2026-08-11_38e92f94e825262e287eca5e101b4a34_amadey_cobalt-strike_elex_glassworm_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_38e92f94e825262e287eca5e101b4a34_amadey_cobalt-strike_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 533KB
Sample260811-tey9rawdkh
SHA256 8fdaf6c40ed24e33049a25f880e52f1892cfce4aebf28602ac54d11fad40ae33
MD5 38e92f94e825262e287eca5e101b4a34
SHA1 51d5ae93f041c188ac86e58e23dc575026e1f966
SHA512 5c42701766c2eec769f8fa78ca2f8fd43cb29b911ad00490215337ea7bf897a6fd9fd11d41c98171a0e1e94712399f0ed304fe7f2b060c3352ad61e5d95b3b9c
SSDEEP 12288:4p1PSiwiogOJ+/JULjrZtbV0IybWNmHOCcTpKXtbIBh8Tnc/471qr:4UpWEBhV/L
TLSH
T1E1C45D0D7ED2C1F2C14F2975042AE63F8A7D9E94471CADCF63983DBE99311E06A36069
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-11_38e92f94e825262e287eca5e101b4a34_amadey_cobalt-strike_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-08-11_38e92f94e825262e287eca5e101b4a34_amadey_cobalt-strike_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 533KB

2026-08-11_38e92f94e825262e287eca5e101b4a34_amadey_cobalt-strike_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH cae3012e5e5c9ba5e4c42914bfcb4bbd
SHA256 8fdaf6c40ed24e33049a25f880e52f1892cfce4aebf28602ac54d11fad40ae33
MD5 38e92f94e825262e287eca5e101b4a34
SHA1 51d5ae93f041c188ac86e58e23dc575026e1f966
SHA512 5c42701766c2eec769f8fa78ca2f8fd43cb29b911ad00490215337ea7bf897a6fd9fd11d41c98171a0e1e94712399f0ed304fe7f2b060c3352ad61e5d95b3b9c
SSDEEP 12288:4p1PSiwiogOJ+/JULjrZtbV0IybWNmHOCcTpKXtbIBh8Tnc/471qr:4UpWEBhV/L
TLSH
T1E1C45D0D7ED2C1F2C14F2975042AE63F8A7D9E94471CADCF63983DBE99311E06A36069
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

5c:27:8c:ca:29:40:eb:c2:6b:2a:79:ea:cf:57:be:1b:52:1a:95:5e:bc:5d:d8:1b:ff:7d:df:76:90:d0:f7:fc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=321366800016038,CN=ИП Марчуков Дмитрий Олегович,O=ИП Марчуков Дмитрий Олегович,L=Воронеж,ST=Воронежская область,C=RU,1.3.6.1.4.1.311.60.2.1.2=#130f566f726f6e657a68204f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#130f427573696e65737320456e74697479

Chains

Jul 13, 2026

Subject

Serial Number

35:1b:63:f5:73:7d:3a:fa:c2:1b:8a:0a

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 16, 2026 - Apr 17, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

239837

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

libcef

cef_string_multimap_value cef_string_multimap_key cef_string_multimap_size cef_string_map_append cef_string_map_value cef_string_map_key cef_string_map_size cef_string_list_append cef_string_list_value cef_string_list_size cef_stream_reader_create_for_data cef_stream_reader_create_for_file cef_v8value_create_function cef_v8value_create_object cef_v8value_create_int cef_v8value_create_undefined cef_v8context_get_current_context cef_process_message_create cef_list_value_create cef_dictionary_value_create cef_browser_host_create_browser cef_string_multimap_free cef_uridecode cef_parse_url cef_quit_message_loop cef_run_message_loop cef_shutdown cef_initialize cef_execute_process cef_register_scheme_handler_factory cef_post_delayed_task cef_post_task cef_currently_on cef_api_hash cef_command_line_create cef_string_map_free cef_string_map_alloc cef_string_list_free cef_string_list_alloc cef_string_userfree_utf16_free cef_log cef_string_multimap_alloc cef_string_utf16_cmp cef_string_ascii_to_utf16 cef_string_utf16_to_utf8 cef_string_utf8_to_utf16 cef_string_utf16_clear cef_string_utf8_clear cef_string_multimap_append cef_string_utf16_set

kernel32

WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle GetProcessHeap GetCommandLineW CloseHandle SetEvent CreateEventW WaitForMultipleObjects OpenProcess GetModuleFileNameW CreateFileA CreateFileW GetFileAttributesExA WriteFile GetTempPathW GetTickCount64 MoveFileExA CreateFileMappingW MapViewOfFile UnmapViewOfFile ReadFile GetLastError ConnectNamedPipe DisconnectNamedPipe PeekNamedPipe CreateNamedPipeW Sleep CreateThread GetFileAttributesW MultiByteToWideChar WideCharToMultiByte SetLastError FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc SetFilePointerEx GetFileSizeEx GetFileType LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind RaiseException InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent GetCPInfo GetStringTypeW GetProcAddress GetModuleHandleW GetSystemTimeAsFileTime DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SleepConditionVariableSRW WakeAllConditionVariable QueryPerformanceCounter HeapSize TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread GetCurrentThreadId WaitForSingleObjectEx

shell32

ShellExecuteW

Name

.text

Size

318KB

Virtual Size

318KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

122KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-11_38e92f94e825262e287eca5e101b4a34_amadey_cobalt-strike_elex_glassworm_luca-stealer_njrat_smoke-loader

PE Signature issue

libcef

kernel32

shell32

generic