2026-09-29_54df3bf4edd8e8d08809ca68b0f831ba_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-09-29_54df3bf4edd8e8d08809ca68b0f831ba_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample260930-a8dqcsvclb
SHA256 3b85bc71801a4fc75c8c3cf3605b676db95d994a49cec0f982bfb177a1757c30
MD5 54df3bf4edd8e8d08809ca68b0f831ba
SHA1 2db9b7b64c2e539f25e24e815308a5195a3d5bd7
SHA512 3b898fcb9d5929224708dba68663d6d90f3ae0f57183d2c96ba525543d8de47fe71f0df6e751ab65ea1df7932a128b5671a1063fa8ee8d4d27cb793b1acc92e1
SSDEEP 98304:aCwC32BPGEyf5RLtJSeG2uxyWcuVFNieYdeVAZ6JjnPVrwvJpG:D1CP+fLLvSeaPVPiWSM
TLSH
T16E161221F446C03AE892247DB2B587B75B3C6734577688D7A7B014AFEB944F23335A22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_54df3bf4edd8e8d08809ca68b0f831ba_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-09-29_54df3bf4edd8e8d08809ca68b0f831ba_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-09-29_54df3bf4edd8e8d08809ca68b0f831ba_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 8c828a28d447711099d1cb0c6f646dfb
SHA256 3b85bc71801a4fc75c8c3cf3605b676db95d994a49cec0f982bfb177a1757c30
MD5 54df3bf4edd8e8d08809ca68b0f831ba
SHA1 2db9b7b64c2e539f25e24e815308a5195a3d5bd7
SHA512 3b898fcb9d5929224708dba68663d6d90f3ae0f57183d2c96ba525543d8de47fe71f0df6e751ab65ea1df7932a128b5671a1063fa8ee8d4d27cb793b1acc92e1
SSDEEP 98304:aCwC32BPGEyf5RLtJSeG2uxyWcuVFNieYdeVAZ6JjnPVrwvJpG:D1CP+fLLvSeaPVPiWSM
TLSH
T16E161221F446C03AE892247DB2B587B75B3C6734577688D7A7B014AFEB944F23335A22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

3555485

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentThreadId GetCurrentProcessId SetUnhandledExceptionFilter GetModuleHandleW CloseHandle WideCharToMultiByte SetLastError LocalFree LeaveCriticalSection EnterCriticalSection WriteFile WaitForSingleObject GetProcessHeap ExitProcess GetModuleFileNameW GetStdHandle IsDebuggerPresent GetCommandLineW RaiseException GetFileType GetModuleHandleA InitializeCriticalSection HeapReAlloc GetConsoleMode TlsSetValue CreateEventW TlsAlloc HeapSetInformation WriteConsoleW LoadLibraryW LoadLibraryExW GetCPInfo TlsFree SetFilePointer CompareStringW GetStringTypeW RtlUnwind LCMapStringW SetStdHandle IsValidCodePage DeleteFileW SetEndOfFile GetVersionExW ReleaseMutex OutputDebugStringW VirtualFree GetLocaleInfoW GetFullPathNameW LoadResource UnmapViewOfFile GetExitCodeProcess ExpandEnvironmentStringsW CreateProcessW

user32

TranslateMessage MessageBoxW PostQuitMessage GetWindowLongW GetDlgItem GetSystemMetrics GetDC SendMessageW GetClientRect SetWindowPos IsWindow GetParent EndDialog SetWindowTextW SetForegroundWindow GetSysColor PeekMessageW EndPaint KillTimer RegisterClassW EnableMenuItem GetWindow GetWindowTextW SystemParametersInfoW ClientToScreen

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_54df3bf4edd8e8d08809ca68b0f831ba_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic