c11284281410b9feb6e5bf49f307cbb4349b6b858d1bfc3afb4bea633fd13976

General

Target
2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Size 22.7MB
Sample260828-l6caasce52
SHA256 c11284281410b9feb6e5bf49f307cbb4349b6b858d1bfc3afb4bea633fd13976
MD5 b0e4759c4f562f09f3ec47e8c395c1f1
SHA1 92cc7c99866f509b9ec66a88bdfaa3dc797acdb5
SHA512 a0b607b295ff079cdc8fc51eb45547dd7c3f7780c6c70381f1deb8d04f8dbfcd4a3d965f5644cc0cf2c2e3066109d28c548e8fde330a60af1077d25174dbdf0e
SSDEEP 393216:WZEpxEUEbkJsHHeXh5dBcGbyiH1fxHszks6fRS2/AzV30I1D7+g+O/GLKISGH1CM:WdkJsHHeXh5dBcGbtTszkrcfzV30I1DD
TLSH
T11037BED99251F844E7A10CF0251A63E147431A353B25CAEDBF4357DE2F3858AAEB0E39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Directory\shellex\DragDropHandlers\7-Zip	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Drive\shellex	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\7zip\\7-zip.dll"	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Folder	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Folder\shellex\ContextMenuHandlers\7-Zip	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Drive\shellex\DragDropHandlers\7-Zip	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\7zip\\7-zip32.dll"	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\*\shellex\ContextMenuHandlers\7-Zip	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Drive\shellex\DragDropHandlers	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Directory\shellex\ContextMenuHandlers\7-Zip	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Folder\shellex	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Folder\shellex\ContextMenuHandlers	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Drive	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Directory\shellex\DragDropHandlers	2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_b0e4759c4f562f09f3ec47e8c395c1f1_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4876