2026-08-08_87962b05c156a5d2c2d8d0b0f878d40a_amadey_elex_floxif_glassworm_helldown_hijackloader_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_87962b05c156a5d2c2d8d0b0f878d40a_amadey_elex_floxif_glassworm_helldown_hijackloader_luca-stealer_njrat
Size 3.9MB
Sample260808-tbbz2sec43
SHA256 c300c0bcdd4a6ca92eb6c98875dbb675bb6522f2abce52a28cf096209840dc96
MD5 87962b05c156a5d2c2d8d0b0f878d40a
SHA1 6b5c886f4908baba09b1cd93707cb0a4d79df53d
SHA512 7c958ca2e1b6202394e9c6f4787219b0d0f58a491669acb4a7972a8d2d3ce3221f3bd71b180f31c76e185648975e72822284ca8cdaef35fce799f72a68427dc1
SSDEEP 98304:gkafAym0pTBIOVrhIbiQO9E8LjJhF8w4rlVVs/nX:gkafApSFab5E7
TLSH
T1D0164910F6818C61D4E1063089EA9A7F5675BD27C724B5EBA7807E2E28306D2F7357CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-08_87962b05c156a5d2c2d8d0b0f878d40a_amadey_elex_floxif_glassworm_helldown_hijackloader_luca-stealer_njrat

File Explorer

2026-08-08_87962b05c156a5d2c2d8d0b0f878d40a_amadey_elex_floxif_glassworm_helldown_hijackloader_luca-stealer_njrat

.exe 3.9MB

2026-08-08_87962b05c156a5d2c2d8d0b0f878d40a_amadey_elex_floxif_glassworm_helldown_hijackloader_luca-stealer_njrat

IMPHASH e1434ffd59ab4636a69be302f22f58de
SHA256 c300c0bcdd4a6ca92eb6c98875dbb675bb6522f2abce52a28cf096209840dc96
MD5 87962b05c156a5d2c2d8d0b0f878d40a
SHA1 6b5c886f4908baba09b1cd93707cb0a4d79df53d
SHA512 7c958ca2e1b6202394e9c6f4787219b0d0f58a491669acb4a7972a8d2d3ce3221f3bd71b180f31c76e185648975e72822284ca8cdaef35fce799f72a68427dc1
SSDEEP 98304:gkafAym0pTBIOVrhIbiQO9E8LjJhF8w4rlVVs/nX:gkafApSFab5E7
TLSH
T1D0164910F6818C61D4E1063089EA9A7F5675BD27C724B5EBA7807E2E28306D2F7357CB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

be:96:8d:02:49:d3:a5:39:fc:e7:eb:e2:85:0a:e4:38:36:06:5d:93:40:0e:70:71:d7:78:23:63:70:ad:ca:06

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=C27039-2001,CN=TeraByte\, Inc.,O=TeraByte\, Inc.,L=Las Vegas,ST=Nevada,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13064e6576616461,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 28, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

07:34:c0:22:c3:98:4a:03:25:bd:ac:4f:ea:e2:63:10

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 7, 2022 - Jul 30, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1624827

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

V:\image2\win32\en_gui\ReleaseUnicode\imagew.pdb

mpr

WNetCloseEnum

comctl32

ImageList_GetIcon ImageList_Destroy ImageList_ReplaceIcon ImageList_Draw InitCommonControlsEx ImageList_GetImageCount ImageList_AddMasked ImageList_Create ImageList_LoadImageW

ws2_32

__WSAFDIsSet getservbyname getservbyport gethostbyaddr ntohs listen inet_ntoa getsockopt ioctlsocket accept getsockname setsockopt sendto recvfrom htonl closesocket connect htons inet_addr recv bind select send shutdown socket WSAStringToAddressW WSASetLastError WSAGetLastError WSACleanup WSAStartup gethostbyname

kernel32

LocalFree GetTickCount FileTimeToLocalFileTime FindClose GetLogicalDrives FileTimeToSystemTime ReadFile WriteFile EnterCriticalSection LeaveCriticalSection QueryPerformanceCounter QueryPerformanceFrequency HeapAlloc HeapFree GetProcessHeap ReleaseMutex GetExitCodeProcess GetCurrentThreadId GetPriorityClass GetLocalTime SystemTimeToTzSpecificLocalTime SystemTimeToFileTime ResetEvent GetSystemTime FlushFileBuffers SetEndOfFile GlobalAlloc GlobalUnlock GlobalLock GlobalFree LoadLibraryA VirtualUnlock MultiByteToWideChar WideCharToMultiByte QueryDosDeviceW GetOverlappedResult lstrlenW CreateFileA GetDiskFreeSpaceW GetVolumeInformationW InitializeCriticalSection DeleteCriticalSection GetFileSize LocalAlloc LocalLock LocalUnlock GetFullPathNameW SetHandleInformation CreatePipe RemoveDirectoryW CreateDirectoryW MoveFileW SetFileAttributesW GlobalMemoryStatus VirtualLock GetConsoleMode GetConsoleOutputCP GetStdHandle ExitProcess FindFirstFileExW GetFileType FreeLibraryAndExitThread ResumeThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc RaiseException RtlUnwind CreateThread GetSystemDirectoryA GetSystemTimeAsFileTime IsDebuggerPresent WaitForSingleObjectEx IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SetProcessWorkingSetSize GetProcessWorkingSetSize GetCurrentThread GetCurrentProcess UnmapViewOfFile MapViewOfFile OpenProcess WaitForMultipleObjects ReleaseSemaphore WaitForSingleObject SetEvent Sleep DeviceIoControl FreeLibrary GetCurrentProcessId SetErrorMode CloseHandle VirtualQuery VirtualFree VirtualAlloc SetLastError GetLastError SetFilePointer IsValidLocale GetUserDefaultLCID HeapReAlloc SetStdHandle GetTimeZoneInformation GetACP GetOEMCP HeapSize MulDiv GetCommandLineA GetCommandLineW GetFileSizeEx GetModuleHandleA

user32

OemToCharW WinHelpW GetDesktopWindow DrawIcon EnableMenuItem GetSystemMenu GetDialogBaseUnits CheckDlgButton DialogBoxIndirectParamW GetSystemMetrics UpdateWindow SendNotifyMessageW SetMenuItemInfoW AppendMenuW TrackPopupMenu DrawIconEx IsRectEmpty InflateRect GetSysColorBrush ScreenToClient GetCursorPos MessageBeep GetWindowRect GetScrollRange GetScrollPos GetMenuItemCount KillTimer SetTimer GetAsyncKeyState GetKeyState GetActiveWindow SetFocus GetDlgCtrlID GetDlgItemInt GetMenuItemInfoW CreatePopupMenu DestroyMenu DrawFrameControl GetDlgItem GetDC ReleaseDC BeginPaint EndPaint InvalidateRect SetDlgItemInt EndDialog IsIconic IsWindowVisible SetWindowPos IsChild IsWindow WaitMessage ExitWindowsEx IsWindowEnabled GetClientRect GetSysColor SetForegroundWindow DrawFocusRect FillRect PtInRect GetParent GetComboBoxInfo ShowWindow OffsetRect DestroyIcon CopyImage CreateIconIndirect GetIconInfo TranslateMessage PostQuitMessage DestroyWindow GetFocus SetCursor

gdi32

Rectangle DeleteObject CreateSolidBrush Polygon CreateCompatibleBitmap CreateDIBSection CreateDCW BitBlt LineTo SelectObject GetStockObject GetDeviceCaps DeleteDC CreateHatchBrush CreateCompatibleDC MoveToEx SetTextColor SetBkMode SetBkColor CreatePen StretchBlt

advapi32

OpenProcessToken StartServiceW QueryServiceStatus OpenServiceW DeleteService CreateServiceW ControlService ReportEventW RegisterEventSourceW DeregisterEventSource OpenSCManagerW EnumServicesStatusW CloseServiceHandle LogonUserW CryptGenRandom CryptReleaseContext LookupAccountSidW GetTokenInformation OpenThreadToken RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges

shell32

DragFinish DragAcceptFiles

ole32

CoTaskMemFree CLSIDFromString CoSetProxyBlanket CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

VariantInit VariantClear SysFreeString VariantCopy VariantChangeType SysAllocString VariantTimeToSystemTime

ntdll

RtlNtStatusToDosError

generic

count=11, id=259, version=27412,

count=199, id=261, version=27412,

count=18, id=260, version=27412,

count=11, id=150, version=20413,

count=19, id=260, version=26706,

count=25, id=259, version=26706,

count=41, id=158, version=20921,

count=217, productName=Unmarked objects (old),

count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=259, version=27024,

count=115, id=260, version=27049,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=300, id=1, productName=Unmarked objects,

count=113, id=262, version=27412,

count=110, id=253, version=27412,

count=1, id=259, version=27049,

count=45, id=261, version=26706,

count=7, id=261, version=27050,

count=58, id=261, version=27051,

count=533, id=261, version=27049,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,