General
- Target 2026-08-08_f249d3e7c42c492d1d127d3cc8fd5ba4_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader
- Size 6.6MB
- Sample260808-pwjs6s1vez
- SHA256 390e7e126a8265f3dc1c5617abfc532828866dc332e92cd0ef0931055e1febbf
- MD5 f249d3e7c42c492d1d127d3cc8fd5ba4
- SHA1 bac026dd144cce9adb52a2742e2bf67bc39fea0f
- SHA512 a2954e1ae3392adf9d481d940b4237a2e88f2ff409e1317d8502e8530d76bea5629ea28810015a49720d3f9854468bf54ecac38fb18a76b097c250b41b9cc046
- SSDEEP 196608:qbuCCCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazm:huN/HYOSIT/EVF9a
- TLSH T1AC663381B092CC7AE8F3253606B7D1346D7EFD130B1049BB62AC4A537E61B92B77921D
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_f249d3e7c42c492d1d127d3cc8fd5ba4_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-08_f249d3e7c42c492d1d127d3cc8fd5ba4_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader
- Size 6.6MB
- SHA256 390e7e126a8265f3dc1c5617abfc532828866dc332e92cd0ef0931055e1febbf
- MD5 f249d3e7c42c492d1d127d3cc8fd5ba4
- SHA1 bac026dd144cce9adb52a2742e2bf67bc39fea0f
- SHA512 a2954e1ae3392adf9d481d940b4237a2e88f2ff409e1317d8502e8530d76bea5629ea28810015a49720d3f9854468bf54ecac38fb18a76b097c250b41b9cc046
- SSDEEP 196608:qbuCCCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazm:huN/HYOSIT/EVF9a
- TLSH T1AC663381B092CC7AE8F3253606B7D1346D7EFD130B1049BB62AC4A537E61B92B77921D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contacts a large (8417) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Loads dropped DLL