2026-08-30_e26fe25b500a4f0647fa559ea156a179_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-08-30_e26fe25b500a4f0647fa559ea156a179_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample260831-cv736atdph
SHA256 bf2d5ba8f31e378ad84d2fba10b39a2d126052009e8b937e8971a0f53cb953c0
MD5 e26fe25b500a4f0647fa559ea156a179
SHA1 ff8463a2cd71f19c36e40aca26abee45e63c198c
SHA512 a0fad00d6cb3e70e1caf30e3fa46c477d2f5ab2c3d9f39a46e2c2101d54ac55dfb46532c2cc02c916ba12c237d497a65ab1bef210b5f4fa4ad1d8ffc936e933f
SSDEEP 49152:8XnCbVmDzFsjfsrkng4UHbJUrFCgjK0OXFz9wvJpGVb:8XOIzSbUHbKrFCgjKVrwvJpG
TLSH
T12D16CE2266CEF063E1D1043A52678A7D1EB85E3BD3D08CDFA69214A5AD1C8F17E35F42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-30_e26fe25b500a4f0647fa559ea156a179_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-08-30_e26fe25b500a4f0647fa559ea156a179_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-08-30_e26fe25b500a4f0647fa559ea156a179_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH b2400c7e5628373efe9df6ac67ec076a
SHA256 bf2d5ba8f31e378ad84d2fba10b39a2d126052009e8b937e8971a0f53cb953c0
MD5 e26fe25b500a4f0647fa559ea156a179
SHA1 ff8463a2cd71f19c36e40aca26abee45e63c198c
SHA512 a0fad00d6cb3e70e1caf30e3fa46c477d2f5ab2c3d9f39a46e2c2101d54ac55dfb46532c2cc02c916ba12c237d497a65ab1bef210b5f4fa4ad1d8ffc936e933f
SSDEEP 49152:8XnCbVmDzFsjfsrkng4UHbJUrFCgjK0OXFz9wvJpGVb:8XOIzSbUHbKrFCgjKVrwvJpG
TLSH
T12D16CE2266CEF063E1D1043A52678A7D1EB85E3BD3D08CDFA69214A5AD1C8F17E35F42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

3549701

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError GetCurrentThreadId GetCurrentProcess GetSystemTimeAsFileTime GetModuleHandleW Sleep FreeLibrary MultiByteToWideChar WideCharToMultiByte HeapFree HeapAlloc LeaveCriticalSection EnterCriticalSection WriteFile GetProcessHeap CreateFileW GetModuleFileNameW GetStdHandle IsDebuggerPresent GetCommandLineW FindClose GetACP GetFileType TlsGetValue InitializeCriticalSection GetConsoleMode CreateEventW HeapSetInformation WriteConsoleW CreateThread SetFilePointer GetFileAttributesW SetStdHandle FreeEnvironmentStringsW FindFirstFileW DeleteFileW VirtualAlloc GetConsoleCP LocalAlloc GetCommandLineA DecodePointer ResetEvent ReleaseMutex OutputDebugStringW GetFileSize VirtualFree lstrlenW LoadLibraryA GetModuleHandleExW LoadResource UnmapViewOfFile ExpandEnvironmentStringsW CreateProcessW

user32

TranslateMessage DispatchMessageW ReleaseDC MessageBoxW CreateWindowExW SetWindowLongW GetWindowLongW PostMessageW GetClientRect EnableWindow LoadCursorW GetParent EndDialog LoadIconW SetFocus GetSysColor EndPaint ScreenToClient EnableMenuItem GetWindow UpdateWindow CharUpperW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-30_e26fe25b500a4f0647fa559ea156a179_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic