2026-09-24_17002922a14c16ccfa862b3584c060a9_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-09-24_17002922a14c16ccfa862b3584c060a9_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample260925-rpea8aef72
SHA256 902d624b8fc47b676add489eda856b590db35bb7d5e4eafbe50638f1fa9a9425
MD5 17002922a14c16ccfa862b3584c060a9
SHA1 fef95a44865ac5e87c01f7e45fdfdbace7d82eb7
SHA512 caf29746e939fe58aec0fca1ee41e29fda19addcb08baced5062efe3f8be405ab20a0cfe94235f5fa696e44f74e606464fb45767073ff8aa130f63cf01209d65
SSDEEP 98304:8u5Ai9sn7wyz7q1kBGE0kMO/FTv+/71Lk88CnHVrwvJpG:8uCi9sns3kHd/FTvKRLkHCH
TLSH
T13C1612A16981F0B3E65B4CBCD0AF9AFE4B281531533750CBE3D425B26A600D1AB3DF65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_17002922a14c16ccfa862b3584c060a9_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-09-24_17002922a14c16ccfa862b3584c060a9_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-09-24_17002922a14c16ccfa862b3584c060a9_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH b189046f9e35cae2a716e0cd215e4ef5
SHA256 902d624b8fc47b676add489eda856b590db35bb7d5e4eafbe50638f1fa9a9425
MD5 17002922a14c16ccfa862b3584c060a9
SHA1 fef95a44865ac5e87c01f7e45fdfdbace7d82eb7
SHA512 caf29746e939fe58aec0fca1ee41e29fda19addcb08baced5062efe3f8be405ab20a0cfe94235f5fa696e44f74e606464fb45767073ff8aa130f63cf01209d65
SSDEEP 98304:8u5Ai9sn7wyz7q1kBGE0kMO/FTv+/71Lk88CnHVrwvJpG:8uCi9sns3kHd/FTvKRLkHCH
TLSH
T13C1612A16981F0B3E65B4CBCD0AF9AFE4B281531533750CBE3D425B26A600D1AB3DF65
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4183157

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError GetCurrentThreadId GetSystemTimeAsFileTime SetUnhandledExceptionFilter GetModuleHandleW GetProcAddress CloseHandle UnhandledExceptionFilter Sleep FreeLibrary MultiByteToWideChar WideCharToMultiByte LocalFree LeaveCriticalSection EnterCriticalSection WaitForSingleObject CreateFileW GetStdHandle IsDebuggerPresent FindClose SetEvent GetFileType TlsGetValue HeapSetInformation HeapSize CreateThread GetCPInfo TlsFree SetFilePointer GetFileAttributesW CompareStringW GetStringTypeW LCMapStringW InitializeCriticalSectionAndSpinCount GetEnvironmentStringsW SetStdHandle IsProcessorFeaturePresent FindNextFileW IsValidCodePage FindFirstFileW LocalAlloc GetCommandLineA SetEndOfFile ResetEvent GetVersionExW CreateFileA EncodePointer lstrlenW GetModuleHandleExW GetLocaleInfoW CreateDirectoryW CreateProcessW

user32

LoadStringW ShowWindow ReleaseDC DefWindowProcW MessageBoxW SetWindowLongW GetWindowLongW GetDlgItem GetDC PostMessageW IsWindow LoadCursorW EndDialog SetFocus ScreenToClient SetCursor KillTimer InvalidateRect UpdateWindow SystemParametersInfoW GetKeyState CharUpperW ClientToScreen

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_17002922a14c16ccfa862b3584c060a9_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic