Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/09/2026, 21:55
Static task
static1
Behavioral task
behavioral1
Sample
2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
- Size 39.8MB
- Sample260920-1srkdstthx
- SHA256 a5481bd17c799f1bec2c122a0fafc0b40978dd08f7fd8211e0567441312736fd
- MD5 fc09f4a9a117ce80cb80892d7aa49c75
- SHA1 67d5daaccf4f995838024de3075a4ad1530e31df
- SHA512 1502d5eb045c5cb4c2c8d2e57380fd9b53adb36e0aceb4b76e34ac3976c953311cb0f1924c8509828e3a278a09c9df0adb7963c47c7eb030a3478884a324a3b8
- SSDEEP 786432:5hkPURhsg8WCZzJvwHBtlSen0oUiCc4cwcs1j5/C0YgyJjF:51RhmWIJvwHAZoi9xcsznWF
- TLSH T19197330B3E960436D9BE0F7618B69B10AF356D049A35C24E27A5B54CEEF07D086B23D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe File opened (read-only) \??\Q: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe File opened (read-only) \??\T: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe File opened (read-only) \??\W: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe File opened (read-only) \??\X: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe File opened (read-only) \??\D: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe File opened (read-only) \??\M: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe File opened (read-only) \??\O: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe File opened (read-only) \??\R: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe File opened (read-only) \??\Y: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe File opened (read-only) \??\A: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe File opened (read-only) \??\G: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe File opened (read-only) \??\H: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe File opened (read-only) \??\I: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe File opened (read-only) \??\K: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe File opened (read-only) \??\N: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe File opened (read-only) \??\P: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe File opened (read-only) \??\S: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe File opened (read-only) \??\J: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe File opened (read-only) \??\U: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe File opened (read-only) \??\V: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe File opened (read-only) \??\Z: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe File opened (read-only) \??\B: 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 944 msiexec.exe Token: SeCreateTokenPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeAssignPrimaryTokenPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeLockMemoryPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeIncreaseQuotaPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeMachineAccountPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeTcbPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeSecurityPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeTakeOwnershipPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeLoadDriverPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeSystemProfilePrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeSystemtimePrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeProfSingleProcessPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeIncBasePriorityPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeCreatePagefilePrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeCreatePermanentPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeBackupPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeRestorePrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeShutdownPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeAuditPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeSystemEnvironmentPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeChangeNotifyPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeRemoteShutdownPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeUndockPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeSyncAgentPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeEnableDelegationPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeManageVolumePrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeImpersonatePrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeCreateGlobalPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeCreateTokenPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeAssignPrimaryTokenPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeLockMemoryPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeIncreaseQuotaPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeMachineAccountPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeTcbPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeSecurityPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeTakeOwnershipPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeLoadDriverPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeSystemProfilePrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeSystemtimePrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeProfSingleProcessPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeIncBasePriorityPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeCreatePagefilePrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeCreatePermanentPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeBackupPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeRestorePrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeShutdownPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeAuditPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeSystemEnvironmentPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeChangeNotifyPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeRemoteShutdownPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeUndockPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeSyncAgentPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeEnableDelegationPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeManageVolumePrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeImpersonatePrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeCreateGlobalPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeCreateTokenPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeAssignPrimaryTokenPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeLockMemoryPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeIncreaseQuotaPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe Token: SeMachineAccountPrivilege 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe 2392 2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 944 msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-20_fc09f4a9a117ce80cb80892d7aa49c75_amadey_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2392
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:944
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Vibepollo\InstallerCache\fdb43b414fef3749f729bbc136ca1a3b2ef3545bad1bdeb0ad5366c0e4ae971c\Vibepollo.msi
- Size 39.5MB
- SHA256 fdb43b414fef3749f729bbc136ca1a3b2ef3545bad1bdeb0ad5366c0e4ae971c
- MD5 4862b45fd8634d384e95249843d4069e
- SHA1 544ce8a02a2c4e723d3976a09ad376f0b7c1f693
- SHA512 89b8b7dd57ec3b7385f61a65079012a65456fd68686ea0c977ffbf76418ed17948b58415e98732bfcdb4c917744a7851367a67554489ada232dc45de21cc63f3
- SSDEEP 786432:4hkPURhsg8WCZzJvwHBtlSen0oUiCc4cwcs1j5/C0YgyJjk:41RhmWIJvwHAZoi9xcsznWk
- TLSH T18497330F3D57047BC9AD0E7708B69B20EF396E049A65C14A67B5B60CFDF06E046B22D6
- MD5 SHA1 SHA512 SSDEEP TLSH