2026-09-30_9e7c6bcacf7b44f6a56299b941ae2d40_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-09-30_9e7c6bcacf7b44f6a56299b941ae2d40_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample261001-k56bbatxe1
SHA256 6d3243eb2622e7d77e0af9d637a70509f60074fdc0f294e44f593e40596cdb33
MD5 9e7c6bcacf7b44f6a56299b941ae2d40
SHA1 1c2e9d7af43fda37e9dde20988ecc0f4ff806ed7
SHA512 66fe1256d75e92853268a485054167908f7b68253bdc74c7add6d24f6d12bfdb841e78e542e3ea5e8199bc1adc9e5a9512eaf6def7b38d51ac4a403113145fec
SSDEEP 98304:p1MtaxIUekl0R50znHS8FyKbRHG40ft0zQWYvZR2zVrwvJpG:fWaxu5CzHH1010zTYBUz
TLSH
T1001612236042B0BBF3E20575EE65C7B3693D5225632DF7CB62C030B8D6A44D6AF38656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_9e7c6bcacf7b44f6a56299b941ae2d40_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-09-30_9e7c6bcacf7b44f6a56299b941ae2d40_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-09-30_9e7c6bcacf7b44f6a56299b941ae2d40_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 76f9a88f141c6ddd13b14c3e762a1370
SHA256 6d3243eb2622e7d77e0af9d637a70509f60074fdc0f294e44f593e40596cdb33
MD5 9e7c6bcacf7b44f6a56299b941ae2d40
SHA1 1c2e9d7af43fda37e9dde20988ecc0f4ff806ed7
SHA512 66fe1256d75e92853268a485054167908f7b68253bdc74c7add6d24f6d12bfdb841e78e542e3ea5e8199bc1adc9e5a9512eaf6def7b38d51ac4a403113145fec
SSDEEP 98304:p1MtaxIUekl0R50znHS8FyKbRHG40ft0zQWYvZR2zVrwvJpG:fWaxu5CzHH1010zTYBUz
TLSH
T1001612236042B0BBF3E20575EE65C7B3693D5225632DF7CB62C030B8D6A44D6AF38656
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4181364

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError GetCurrentProcessId GetModuleHandleW QueryPerformanceCounter GetProcAddress TerminateProcess GetTickCount MultiByteToWideChar HeapFree HeapAlloc LocalFree LeaveCriticalSection EnterCriticalSection WriteFile GetProcessHeap ExitProcess GetModuleFileNameW GetStdHandle GetStartupInfoW IsDebuggerPresent GetCommandLineW FindClose SetEvent GetACP GetFileType TlsGetValue GetModuleHandleA HeapReAlloc TlsSetValue TlsAlloc WriteConsoleW LoadLibraryExW CreateThread SetFilePointer GetFileAttributesW InitializeCriticalSectionAndSpinCount SetStdHandle IsProcessorFeaturePresent IsValidCodePage GetConsoleCP GetCommandLineA ResetEvent ReleaseMutex OutputDebugStringW LoadLibraryA GetLocaleInfoW LoadResource ExpandEnvironmentStringsW

user32

LoadStringW DispatchMessageW ShowWindow MessageBoxW PostQuitMessage SetWindowLongW GetWindowLongW GetMessageW GetDlgItem GetDC GetWindowRect PostMessageW GetClientRect SetWindowPos EnableWindow IsWindow LoadCursorW GetParent EndDialog SetWindowTextW SetForegroundWindow GetSysColor PeekMessageW InvalidateRect GetWindow UpdateWindow GetKeyState CharUpperW ClientToScreen

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_9e7c6bcacf7b44f6a56299b941ae2d40_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic