2026-09-17_064cecded59f75fcf9e379e9f1f29313_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-09-17_064cecded59f75fcf9e379e9f1f29313_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample260917-2y95cssz2r
SHA256 f4077154ecd2006b89250fda54380a470693ec171586e079d313ef38e2f39ce3
MD5 064cecded59f75fcf9e379e9f1f29313
SHA1 b52c98b21a2f077d447f0aff47c46c6caa993b92
SHA512 b1a646c781a2a871d15c07a20ce6cd1e1b7ff86fb38fe6e02f50a307c7a5df7e64e5af53d1a698151246e1b56369ff415d1c6abea8ca8f4219a21bc7d2d89338
SSDEEP 98304:999WaGozgMZTxgWJseFegKW60MV584WoiMWmxsxpPVrwvJpG:9maGo8MZ5qW6xV6WnWmexR
TLSH
T13616222AF5429072E4F130FA9977DA73892CAE305721A0CBB39205B45E642F16FF5E47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-17_064cecded59f75fcf9e379e9f1f29313_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-09-17_064cecded59f75fcf9e379e9f1f29313_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-09-17_064cecded59f75fcf9e379e9f1f29313_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 6690b106cd36789c0e185509b6c60aae
SHA256 f4077154ecd2006b89250fda54380a470693ec171586e079d313ef38e2f39ce3
MD5 064cecded59f75fcf9e379e9f1f29313
SHA1 b52c98b21a2f077d447f0aff47c46c6caa993b92
SHA512 b1a646c781a2a871d15c07a20ce6cd1e1b7ff86fb38fe6e02f50a307c7a5df7e64e5af53d1a698151246e1b56369ff415d1c6abea8ca8f4219a21bc7d2d89338
SSDEEP 98304:999WaGozgMZTxgWJseFegKW60MV584WoiMWmxsxpPVrwvJpG:9maGo8MZ5qW6xV6WnWmexR
TLSH
T13616222AF5429072E4F130FA9977DA73892CAE305721A0CBB39205B45E642F16FF5E47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10125

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError GetCurrentProcess SetUnhandledExceptionFilter GetModuleHandleW QueryPerformanceCounter GetProcAddress Sleep GetTickCount FreeLibrary MultiByteToWideChar WideCharToMultiByte SetLastError HeapAlloc LocalFree EnterCriticalSection WriteFile WaitForSingleObject GetProcessHeap CreateFileW GetStdHandle GetStartupInfoW FindClose GetACP FormatMessageW GetFileType TlsGetValue InitializeCriticalSection FlushFileBuffers TlsAlloc HeapSize WriteConsoleW GetCPInfo TlsFree CompareStringW GetStringTypeW LCMapStringW InitializeCriticalSectionAndSpinCount GetOEMCP GetEnvironmentStringsW SetStdHandle FreeEnvironmentStringsW IsProcessorFeaturePresent FindNextFileW VirtualAlloc LocalAlloc GetCommandLineA DecodePointer SetEndOfFile ResetEvent GetVersionExW OutputDebugStringW GetFileSize lstrlenW LoadLibraryA GetModuleHandleExW GetLocaleInfoW CreateDirectoryW GetFullPathNameW UnmapViewOfFile GetExitCodeProcess ExpandEnvironmentStringsW

user32

TranslateMessage LoadStringW DestroyWindow ReleaseDC DefWindowProcW MessageBoxW CreateWindowExW GetWindowLongW GetMessageW GetDlgItem GetSystemMetrics EnableWindow IsWindow EndDialog SetFocus SetForegroundWindow PeekMessageW ScreenToClient SetCursor InvalidateRect RegisterClassW EnableMenuItem MessageBoxA ClientToScreen

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-17_064cecded59f75fcf9e379e9f1f29313_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic