2026-08-20_f5c42518fc8614943c2dda525020f39c_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_f5c42518fc8614943c2dda525020f39c_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos
Size 2.7MB
Sample260820-21415azzcs
SHA256 c0fc6ff3c533d68d203cb92c08b15a4720f9fe9a9f0164dbf605466c841b56c4
MD5 f5c42518fc8614943c2dda525020f39c
SHA1 e4fa74ec27ab7b04d0b238f43c0653a57d140c05
SHA512 7c464d55b21dc56d6474bb90de4cbc7a221617da1b97eb4437d7bc4923fa0546d911813872bacacf656ea642b89be0abf541720c27f5263872992e1535ca72e5
SSDEEP 49152:R6WhVIuuUrFxNp4+2oanSWdu6J+yWkWB3j2Q0eEnfwKGEDtThZI:RFVIExNi+2ru6J+yZ78IVG
TLSH
T1CED59E2EBD55C032D56201B05929CBABE22DAE35076204CBBFE8793DD9745C25B33B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-08-20_f5c42518fc8614943c2dda525020f39c_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos

File Explorer

2026-08-20_f5c42518fc8614943c2dda525020f39c_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos

.exe 2.7MB

2026-08-20_f5c42518fc8614943c2dda525020f39c_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos

IMPHASH adb9533ee5d558c1c16cfda172ccca4b
SHA256 c0fc6ff3c533d68d203cb92c08b15a4720f9fe9a9f0164dbf605466c841b56c4
MD5 f5c42518fc8614943c2dda525020f39c
SHA1 e4fa74ec27ab7b04d0b238f43c0653a57d140c05
SHA512 7c464d55b21dc56d6474bb90de4cbc7a221617da1b97eb4437d7bc4923fa0546d911813872bacacf656ea642b89be0abf541720c27f5263872992e1535ca72e5
SSDEEP 49152:R6WhVIuuUrFxNp4+2oanSWdu6J+yWkWB3j2Q0eEnfwKGEDtThZI:RFVIExNi+2ru6J+yZ78IVG
TLSH
T1CED59E2EBD55C032D56201B05929CBABE22DAE35076204CBBFE8793DD9745C25B33B1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

92:e6:a2:52:3f:b9:77:e6:30:db:89:88:a4:e0:f2:51:28:ee:ac:1e:81:2f:4f:fe:a6:e9:5f:1b:e3:81:b1:74:82:ab:13:37:c2:4d:f7:6d:2f:99:8b:b2:5d:8a:31:a0

Digest Algorithm

sha384

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=02096520,CN=Sophos Ltd,OU=Endpoint Security Group,O=Sophos Ltd,L=Abingdon,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Apr 13, 2026

SERIALNUMBER=02096520,CN=Sophos Ltd,OU=Endpoint Security Group,O=Sophos Ltd,L=Abingdon,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert G5 CS RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Subject

CN=DigiCert G5 CS RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

01:02:62:e1:62:24:ca:6d:fe:f5:84:f8:c6:30:48:db

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2021 - Feb 10, 2036

Subject

SERIALNUMBER=02096520,CN=Sophos Ltd,OU=Endpoint Security Group,O=Sophos Ltd,L=Abingdon,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

07:d9:61:4b:c5:83:39:77:d4:e7:47:15:2b:ee:a1:64

Issuer

CN=DigiCert G5 CS RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 15, 2025 - Jul 14, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

210048

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

SophosSetup.pdb

shell32

CommandLineToArgvW

kernel32

HeapSize HeapReAlloc GetCommandLineW SetEnvironmentVariableW CreateFileW WriteFile OutputDebugStringW GetLastError GetSystemDirectoryW LoadResource LockResource SizeofResource FindResourceW ReOpenFile GetProcessHeap HeapSetInformation GetCurrentProcessId SetDllDirectoryW FindClose CloseHandle FreeLibrary LocalFree WaitForSingleObject TerminateProcess GetExitCodeProcess OpenProcess CreateDirectoryW GetVolumeInformationW GetTempPathW GetCurrentProcess GetModuleHandleW GetProcAddress CreateProcessW InitializeProcThreadAttributeList UpdateProcThreadAttribute LoadLibraryExW GetEnvironmentVariableW LoadLibraryExA SetSearchPathMode OutputDebugStringA ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetCurrentThreadId GetConsoleMode WriteConsoleW FlushFileBuffers GetFileInformationByHandle SetEndOfFile SetFilePointer DeviceIoControl MoveFileExW ReplaceFileW GetFileInformationByHandleEx FindFirstFileW GetFileAttributesW GetModuleFileNameW GetStdHandle FileTimeToSystemTime Sleep FreeEnvironmentStringsW DeleteProcThreadAttributeList FormatMessageW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation GetConsoleOutputCP RaiseException GetSystemInfo VirtualProtect VirtualQuery WakeAllConditionVariable SleepConditionVariableSRW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW FormatMessageA GetLocaleInfoEx FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetStringTypeW TryAcquireSRWLockExclusive WaitForSingleObjectEx GetExitCodeThread WakeConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW ExitProcess HeapAlloc HeapFree GetFileType SetStdHandle GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetFilePointerEx

Name

.text

Size

332KB

Virtual Size

331KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

213KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_f5c42518fc8614943c2dda525020f39c_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos

shell32

kernel32

generic