2026-09-29_8eceed75d1e05a2f83dd48ae66dc332a_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-09-29_8eceed75d1e05a2f83dd48ae66dc332a_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample260929-zbtsraswcs
SHA256 4bf0ae00a9cdea315765a69f34fd7a6332dc8e7aaaf5d4e07a45e141963ab9c8
MD5 8eceed75d1e05a2f83dd48ae66dc332a
SHA1 a409e6204923750c45bb67ca0ca41caae66675e4
SHA512 8da8b3c20199689e4b2dbde4bd93a8b0ba1b14354661f6d9eef182e2c2c0c9c92e4008e51b2c0c449395be08268f0e369b98255aedfff3626250be78428ffdbb
SSDEEP 98304:zLIiMv9OnGYvvVc4uynFnlfAAx1yYP3xvNgOEe58Y7e+l+VrwvJpG:zLBjc4VjoAxBBv2OEe58a8
TLSH
T115161211F4C094B3F1D638B692684B3E8A3C75361F2DB4D753A444FD3AE06E2A63D686
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_8eceed75d1e05a2f83dd48ae66dc332a_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-09-29_8eceed75d1e05a2f83dd48ae66dc332a_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-09-29_8eceed75d1e05a2f83dd48ae66dc332a_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 8f37f6e6032822b5d2e830ccacb1c21c
SHA256 4bf0ae00a9cdea315765a69f34fd7a6332dc8e7aaaf5d4e07a45e141963ab9c8
MD5 8eceed75d1e05a2f83dd48ae66dc332a
SHA1 a409e6204923750c45bb67ca0ca41caae66675e4
SHA512 8da8b3c20199689e4b2dbde4bd93a8b0ba1b14354661f6d9eef182e2c2c0c9c92e4008e51b2c0c449395be08268f0e369b98255aedfff3626250be78428ffdbb
SSDEEP 98304:zLIiMv9OnGYvvVc4uynFnlfAAx1yYP3xvNgOEe58Y7e+l+VrwvJpG:zLBjc4VjoAxBBv2OEe58a8
TLSH
T115161211F4C094B3F1D638B692684B3E8A3C75361F2DB4D753A444FD3AE06E2A63D686
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4240

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError GetCurrentThreadId GetCurrentProcess GetSystemTimeAsFileTime SetUnhandledExceptionFilter GetProcAddress TerminateProcess Sleep GetTickCount FreeLibrary WideCharToMultiByte SetLastError HeapFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection WaitForSingleObject GetProcessHeap CreateFileW ExitProcess GetStdHandle IsDebuggerPresent FindClose SetEvent TlsGetValue GetModuleHandleA HeapReAlloc FlushFileBuffers TlsSetValue HeapSize WriteConsoleW LoadLibraryW LoadLibraryExW CreateThread GetCPInfo TlsFree GetFileAttributesW CompareStringW GetModuleFileNameA GetEnvironmentStringsW SetStdHandle FreeEnvironmentStringsW FindNextFileW VirtualAlloc GetCommandLineA SetEndOfFile ReleaseMutex CreateFileA OutputDebugStringW GetFileSize EncodePointer VirtualFree lstrlenW GetModuleHandleExW GetFullPathNameW GetExitCodeProcess ExpandEnvironmentStringsW

user32

TranslateMessage LoadStringW ShowWindow ReleaseDC DefWindowProcW MessageBoxW PostQuitMessage CreateWindowExW SetWindowLongW GetWindowLongW GetDlgItem GetSystemMetrics PostMessageW SendMessageW GetClientRect LoadCursorW GetParent SetFocus PeekMessageW BeginPaint ScreenToClient SetCursor KillTimer UpdateWindow SystemParametersInfoW MessageBoxA ClientToScreen

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_8eceed75d1e05a2f83dd48ae66dc332a_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic