9b9994ca1cd29ab05b364b6c40f8f07b7987209bf37f93793b3f0801b3e8c3e5

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 03:44

Target
2026-08-21_f1e7555e12fcd09ddd9e5c1ce2ba8c6c_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
Size 10.7MB
Sample260821-eaz8xssbpe
SHA256 9b9994ca1cd29ab05b364b6c40f8f07b7987209bf37f93793b3f0801b3e8c3e5
MD5 f1e7555e12fcd09ddd9e5c1ce2ba8c6c
SHA1 12914cae4aa5d4f071c79129e178ed19f690b644
SHA512 fbf26fbe7bad964d3d33de606e643039a2ebcf088fe276ed1e6cfae04bca373faa5cd27e88af8dc2210209999a5e1f3263b8833b1ae8805b2879b6f17f483aab
SSDEEP 196608:SYFXUsWSoJie61KCSOAjxWCLCjHQoo3ff5eBw:32ZSoJieCNSOAjxWCLCnsfABw
TLSH
T1D8B6AE32B255C032F55011F1986FAB1A63207A795770C8CBF2E1AE6D21E96C74B36F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

upx

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/memory/6032-0-0x0000000000D30000-0x00000000017E1000-memory.dmp	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/6032-0-0x0000000000D30000-0x00000000017E1000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2036	6032	WerFault.exe	88
5820	6032	WerFault.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-21_f1e7555e12fcd09ddd9e5c1ce2ba8c6c_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_f1e7555e12fcd09ddd9e5c1ce2ba8c6c_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe"
1⤵
PID:6032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 252
  2⤵
  - Program crash
  PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 268
  2⤵
  - Program crash
  PID:5820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6032 -ip 6032
1⤵
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6032 -ip 6032
1⤵
PID:2156

memory/6032-0-0x0000000000D30000-0x00000000017E1000-memory.dmp

Download