2026-09-29_a9da1471b256d40f0ffea704e85d8c24_amadey_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_a9da1471b256d40f0ffea704e85d8c24_amadey_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader
Size 5.6MB
Sample260930-v8c42sec26
SHA256 8e5d8f4351b78a1b05383c6c53ed6e393c72783e830e745ed89bd5db7951b0e3
MD5 a9da1471b256d40f0ffea704e85d8c24
SHA1 d911ecf15f106c390f7306bd0f8ce3b7c1c54a13
SHA512 11ac335d02cea314e666bf7a6000eef1b7c9c7b81141b9655172b5c8bcadf198658038de695afaf46785ce36b8e929cc0b20e8406a89870de323b2d062802723
SSDEEP 98304:JPJjzrZtnNrk1x+yhlqdjlBH7GWQOuwu2J2m7VHBU09cv8JVNFmQNvN:lV3WnqxHweHAv8J9v5N
TLSH
T18E56027726514121D0E28C36863BBEB5B1F812366B01B8FFB7D8D9C516310E1BAB26D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_a9da1471b256d40f0ffea704e85d8c24_amadey_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader

File Explorer

2026-09-29_a9da1471b256d40f0ffea704e85d8c24_amadey_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader

.exe 5.6MB

2026-09-29_a9da1471b256d40f0ffea704e85d8c24_amadey_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader

IMPHASH a353a96da712760de632e466a34de7c6
SHA256 8e5d8f4351b78a1b05383c6c53ed6e393c72783e830e745ed89bd5db7951b0e3
MD5 a9da1471b256d40f0ffea704e85d8c24
SHA1 d911ecf15f106c390f7306bd0f8ce3b7c1c54a13
SHA512 11ac335d02cea314e666bf7a6000eef1b7c9c7b81141b9655172b5c8bcadf198658038de695afaf46785ce36b8e929cc0b20e8406a89870de323b2d062802723
SSDEEP 98304:JPJjzrZtnNrk1x+yhlqdjlBH7GWQOuwu2J2m7VHBU09cv8JVNFmQNvN:lV3WnqxHweHAv8J9v5N
TLSH
T18E56027726514121D0E28C36863BBEB5B1F812366B01B8FFB7D8D9C516310E1BAB26D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3780969

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

K32EnumProcessModules K32GetModuleFileNameExA CreateFileA FindClose OutputDebugStringA GetLastError DeviceIoControl GetCurrentProcess LoadLibraryA MultiByteToWideChar DeleteFileA GetFileSize SetFilePointer WriteFile CreateMutexA GetModuleFileNameA lstrcpyA CopyFileA Module32Next Module32First Process32Next Process32First CreateToolhelp32Snapshot WideCharToMultiByte GetPrivateProfileStringA GetProcAddress GetModuleHandleA HeapSize WriteConsoleW DeleteFileW GetProcessHeap SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA GetFullPathNameW GetCurrentDirectoryW WriteProcessMemory VirtualProtectEx VirtualAllocEx GetTickCount OpenProcess CreateThread GetCurrentProcessId SetEndOfFile SetStdHandle GetFileAttributesExW FlushFileBuffers GetStringTypeW GetTimeZoneInformation LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapReAlloc Sleep DecodePointer HeapAlloc HeapFree GetConsoleCP ReadConsoleW GetConsoleMode GetACP ExitProcess SetFilePointerEx GetModuleHandleExW FreeLibraryAndExitThread ExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW CreateFileW EncodePointer LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind RaiseException InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetStartupInfoW IsDebuggerPresent CloseHandle IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetModuleHandleW CreateEventW ResetEvent SetEvent VerifyVersionInfoW VerSetConditionMask GetEnvironmentVariableA WaitForMultipleObjects PeekNamedPipe ReadFile GetFileType GetStdHandle WaitForSingleObjectEx MoveFileExA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx QueryPerformanceFrequency GetSystemDirectoryA FreeLibrary QueryPerformanceCounter SetLastError FormatMessageW GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers WriteConsoleW SetStdHandle IsProcessorFeaturePresent DecodePointer GetCommandLineA RaiseException HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringW GetStringTypeW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapSize WriteFile RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc VirtualQuery LocalAlloc LocalFree GetModuleFileNameW ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

LoadIconA LoadCursorA SetWindowLongA GetWindowLongA InflateRect GetSysColorBrush GetCursorPos GetClientRect SetForegroundWindow SetActiveWindow GetDlgItemTextA MessageBoxA GetMessageA TranslateMessage DispatchMessageA SendMessageA PostMessageA DefWindowProcA PostQuitMessage RegisterClassExA CreateWindowExA DestroyWindow ShowWindow MoveWindow CreateDialogParamA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu UpdateWindow SetDlgItemTextA CharUpperBuffW

gdi32

CreateFontA

advapi32

CryptEncrypt CryptDestroyKey LookupPrivilegeValueA GetTokenInformation AdjustTokenPrivileges OpenProcessToken CryptDestroyHash CryptHashData CryptImportKey CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptCreateHash

shell32

SHGetFolderPathA ShellExecuteA Shell_NotifyIconA

shlwapi

PathAppendA StrStrIA

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

iphlpapi

GetAdaptersInfo

ws2_32

send WSACloseEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError recv bind connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSASetLastError WSAIoctl WSAStartup WSACleanup __WSAFDIsSet select accept htonl listen getaddrinfo freeaddrinfo recvfrom sendto ioctlsocket gethostname WSACreateEvent

wldap32

ord27 ord32 ord33 ord26 ord79 ord22 ord41 ord50 ord60 ord30 ord200 ord301 ord211 ord46 ord217 ord35 ord143

Name

.text

Size

461KB

Virtual Size

460KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

300B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.#2|

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.z?C

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Te9

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_a9da1471b256d40f0ffea704e85d8c24_amadey_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader

kernel32

user32

gdi32

advapi32

shell32

shlwapi

version

iphlpapi

ws2_32

wldap32

generic