2026-09-22_1157b14da511a50044f07139ea93c904_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-09-22_1157b14da511a50044f07139ea93c904_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample260922-2b7qqagg38
SHA256 86f59ebded58536839cdf6dcb94887698a2757700c39440eaf848d24d69b250f
MD5 1157b14da511a50044f07139ea93c904
SHA1 436ea0dd92c5687629af846250b3a7d32fa38c97
SHA512 c32dd048508a8caa832ed3c414e8d471be024e6e51ef15fd8525aa528e3cfb963f7ff1c6243810307c424577744c025f9c06e80d125a405e1b410cbc5d8093ef
SSDEEP 49152:MeUkG6XzzVsTQs3aQTo+6vaRX0Yjj4/vH6aJusyq0OXFz9wvJpGVb:XGI/KTQsDU+6vJYjjQaaudqVrwvJpG
TLSH
T1EF16BE23F50BEF25E1910C7DD7AEFA674AD99930AF244DF367960056996C8D32330A32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-22_1157b14da511a50044f07139ea93c904_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-09-22_1157b14da511a50044f07139ea93c904_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-09-22_1157b14da511a50044f07139ea93c904_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 29f986e24e3754c40d23a5fcff25a393
SHA256 86f59ebded58536839cdf6dcb94887698a2757700c39440eaf848d24d69b250f
MD5 1157b14da511a50044f07139ea93c904
SHA1 436ea0dd92c5687629af846250b3a7d32fa38c97
SHA512 c32dd048508a8caa832ed3c414e8d471be024e6e51ef15fd8525aa528e3cfb963f7ff1c6243810307c424577744c025f9c06e80d125a405e1b410cbc5d8093ef
SSDEEP 49152:MeUkG6XzzVsTQs3aQTo+6vaRX0Yjj4/vH6aJusyq0OXFz9wvJpGVb:XGI/KTQsDU+6vJYjjQaaudqVrwvJpG
TLSH
T1EF16BE23F50BEF25E1910C7DD7AEFA674AD99930AF244DF367960056996C8D32330A32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5018

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetProcAddress TerminateProcess Sleep FreeLibrary WideCharToMultiByte HeapFree LocalFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection ExitProcess GetModuleFileNameW GetStdHandle IsDebuggerPresent GetCommandLineW FindClose SetEvent FormatMessageW GetFileType GetModuleHandleA InitializeCriticalSection HeapReAlloc GetConsoleMode FlushFileBuffers TlsSetValue CreateEventW TlsAlloc HeapSetInformation WriteConsoleW LoadLibraryExW CreateThread GetFileAttributesW CompareStringW GetStringTypeW GetOEMCP SetStdHandle FreeEnvironmentStringsW IsProcessorFeaturePresent VirtualAlloc GetConsoleCP LocalAlloc GetCommandLineA DecodePointer SetEndOfFile GetVersionExW ReleaseMutex CreateFileA VirtualFree lstrlenW LoadLibraryA GetLocaleInfoW GetFullPathNameW LoadResource UnmapViewOfFile CreateProcessW

user32

LoadStringW DispatchMessageW DestroyWindow DefWindowProcW CreateWindowExW GetWindowLongW GetMessageW GetDC PostMessageW SendMessageW GetClientRect SetWindowPos EndDialog LoadIconW GetSysColor BeginPaint SetCursor KillTimer InvalidateRect EnableMenuItem GetWindow GetKeyState ClientToScreen

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-22_1157b14da511a50044f07139ea93c904_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic