2026-08-09_d48715d00d0b36ac1ec0f4122a935c39_amadey_blankgrabber_elex_floxif_glassworm_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_d48715d00d0b36ac1ec0f4122a935c39_amadey_blankgrabber_elex_floxif_glassworm_luca-stealer_njrat_remcos_smoke-loader
Size 17.4MB
Sample260809-g7ysgascpd
SHA256 f5ad779905809fdd104b665bc00da0f41ab44b14c773bfca3cfbce6d16786d46
MD5 d48715d00d0b36ac1ec0f4122a935c39
SHA1 e238e44d62ed7abff28a62b1b6a8a79a441c3ab0
SHA512 35e03fac29b536119eed5e8b018df57b4f760f550520ad7d1cb9c77bc79b8ac62e178f98eff30f20def223c3efa6b50b934e126a2ad2154d9f42b4fb0b59cd1e
SSDEEP 393216:KTF3TYXyijroypW+d6vHlP0A7PtmrxCi/gs6:2DYXrPYvR0A7V+H6
TLSH
T189072330BA45C076E89105B5DD6CA7AA816CBE340B6200CBA3F47E1D7DB55C32B39B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_d48715d00d0b36ac1ec0f4122a935c39_amadey_blankgrabber_elex_floxif_glassworm_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-08-09_d48715d00d0b36ac1ec0f4122a935c39_amadey_blankgrabber_elex_floxif_glassworm_luca-stealer_njrat_remcos_smoke-loader

.exe 17.4MB

2026-08-09_d48715d00d0b36ac1ec0f4122a935c39_amadey_blankgrabber_elex_floxif_glassworm_luca-stealer_njrat_remcos_smoke-loader

IMPHASH 89499f85d507b5e8218980e01d370016
SHA256 f5ad779905809fdd104b665bc00da0f41ab44b14c773bfca3cfbce6d16786d46
MD5 d48715d00d0b36ac1ec0f4122a935c39
SHA1 e238e44d62ed7abff28a62b1b6a8a79a441c3ab0
SHA512 35e03fac29b536119eed5e8b018df57b4f760f550520ad7d1cb9c77bc79b8ac62e178f98eff30f20def223c3efa6b50b934e126a2ad2154d9f42b4fb0b59cd1e
SSDEEP 393216:KTF3TYXyijroypW+d6vHlP0A7PtmrxCi/gs6:2DYXrPYvR0A7V+H6
TLSH
T189072330BA45C076E89105B5DD6CA7AA816CBE340B6200CBA3F47E1D7DB55C32B39B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

b2:88:65:95:cd:1b:d7:4b:7a:55:a2:b6:1d:4b:3a:e6:ac:46:44:02:e2:c7:6c:13:cb:9e:72:25:09:40:4e:2f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

May 25, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

278592

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x86\SfxInst.pdb

dwmapi

DwmSetWindowAttribute

bcrypt

BCryptExportKey BCryptSecretAgreement BCryptDeriveKey BCryptGenerateSymmetricKey BCryptEncrypt BCryptDestroyKey BCryptDestroySecret BCryptGenerateKeyPair BCryptImportKeyPair BCryptSetProperty BCryptOpenAlgorithmProvider BCryptFinalizeKeyPair BCryptCloseAlgorithmProvider

ntdll

NtClose NtSetInformationThread VerSetConditionMask NtOpenKey NtQueryKey RtlGetLastNtStatus RtlCaptureContext RtlNtStatusToDosError NtDeleteKey RtlUnwind

kernel32

GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetStdHandle EnumSystemLocalesW IsValidLocale LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleOutputCP ReadConsoleW GetConsoleMode GetFileType ExitProcess GetStdHandle TzSpecificLocalTimeToSystemTime FreeLibraryAndExitThread ExitThread InterlockedPushEntrySList GetStartupInfoW InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo CompareStringEx GetProcAddress GetModuleHandleW CloseHandle SetLastError GetLastError CreateFileW DeviceIoControl WideCharToMultiByte MultiByteToWideChar FindClose FindFirstFileW RemoveDirectoryW Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection WaitForSingleObject SetFilePointerEx GetFileSizeEx UnmapViewOfFile ReadFile GetCurrentProcessId CreateFileMappingW MapViewOfFile OpenFileMappingW IsWow64Process GetCurrentProcess HeapAlloc GetProcessHeap GetSystemDirectoryW lstrcatW GetModuleHandleA LocalFree CreateProcessW CreateEventW ResumeThread GetExitCodeProcess GetCurrentThread FindResourceW SizeofResource LockResource LoadResource GlobalAlloc GlobalLock GlobalFree GlobalUnlock SetEvent CreateThread TerminateThread GetLocaleInfoW GetModuleFileNameA GetModuleHandleExW FreeLibrary GetCurrentThreadId FormatMessageW HeapFree DebugBreak GetUserDefaultLangID LoadLibraryA IsProcessorFeaturePresent ProcessIdToSessionId OpenProcess GetCommandLineW GetFileTime GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemTimeAsFileTime FileTimeToSystemTime GetNativeSystemInfo GetPrivateProfileStringW InitializeCriticalSectionEx LCIDToLocaleName HeapSize GetUserDefaultLCID HeapReAlloc DecodePointer HeapDestroy WaitForMultipleObjects WriteFile ResetEvent CompareStringW GetOverlappedResult CreateIoCompletionPort PostQueuedCompletionStatus GetQueuedCompletionStatus CancelIoEx GetTickCount64 VirtualAlloc WerRegisterMemoryBlock WerUnregisterMemoryBlock VirtualFree QueryPerformanceCounter QueryPerformanceFrequency InitOnceExecuteOnce AcquireSRWLockExclusive ReleaseSRWLockExclusive UnlockFile LockFileEx OutputDebugStringW IsDebuggerPresent HeapQueryInformation CompareFileTime LoadLibraryExW TerminateProcess VerifyVersionInfoW QueryUnbiasedInterruptTime GetTickCount SetThreadPriority InitializeCriticalSectionAndSpinCount RaiseException GetThreadTimes QueryThreadCycleTime UnlockFileEx LoadLibraryW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetProcessImageFileNameW GetProcessTimes GetPriorityClass K32GetProcessMemoryInfo FlushFileBuffers DeleteFileW GetFileInformationByHandle GetFullPathNameW OutputDebugStringA TlsAlloc TlsGetValue TlsSetValue GetModuleFileNameW ReleaseSemaphore GetSystemInfo GetVersionExW ExpandEnvironmentStringsW GetShortPathNameW GetFileAttributesW GetSystemWindowsDirectoryW GetProcessAffinityMask GetLongPathNameW VirtualProtect GlobalMemoryStatusEx GetEnvironmentVariableW GetExitCodeThread TlsFree SetFilePointer SetFileAttributesW GetFileSize SetEndOfFile MoveFileExW GetWindowsDirectoryW DuplicateHandle SetFileTime CreateDirectoryW GetCurrentDirectoryW FindFirstFileExW FindNextFileW QueryDosDeviceW GetVolumePathNameW GetVolumeNameForVolumeMountPointW GetVersion FindResourceExW SetEnvironmentVariableW WriteProcessMemory CopyFileW SetFileInformationByHandle GetDiskFreeSpaceExW K32GetMappedFileNameW VirtualQuery FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose SystemTimeToFileTime GetSystemTimes AreFileApisANSI WaitForSingleObjectEx InitOnceBeginInitialize WriteConsoleW SetThreadAffinityMask LoadLibraryExA GetFileAttributesExW CreateSemaphoreW LCMapStringEx EncodePointer WakeConditionVariable CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns GetLocaleInfoEx FormatMessageA WakeAllConditionVariable SleepConditionVariableSRW AcquireSRWLockShared ReleaseSRWLockShared TryAcquireSRWLockExclusive GetStringTypeW InitOnceComplete

fltlib

FilterGetMessage FilterSendMessage FilterLoad FilterConnectCommunicationPort FilterReplyMessage

rpcrt4

UuidFromStringW RpcEpUnregister

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

420KB

Virtual Size

420KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

60KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

1024B

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=206, id=261, version=33138,

count=1, id=263, version=33138,

count=4, id=253, version=34321,

count=21, id=260, version=34321,

count=27, id=259, version=34321,

count=121, id=261, version=34321,

count=21, id=259, version=33138,

count=27, id=260, version=33138,

count=2, id=257, version=30795,

count=10, id=260, version=33520,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=10, id=260, version=32545,

count=13, productName=Unmarked objects (old),

count=4, id=261, version=32545,

count=21, id=257, version=33138,

count=581, id=1, productName=Unmarked objects,

count=309, id=265, version=34436,

count=1, id=256, version=34436,

count=1, id=255, version=34436,

count=2, id=151,

count=1, id=258, version=34436,