2026-10-01_b8a6eb078ab2cd42a00630c20c6455ed_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-10-01_b8a6eb078ab2cd42a00630c20c6455ed_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample261002-fd541shc69
SHA256 3c7a64a878b5dfd72a089cefec40214d80f3f4c5fdad0d43204c13d5cf7478b4
MD5 b8a6eb078ab2cd42a00630c20c6455ed
SHA1 8381f6c359750ae5210d4cc52bf6ea80f65b1990
SHA512 b86ca09d900c302d1a1c901a755198a47fdc7a4b1081d8bce2af40356264fd14f1aa6dc8f71a077ad255724fe7019bb2d06a6e54907a0bae7379d20e7990dd25
SSDEEP 49152:h0OXFz9wvJpGVb8OXC2bULk2FLFL3sEfdOBesIJpM3XT/7W:hVrwvJpGa2bEFLFw7W6C
TLSH
T16916AD62654D80F2E7BD10F5BCADBE6609285120232DC7C79FB55DEA9A20BC3233574E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_b8a6eb078ab2cd42a00630c20c6455ed_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-10-01_b8a6eb078ab2cd42a00630c20c6455ed_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-10-01_b8a6eb078ab2cd42a00630c20c6455ed_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH e73d8244ee728b1356b5ea1101006490
SHA256 3c7a64a878b5dfd72a089cefec40214d80f3f4c5fdad0d43204c13d5cf7478b4
MD5 b8a6eb078ab2cd42a00630c20c6455ed
SHA1 8381f6c359750ae5210d4cc52bf6ea80f65b1990
SHA512 b86ca09d900c302d1a1c901a755198a47fdc7a4b1081d8bce2af40356264fd14f1aa6dc8f71a077ad255724fe7019bb2d06a6e54907a0bae7379d20e7990dd25
SSDEEP 49152:h0OXFz9wvJpGVb8OXC2bULk2FLFL3sEfdOBesIJpM3XT/7W:hVrwvJpGa2bEFLFw7W6C
TLSH
T16916AD62654D80F2E7BD10F5BCADBE6609285120232DC7C79FB55DEA9A20BC3233574E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

632121

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError GetCurrentThreadId GetCurrentProcess GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleW QueryPerformanceCounter GetProcAddress CloseHandle UnhandledExceptionFilter Sleep FreeLibrary MultiByteToWideChar DeleteCriticalSection LeaveCriticalSection EnterCriticalSection WriteFile ExitProcess GetStdHandle GetStartupInfoW IsDebuggerPresent SetEvent FormatMessageW GetModuleHandleA InitializeCriticalSection GetConsoleMode TlsSetValue TlsAlloc HeapSize WriteConsoleW CreateThread GetCPInfo GetFileAttributesW GetStringTypeW RtlUnwind GetModuleFileNameA InitializeCriticalSectionAndSpinCount GetEnvironmentStringsW IsProcessorFeaturePresent FindFirstFileW VirtualAlloc LocalAlloc GetCommandLineA ResetEvent GetVersionExW ReleaseMutex OutputDebugStringW GetFileSize EncodePointer VirtualFree lstrlenW LoadLibraryA GetModuleHandleExW GetLocaleInfoW CreateDirectoryW GetFullPathNameW UnmapViewOfFile ExpandEnvironmentStringsW CreateProcessW

user32

TranslateMessage DispatchMessageW DestroyWindow ReleaseDC DefWindowProcW PostQuitMessage CreateWindowExW GetWindowLongW GetMessageW GetDlgItem GetWindowRect SendMessageW EnableWindow LoadCursorW SetWindowTextW SetTimer GetSysColor EndPaint BeginPaint SetCursor InvalidateRect RegisterClassW GetWindowTextW UpdateWindow GetKeyState CharUpperW ClientToScreen

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_b8a6eb078ab2cd42a00630c20c6455ed_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic