2026-08-09_183f478bf89e7a479e27a8220a932b7d_amadey_elex_floxif_glassworm_helldown_hijackloader_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_183f478bf89e7a479e27a8220a932b7d_amadey_elex_floxif_glassworm_helldown_hijackloader_luca-stealer_njrat
Size 3.9MB
Sample260809-ghgsnavxe1
SHA256 a6a50fd2585a473ec4c21bdb0d0beb4f99f853f1920d2c38c26de1d24f0e7efc
MD5 183f478bf89e7a479e27a8220a932b7d
SHA1 3c3c6ef277fdbd3857b45e1a105877bf946de687
SHA512 c09ab44a19a9ed30ec22d870f65f103427e6cadc07711e61bcd732e6800be67851651c8750fcca3f26c70b95f025c46f41f1ea5c0b4723885effdfcd0be18e8c
SSDEEP 98304:gkafAym0paIOVr8IbiQO9E8LjJhF8w4rlVVs/nz:gkafApSSfb5E/
TLSH
T11F165910F6818C61D4E1063089EA9A7F5675BD27C724B5EBA7807E2E28306D2F7357CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_183f478bf89e7a479e27a8220a932b7d_amadey_elex_floxif_glassworm_helldown_hijackloader_luca-stealer_njrat

File Explorer

2026-08-09_183f478bf89e7a479e27a8220a932b7d_amadey_elex_floxif_glassworm_helldown_hijackloader_luca-stealer_njrat

.exe 3.9MB

2026-08-09_183f478bf89e7a479e27a8220a932b7d_amadey_elex_floxif_glassworm_helldown_hijackloader_luca-stealer_njrat

IMPHASH e1434ffd59ab4636a69be302f22f58de
SHA256 a6a50fd2585a473ec4c21bdb0d0beb4f99f853f1920d2c38c26de1d24f0e7efc
MD5 183f478bf89e7a479e27a8220a932b7d
SHA1 3c3c6ef277fdbd3857b45e1a105877bf946de687
SHA512 c09ab44a19a9ed30ec22d870f65f103427e6cadc07711e61bcd732e6800be67851651c8750fcca3f26c70b95f025c46f41f1ea5c0b4723885effdfcd0be18e8c
SSDEEP 98304:gkafAym0paIOVr8IbiQO9E8LjJhF8w4rlVVs/nz:gkafApSSfb5E/
TLSH
T11F165910F6818C61D4E1063089EA9A7F5675BD27C724B5EBA7807E2E28306D2F7357CB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

36:bb:3f:3c:07:4b:ab:b3:75:a7:6d:be:98:e0:b0:cd:3d:29:5f:96:e3:9f:dc:56:83:8b:30:34:d6:a2:cf:e0

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=C27039-2001,CN=TeraByte\, Inc.,O=TeraByte\, Inc.,L=Las Vegas,ST=Nevada,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13064e6576616461,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 28, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

07:34:c0:22:c3:98:4a:03:25:bd:ac:4f:ea:e2:63:10

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 7, 2022 - Jul 30, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1624827

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

V:\image2\win32\en_gui\ReleaseUnicode\imagew.pdb

mpr

WNetCloseEnum

comctl32

ImageList_GetIcon ImageList_Destroy ImageList_ReplaceIcon ImageList_Draw InitCommonControlsEx ImageList_GetImageCount ImageList_AddMasked ImageList_Create ImageList_LoadImageW

ws2_32

__WSAFDIsSet getservbyname getservbyport gethostbyaddr ntohs listen inet_ntoa getsockopt ioctlsocket accept getsockname setsockopt sendto recvfrom htonl closesocket connect htons inet_addr recv bind select send shutdown socket WSAStringToAddressW WSASetLastError WSAGetLastError WSACleanup WSAStartup gethostbyname

kernel32

LocalFree GetTickCount FileTimeToLocalFileTime FindClose GetLogicalDrives FileTimeToSystemTime ReadFile WriteFile EnterCriticalSection LeaveCriticalSection QueryPerformanceCounter QueryPerformanceFrequency HeapAlloc HeapFree GetProcessHeap ReleaseMutex GetExitCodeProcess GetCurrentThreadId GetPriorityClass GetLocalTime SystemTimeToTzSpecificLocalTime SystemTimeToFileTime ResetEvent GetSystemTime FlushFileBuffers SetEndOfFile GlobalAlloc GlobalUnlock GlobalLock GlobalFree LoadLibraryA VirtualUnlock MultiByteToWideChar WideCharToMultiByte QueryDosDeviceW GetOverlappedResult lstrlenW CreateFileA GetDiskFreeSpaceW GetVolumeInformationW InitializeCriticalSection DeleteCriticalSection GetFileSize LocalAlloc LocalLock LocalUnlock GetFullPathNameW SetHandleInformation CreatePipe RemoveDirectoryW CreateDirectoryW MoveFileW SetFileAttributesW GlobalMemoryStatus VirtualLock GetConsoleMode GetConsoleOutputCP GetStdHandle ExitProcess FindFirstFileExW GetFileType FreeLibraryAndExitThread ResumeThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc RaiseException RtlUnwind CreateThread GetSystemDirectoryA GetSystemTimeAsFileTime IsDebuggerPresent WaitForSingleObjectEx IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SetProcessWorkingSetSize GetProcessWorkingSetSize GetCurrentThread GetCurrentProcess UnmapViewOfFile MapViewOfFile OpenProcess WaitForMultipleObjects ReleaseSemaphore WaitForSingleObject SetEvent Sleep DeviceIoControl FreeLibrary GetCurrentProcessId SetErrorMode CloseHandle VirtualQuery VirtualFree VirtualAlloc SetLastError GetLastError SetFilePointer IsValidLocale GetUserDefaultLCID HeapReAlloc SetStdHandle GetTimeZoneInformation GetACP GetOEMCP HeapSize MulDiv GetCommandLineA GetCommandLineW GetFileSizeEx GetModuleHandleA

user32

OemToCharW WinHelpW GetDesktopWindow DrawIcon EnableMenuItem GetSystemMenu GetDialogBaseUnits CheckDlgButton DialogBoxIndirectParamW GetSystemMetrics UpdateWindow SendNotifyMessageW SetMenuItemInfoW AppendMenuW TrackPopupMenu DrawIconEx IsRectEmpty InflateRect GetSysColorBrush ScreenToClient GetCursorPos MessageBeep GetWindowRect GetScrollRange GetScrollPos GetMenuItemCount KillTimer SetTimer GetAsyncKeyState GetKeyState GetActiveWindow SetFocus GetDlgCtrlID GetDlgItemInt GetMenuItemInfoW CreatePopupMenu DestroyMenu DrawFrameControl GetDlgItem GetDC ReleaseDC BeginPaint EndPaint InvalidateRect SetDlgItemInt EndDialog IsIconic IsWindowVisible SetWindowPos IsChild IsWindow WaitMessage ExitWindowsEx IsWindowEnabled GetClientRect GetSysColor SetForegroundWindow DrawFocusRect FillRect PtInRect GetParent GetComboBoxInfo ShowWindow OffsetRect DestroyIcon CopyImage CreateIconIndirect GetIconInfo TranslateMessage PostQuitMessage DestroyWindow GetFocus SetCursor

gdi32

Rectangle DeleteObject CreateSolidBrush Polygon CreateCompatibleBitmap CreateDIBSection CreateDCW BitBlt LineTo SelectObject GetStockObject GetDeviceCaps DeleteDC CreateHatchBrush CreateCompatibleDC MoveToEx SetTextColor SetBkMode SetBkColor CreatePen StretchBlt

advapi32

OpenProcessToken StartServiceW QueryServiceStatus OpenServiceW DeleteService CreateServiceW ControlService ReportEventW RegisterEventSourceW DeregisterEventSource OpenSCManagerW EnumServicesStatusW CloseServiceHandle LogonUserW CryptGenRandom CryptReleaseContext LookupAccountSidW GetTokenInformation OpenThreadToken RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges

shell32

DragFinish DragAcceptFiles

ole32

CoTaskMemFree CLSIDFromString CoSetProxyBlanket CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

VariantInit VariantClear SysFreeString VariantCopy VariantChangeType SysAllocString VariantTimeToSystemTime

ntdll

RtlNtStatusToDosError

generic

count=11, id=259, version=27412,

count=199, id=261, version=27412,

count=18, id=260, version=27412,

count=11, id=150, version=20413,

count=19, id=260, version=26706,

count=25, id=259, version=26706,

count=41, id=158, version=20921,

count=217, productName=Unmarked objects (old),

count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=259, version=27024,

count=115, id=260, version=27049,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=300, id=1, productName=Unmarked objects,

count=113, id=262, version=27412,

count=110, id=253, version=27412,

count=1, id=259, version=27049,

count=45, id=261, version=26706,

count=7, id=261, version=27050,

count=58, id=261, version=27051,

count=533, id=261, version=27049,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,