2026-09-29_1edce96f6a2dedacb57abca2b02b024c_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-09-29_1edce96f6a2dedacb57abca2b02b024c_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample260930-e934vstv6j
SHA256 c9b591988dc030b9b9e34e7243d00f88d60db624a603973dce790af969cd9f74
MD5 1edce96f6a2dedacb57abca2b02b024c
SHA1 f365f0515e28269ca7934dac0b6388b39b5b4f0c
SHA512 e9a71710052846f918a005634b66582d1a818b3d6c5a91992730e8ee7dfdcc4f74833aa4fed29ffb982aa254d87aa2337c7147676f6b82a64873d29d9c544d6f
SSDEEP 49152:E0OXFz9wvJpGVbDpUK36MTjTaXYp9B1uYgWzOmGg:EVrwvJpG5pUKKwjTaoVZt
TLSH
T16616BE216D81A17EE19300759B658FFACA7BF6203BD640C776C210A87D302D77A367E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_1edce96f6a2dedacb57abca2b02b024c_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-09-29_1edce96f6a2dedacb57abca2b02b024c_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-09-29_1edce96f6a2dedacb57abca2b02b024c_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH c467f2c373b7713d52a7623e7413a7cf
SHA256 c9b591988dc030b9b9e34e7243d00f88d60db624a603973dce790af969cd9f74
MD5 1edce96f6a2dedacb57abca2b02b024c
SHA1 f365f0515e28269ca7934dac0b6388b39b5b4f0c
SHA512 e9a71710052846f918a005634b66582d1a818b3d6c5a91992730e8ee7dfdcc4f74833aa4fed29ffb982aa254d87aa2337c7147676f6b82a64873d29d9c544d6f
SSDEEP 49152:E0OXFz9wvJpGVbDpUK36MTjTaXYp9B1uYgWzOmGg:EVrwvJpG5pUKKwjTaoVZt
TLSH
T16616BE216D81A17EE19300759B658FFACA7BF6203BD640C776C210A87D302D77A367E9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5316

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError GetCurrentThreadId GetCurrentProcess GetSystemTimeAsFileTime GetModuleHandleW QueryPerformanceCounter GetProcAddress CloseHandle TerminateProcess FreeLibrary MultiByteToWideChar SetLastError LocalFree DeleteCriticalSection LeaveCriticalSection WriteFile WaitForSingleObject GetProcessHeap CreateFileW ExitProcess GetModuleFileNameW GetStartupInfoW IsDebuggerPresent ReadFile RaiseException FormatMessageW HeapReAlloc GetConsoleMode TlsSetValue HeapSetInformation WriteConsoleW LoadLibraryExW GetCPInfo TlsFree GetFileAttributesW GetStringTypeW RtlUnwind LCMapStringW GetModuleFileNameA InitializeCriticalSectionAndSpinCount GetOEMCP GetEnvironmentStringsW SetStdHandle ResetEvent ReleaseMutex CreateFileA lstrlenW GetModuleHandleExW CreateDirectoryW LoadResource UnmapViewOfFile ExpandEnvironmentStringsW

user32

TranslateMessage DestroyWindow ReleaseDC DefWindowProcW PostQuitMessage GetWindowRect SendMessageW GetClientRect GetParent EndDialog SetWindowTextW LoadIconW SetFocus SetForegroundWindow PeekMessageW EndPaint SetCursor KillTimer RegisterClassW GetWindow UpdateWindow MessageBoxA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_1edce96f6a2dedacb57abca2b02b024c_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic