9b9994ca1cd29ab05b364b6c40f8f07b7987209bf37f93793b3f0801b3e8c3e5

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 03:44

Target
2026-08-21_f1e7555e12fcd09ddd9e5c1ce2ba8c6c_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
Size 10.7MB
Sample260821-eaz8xssbpe
SHA256 9b9994ca1cd29ab05b364b6c40f8f07b7987209bf37f93793b3f0801b3e8c3e5
MD5 f1e7555e12fcd09ddd9e5c1ce2ba8c6c
SHA1 12914cae4aa5d4f071c79129e178ed19f690b644
SHA512 fbf26fbe7bad964d3d33de606e643039a2ebcf088fe276ed1e6cfae04bca373faa5cd27e88af8dc2210209999a5e1f3263b8833b1ae8805b2879b6f17f483aab
SSDEEP 196608:SYFXUsWSoJie61KCSOAjxWCLCjHQoo3ff5eBw:32ZSoJieCNSOAjxWCLCnsfABw
TLSH
T1D8B6AE32B255C032F55011F1986FAB1A63207A795770C8CBF2E1AE6D21E96C74B36F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

upx

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/memory/3444-0-0x0000000000970000-0x0000000001421000-memory.dmp	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3444-0-0x0000000000970000-0x0000000001421000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3780	3444	WerFault.exe	83
3364	3444	WerFault.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-08-21_f1e7555e12fcd09ddd9e5c1ce2ba8c6c_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_f1e7555e12fcd09ddd9e5c1ce2ba8c6c_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe"
1⤵
PID:3444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 196
  2⤵
  - Program crash
  PID:3780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 204
  2⤵
  - Program crash
  PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3444 -ip 3444
1⤵
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3444 -ip 3444
1⤵
PID:1320

memory/3444-0-0x0000000000970000-0x0000000001421000-memory.dmp

Download