2026-09-28_dae64fb5acc4006862c2a620a4a2d464_amadey_elex_glassworm_luca-stealer_medusalocker_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-28_dae64fb5acc4006862c2a620a4a2d464_amadey_elex_glassworm_luca-stealer_medusalocker_njrat_smoke-loader
Size 3.0MB
Sample260928-new7hattcv
SHA256 2bcb252dd4b336f7cd3ca8cb7c9215c9f08e7015478e4efa01c7e1e1a3094d9d
MD5 dae64fb5acc4006862c2a620a4a2d464
SHA1 8beee8e77aed4acd15c02fd139cae8b25a1a0d2b
SHA512 75114b5cb7baed11247a95d91ede9f7b98488d89d4c9f35ea0a62e401d5c54a53ef7b504ece26c6066f16bce41afaf6954a9dfb7a2e6f5923d38bed24702522e
SSDEEP 24576:I4nJeBbfeRigZLbPyn7dgnstF/LwjoENshWglnzB9YCt/I72UWJ0fMaLG:I4nJeBbWRiU7SJcjRNs395t/I6UWO5C
TLSH
T18AE5F694BA918127FCF3C2BE4AFE205D451CBEA0875854C3598836ED81B9AED3D31E17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_dae64fb5acc4006862c2a620a4a2d464_amadey_elex_glassworm_luca-stealer_medusalocker_njrat_smoke-loader

File Explorer

2026-09-28_dae64fb5acc4006862c2a620a4a2d464_amadey_elex_glassworm_luca-stealer_medusalocker_njrat_smoke-loader

.exe 3.0MB

2026-09-28_dae64fb5acc4006862c2a620a4a2d464_amadey_elex_glassworm_luca-stealer_medusalocker_njrat_smoke-loader

IMPHASH 6b1fea4ed0f5bc3868d026d86e8cfbda
SHA256 2bcb252dd4b336f7cd3ca8cb7c9215c9f08e7015478e4efa01c7e1e1a3094d9d
MD5 dae64fb5acc4006862c2a620a4a2d464
SHA1 8beee8e77aed4acd15c02fd139cae8b25a1a0d2b
SHA512 75114b5cb7baed11247a95d91ede9f7b98488d89d4c9f35ea0a62e401d5c54a53ef7b504ece26c6066f16bce41afaf6954a9dfb7a2e6f5923d38bed24702522e
SSDEEP 24576:I4nJeBbfeRigZLbPyn7dgnstF/LwjoENshWglnzB9YCt/I72UWJ0fMaLG:I4nJeBbWRiU7SJcjRNs395t/I6UWO5C
TLSH
T18AE5F694BA918127FCF3C2BE4AFE205D451CBEA0875854C3598836ED81B9AED3D31E17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39441

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle GetModuleHandleA GetProcAddress LoadLibraryA Sleep CreateConsoleScreenBuffer SetConsoleActiveScreenBuffer WriteConsoleOutputCharacterW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation ReadConsoleW ReadFile GetConsoleMode GetConsoleCP FlushFileBuffers SetFilePointerEx GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW EncodePointer DecodePointer RaiseException GetLastError FormatMessageW WideCharToMultiByte DuplicateHandle WaitForSingleObjectEx GetCurrentProcess SwitchToThread GetCurrentThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection QueueUserWorkItem GetModuleHandleExW RtlCaptureStackBackTrace IsProcessorFeaturePresent SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW QueryPerformanceCounter QueryPerformanceFrequency MultiByteToWideChar CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo SetEvent ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait OutputDebugStringW GetThreadTimes FreeLibraryAndExitThread GetModuleFileNameW LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree SetProcessAffinityMask ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx WaitForMultipleObjectsEx LoadLibraryW WaitForSingleObject RtlUnwind ExitProcess HeapValidate GetSystemInfo ExitThread ResumeThread GetStdHandle WriteFile GetFileType WriteConsoleW SetConsoleCtrlHandler HeapReAlloc HeapSize HeapQueryInformation GetExitCodeProcess CreateProcessW GetFileAttributesExW CreateFileW

user32

LoadCursorW FindWindowA MessageBoxA EndPaint BeginPaint UpdateWindow TranslateAcceleratorW LoadAcceleratorsW EndDialog DialogBoxParamW LoadIconW DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PostMessageA DispatchMessageW TranslateMessage GetMessageW LoadStringW GetAsyncKeyState ShowWindow

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

402KB

Virtual Size

401KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

260B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

737KB

Virtual Size

737KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_dae64fb5acc4006862c2a620a4a2d464_amadey_elex_glassworm_luca-stealer_medusalocker_njrat_smoke-loader

kernel32

user32

generic