2026-09-04_2c25358578e477b92ab1f17b4af008c5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-09-04_2c25358578e477b92ab1f17b4af008c5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample260905-sxtasaef45
SHA256 23540c718132ea2e8ac8468b727bbe27a5a3e2c239f6477e26bd2334a24a91ef
MD5 2c25358578e477b92ab1f17b4af008c5
SHA1 73239cc936314150ce22feabbbd923fb7321f9c5
SHA512 a286c2862b7bdbc3a7c45bd89c7c0c52f106042a5944fc46c4479279336286e5b1af2b63600e83bd86aa17e5c837e5e0588c3db66d7aca7fdd4ece09f9182097
SSDEEP 98304:hVrwvJpGi39ifdMZ5g89wB1uHM0e+uPCcv7Wze2zsQ:hE39iVMZ5gum1GM3fW
TLSH
T1E61612B3A901987BF3DF10359366AB363A6D7A21131EE0D717D276B477606E2223074E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_2c25358578e477b92ab1f17b4af008c5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-09-04_2c25358578e477b92ab1f17b4af008c5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-09-04_2c25358578e477b92ab1f17b4af008c5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 12e0274d469e5d57623131e08f8832a0
SHA256 23540c718132ea2e8ac8468b727bbe27a5a3e2c239f6477e26bd2334a24a91ef
MD5 2c25358578e477b92ab1f17b4af008c5
SHA1 73239cc936314150ce22feabbbd923fb7321f9c5
SHA512 a286c2862b7bdbc3a7c45bd89c7c0c52f106042a5944fc46c4479279336286e5b1af2b63600e83bd86aa17e5c837e5e0588c3db66d7aca7fdd4ece09f9182097
SSDEEP 98304:hVrwvJpGi39ifdMZ5g89wB1uHM0e+uPCcv7Wze2zsQ:hE39iVMZ5gum1GM3fW
TLSH
T1E61612B3A901987BF3DF10359366AB363A6D7A21131EE0D717D276B477606E2223074E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

637190

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError GetCurrentProcess GetCurrentProcessId SetUnhandledExceptionFilter GetModuleHandleW GetProcAddress TerminateProcess UnhandledExceptionFilter FreeLibrary WideCharToMultiByte HeapFree DeleteCriticalSection LeaveCriticalSection WaitForSingleObject CreateFileW ExitProcess GetStdHandle IsDebuggerPresent ReadFile RaiseException GetACP FormatMessageW GetFileType GetModuleHandleA InitializeCriticalSection HeapReAlloc FlushFileBuffers TlsSetValue HeapSize WriteConsoleW CreateThread GetCPInfo GetFileAttributesW CompareStringW GetStringTypeW GetModuleFileNameA InitializeCriticalSectionAndSpinCount GetOEMCP GetEnvironmentStringsW SetStdHandle FreeEnvironmentStringsW FindNextFileW IsValidCodePage FindFirstFileW DeleteFileW VirtualAlloc GetFileSize lstrlenW LoadLibraryA CreateDirectoryW GetFullPathNameW UnmapViewOfFile GetExitCodeProcess ExpandEnvironmentStringsW CreateProcessW

user32

TranslateMessage LoadStringW DispatchMessageW DestroyWindow ReleaseDC DefWindowProcW CreateWindowExW SetWindowLongW GetDlgItem GetDC PostMessageW EnableWindow PeekMessageW ScreenToClient SetCursor KillTimer InvalidateRect RegisterClassW GetWindow GetWindowTextW SystemParametersInfoW MessageBoxA CharUpperW ClientToScreen

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_2c25358578e477b92ab1f17b4af008c5_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic