2026-09-08_8e5b53881021be9d033dba1cbc05f7f1_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-09-08_8e5b53881021be9d033dba1cbc05f7f1_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample260910-erkvkafm2s
SHA256 5bb0a220a591d8ec0b4c2ebad440f36f0ec406f550a21251d9976f089ccd1e85
MD5 8e5b53881021be9d033dba1cbc05f7f1
SHA1 8c1ef206bef790378f29954535b65ac055e96e63
SHA512 0c2ed5fe9fdb1d60878d2089dbf2eae62d9beab1597bb270a332538861c3f4c238645e0ac5650d6780d2ef672ca35cac1206673f2177e7d261a602102137f3f6
SSDEEP 98304:1VrwvJpGLFu+BLGhdiGZ0Zbj7t2c9HfFw8szJ4w/0mFu:1htGhdH2Z3tVHf68sSwF
TLSH
T13B161262B241D833F4EA113593BF8B72DA2CF120332896C757979AB89E647D37237611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_8e5b53881021be9d033dba1cbc05f7f1_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-09-08_8e5b53881021be9d033dba1cbc05f7f1_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-09-08_8e5b53881021be9d033dba1cbc05f7f1_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH a9bd62b9dcd2ce5b9003e3c28d8bfb10
SHA256 5bb0a220a591d8ec0b4c2ebad440f36f0ec406f550a21251d9976f089ccd1e85
MD5 8e5b53881021be9d033dba1cbc05f7f1
SHA1 8c1ef206bef790378f29954535b65ac055e96e63
SHA512 0c2ed5fe9fdb1d60878d2089dbf2eae62d9beab1597bb270a332538861c3f4c238645e0ac5650d6780d2ef672ca35cac1206673f2177e7d261a602102137f3f6
SSDEEP 98304:1VrwvJpGLFu+BLGhdiGZ0Zbj7t2c9HfFw8szJ4w/0mFu:1htGhdH2Z3tVHf68sSwF
TLSH
T13B161262B241D833F4EA113593BF8B72DA2CF120332896C757979AB89E647D37237611
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

633239

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcess GetCurrentProcessId SetUnhandledExceptionFilter GetModuleHandleW CloseHandle TerminateProcess UnhandledExceptionFilter FreeLibrary MultiByteToWideChar WideCharToMultiByte SetLastError LocalFree DeleteCriticalSection EnterCriticalSection WriteFile WaitForSingleObject CreateFileW ExitProcess RaiseException GetACP FormatMessageW GetModuleHandleA InitializeCriticalSection HeapReAlloc GetConsoleMode FlushFileBuffers CreateEventW TlsAlloc HeapSetInformation HeapSize LoadLibraryExW GetCPInfo SetFilePointer GetStringTypeW RtlUnwind InitializeCriticalSectionAndSpinCount GetOEMCP SetStdHandle FindNextFileW DeleteFileW GetConsoleCP LocalAlloc SetEndOfFile ResetEvent ReleaseMutex lstrlenW GetModuleHandleExW CreateDirectoryW GetFullPathNameW LoadResource UnmapViewOfFile ExpandEnvironmentStringsW CreateProcessW

user32

LoadStringW ShowWindow DestroyWindow DefWindowProcW MessageBoxW CreateWindowExW GetDC SendMessageW GetClientRect SetWindowPos SetWindowTextW SetTimer SetFocus GetSysColor PeekMessageW BeginPaint SetCursor RegisterClassW GetWindowTextW UpdateWindow MessageBoxA CharUpperW ClientToScreen

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_8e5b53881021be9d033dba1cbc05f7f1_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic