2026-08-24_30d4241d68dbf391fa787490bfd4cad5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-08-24_30d4241d68dbf391fa787490bfd4cad5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample260825-tkwe2svhjf
SHA256 91bc9f2c321456bd74ed46eee538e0afe0daf28a326e43f179f563ac7aeb4f3f
MD5 30d4241d68dbf391fa787490bfd4cad5
SHA1 e277c9cbdb9f4305fa506b0dce5b72ef4073c6b4
SHA512 e4f7c776c13aed85dec6a6949c3e42f5a963c7ef9bd39d84efaa8429df3d00f2de91ef3da0ada954d95898679d87ce090d62eedd2eb50e34a2fd0ebbd0644c82
SSDEEP 49152:w0OXFz9wvJpGVbokmjrYIk13/+rMtctYBPRNuoF:wVrwvJpGOkmjrYI63ByelDH
TLSH
T1671679DAAB7DB02FD371CB3552E4EE690D2CF5271310C9F7A25C00B5A66C4C1622AE5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-24_30d4241d68dbf391fa787490bfd4cad5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-08-24_30d4241d68dbf391fa787490bfd4cad5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-08-24_30d4241d68dbf391fa787490bfd4cad5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 9d8cc939fc85fb60844fe5c0f5ca700b
SHA256 91bc9f2c321456bd74ed46eee538e0afe0daf28a326e43f179f563ac7aeb4f3f
MD5 30d4241d68dbf391fa787490bfd4cad5
SHA1 e277c9cbdb9f4305fa506b0dce5b72ef4073c6b4
SHA512 e4f7c776c13aed85dec6a6949c3e42f5a963c7ef9bd39d84efaa8429df3d00f2de91ef3da0ada954d95898679d87ce090d62eedd2eb50e34a2fd0ebbd0644c82
SSDEEP 49152:w0OXFz9wvJpGVbokmjrYIk13/+rMtctYBPRNuoF:wVrwvJpGOkmjrYI63ByelDH
TLSH
T1671679DAAB7DB02FD371CB3552E4EE690D2CF5271310C9F7A25C00B5A66C4C1622AE5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4913

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcessId QueryPerformanceCounter TerminateProcess UnhandledExceptionFilter GetTickCount FreeLibrary MultiByteToWideChar SetLastError HeapAlloc LocalFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection WriteFile CreateFileW ExitProcess GetModuleFileNameW GetStdHandle GetStartupInfoW IsDebuggerPresent ReadFile RaiseException GetACP FormatMessageW GetFileType TlsGetValue GetModuleHandleA HeapReAlloc GetConsoleMode FlushFileBuffers TlsSetValue CreateEventW HeapSetInformation WriteConsoleW LoadLibraryW LoadLibraryExW TlsFree GetStringTypeW LCMapStringW InitializeCriticalSectionAndSpinCount GetOEMCP SetStdHandle IsProcessorFeaturePresent FindNextFileW IsValidCodePage DeleteFileW VirtualAlloc GetConsoleCP GetCommandLineA DecodePointer SetEndOfFile ResetEvent ReleaseMutex OutputDebugStringW EncodePointer lstrlenW GetModuleHandleExW UnmapViewOfFile GetExitCodeProcess ExpandEnvironmentStringsW

user32

TranslateMessage ShowWindow DestroyWindow ReleaseDC SetWindowLongW GetDlgItem GetDC GetWindowRect SendMessageW EnableWindow LoadCursorW GetParent SetWindowTextW SetTimer LoadIconW SetFocus SetForegroundWindow GetSysColor PeekMessageW EndPaint ScreenToClient KillTimer GetWindow GetWindowTextW SystemParametersInfoW MessageBoxA CharUpperW ClientToScreen

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-24_30d4241d68dbf391fa787490bfd4cad5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic