2026-09-29_2143262a28f1e26bf806c4b8b6003d87_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-09-29_2143262a28f1e26bf806c4b8b6003d87_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample260930-e3w2zasy4p
SHA256 59c7a8f8c6d202e27de15c737f23681d79beb5221ac6138b250b9b35d3991cf5
MD5 2143262a28f1e26bf806c4b8b6003d87
SHA1 2c71cf00c69eb3fc6b990c5bb1ce3149308dc7a7
SHA512 0caf7811d6a5570e0542b1e106793bbb83a93859e582bab30c5078256b8a2e7518e54725664bc8daec90ada219bb5ef949e5920bf4d796893a85b448b7d02a43
SSDEEP 98304:p1MtaxIUekl0R50znHS8FyKbRHG40ft0zQWYvZR2nVrwvJpG:fWaxu5CzHH1010zTYBUn
TLSH
T1261612236042B0BBF3E20575EE65C7B3693D5225632DF7CB62C030B8D6A44D6AF38656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_2143262a28f1e26bf806c4b8b6003d87_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-09-29_2143262a28f1e26bf806c4b8b6003d87_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-09-29_2143262a28f1e26bf806c4b8b6003d87_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 76f9a88f141c6ddd13b14c3e762a1370
SHA256 59c7a8f8c6d202e27de15c737f23681d79beb5221ac6138b250b9b35d3991cf5
MD5 2143262a28f1e26bf806c4b8b6003d87
SHA1 2c71cf00c69eb3fc6b990c5bb1ce3149308dc7a7
SHA512 0caf7811d6a5570e0542b1e106793bbb83a93859e582bab30c5078256b8a2e7518e54725664bc8daec90ada219bb5ef949e5920bf4d796893a85b448b7d02a43
SSDEEP 98304:p1MtaxIUekl0R50znHS8FyKbRHG40ft0zQWYvZR2nVrwvJpG:fWaxu5CzHH1010zTYBUn
TLSH
T1261612236042B0BBF3E20575EE65C7B3693D5225632DF7CB62C030B8D6A44D6AF38656
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4181364

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError GetCurrentProcessId GetModuleHandleW QueryPerformanceCounter GetProcAddress TerminateProcess GetTickCount MultiByteToWideChar HeapFree HeapAlloc LocalFree LeaveCriticalSection EnterCriticalSection WriteFile GetProcessHeap ExitProcess GetModuleFileNameW GetStdHandle GetStartupInfoW IsDebuggerPresent GetCommandLineW FindClose SetEvent GetACP GetFileType TlsGetValue GetModuleHandleA HeapReAlloc TlsSetValue TlsAlloc WriteConsoleW LoadLibraryExW CreateThread SetFilePointer GetFileAttributesW InitializeCriticalSectionAndSpinCount SetStdHandle IsProcessorFeaturePresent IsValidCodePage GetConsoleCP GetCommandLineA ResetEvent ReleaseMutex OutputDebugStringW LoadLibraryA GetLocaleInfoW LoadResource ExpandEnvironmentStringsW

user32

LoadStringW DispatchMessageW ShowWindow MessageBoxW PostQuitMessage SetWindowLongW GetWindowLongW GetMessageW GetDlgItem GetDC GetWindowRect PostMessageW GetClientRect SetWindowPos EnableWindow IsWindow LoadCursorW GetParent EndDialog SetWindowTextW SetForegroundWindow GetSysColor PeekMessageW InvalidateRect GetWindow UpdateWindow GetKeyState CharUpperW ClientToScreen

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_2143262a28f1e26bf806c4b8b6003d87_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic