCommandLineW GetCommandLineA ExitProcess GetModuleFileNameW WriteFile SetFilePointerEx GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount PeekNamedPipe ReadFile GetFileType GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx CloseHandle MoveFileExA WideCharToMultiByte MultiByteToWideChar Sleep GetTickCount QueryPerformanceCounter LoadLibraryA GetProcAddress FreeLibrary GetModuleHandleA GetSystemDirectoryA QueryPerformanceFrequency SleepEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection GetLastError EnterCriticalSection FormatMessageW SetLastError FlsFree LocalFree FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx LCMapStringEx EncodePointer DecodePointer CompareStringEx GetCPInfo GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind RaiseException WriteConsoleW

normaliz

IdnToAscii

ws2_32

WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent freeaddrinfo recvfrom select __WSAFDIsSet ioctlsocket listen htonl accept WSACleanup WSAStartup WSAIoctl WSASetLastError socket setsockopt ntohs htons getsockopt getsockname getpeername connect bind WSAGetLastError send recv closesocket sendto gethostname ntohl getaddrinfo

wldap32

ord35 ord33 ord32 ord27 ord26 ord22 ord79 ord50 ord45 ord60 ord211 ord46 ord217 ord143 ord30 ord200 ord301 ord41

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore

advapi32

CryptDestroyHash CryptEncrypt CryptImportKey CryptDestroyKey CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA

Name

.text

Size

535KB

Virtual Size

534KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

648B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_b2aa2eaab54876495adcd5421f0e6b78_amadey_cobalt-strike_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

normaliz

ws2_32

wldap32

crypt32

advapi32

generic