2026-10-04_ec37e9eddb508a4f13509064b93fbc93_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-10-04_ec37e9eddb508a4f13509064b93fbc93_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample261004-2tsphssx2l
SHA256 cf1ec5ffeb1c0b8621daf97a6707aef09741b3b489ad163bacb1c2f7e32f4e79
MD5 ec37e9eddb508a4f13509064b93fbc93
SHA1 dccf10522ee60950b1a1c69720dd8fdf5d031a71
SHA512 c702185542769f2e5007cec9e2a39f0b954486a981c68f1f62fc7e8081e81c00f47e519b62e997896ab8d19c635cdda6a9e88100cbf905b1a31be16f020e516d
SSDEEP 98304:vVrwvJpGABksqBiIqakpBe7W9kJ6B3mTpRrHjN4etK:v/sqBHqppY7W86B3mTpR14etK
TLSH
T167161271B902837EF1C60DBAA179D776FF2C65B3232490C79FB010B1A6600DABA75653
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-04_ec37e9eddb508a4f13509064b93fbc93_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-10-04_ec37e9eddb508a4f13509064b93fbc93_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-10-04_ec37e9eddb508a4f13509064b93fbc93_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH c2514cee6e5e1f31419af861ff897071
SHA256 cf1ec5ffeb1c0b8621daf97a6707aef09741b3b489ad163bacb1c2f7e32f4e79
MD5 ec37e9eddb508a4f13509064b93fbc93
SHA1 dccf10522ee60950b1a1c69720dd8fdf5d031a71
SHA512 c702185542769f2e5007cec9e2a39f0b954486a981c68f1f62fc7e8081e81c00f47e519b62e997896ab8d19c635cdda6a9e88100cbf905b1a31be16f020e516d
SSDEEP 98304:vVrwvJpGABksqBiIqakpBe7W9kJ6B3mTpRrHjN4etK:v/sqBHqppY7W86B3mTpR14etK
TLSH
T167161271B902837EF1C60DBAA179D776FF2C65B3232490C79FB010B1A6600DABA75653
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4174664

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError GetCurrentThreadId SetUnhandledExceptionFilter QueryPerformanceCounter GetProcAddress TerminateProcess UnhandledExceptionFilter MultiByteToWideChar SetLastError HeapFree HeapAlloc LeaveCriticalSection EnterCriticalSection WriteFile CreateFileW ExitProcess GetModuleFileNameW GetStartupInfoW IsDebuggerPresent GetCommandLineW ReadFile SetEvent GetFileType TlsGetValue HeapReAlloc GetConsoleMode FlushFileBuffers TlsAlloc LoadLibraryExW GetCPInfo TlsFree SetFilePointer CompareStringW GetStringTypeW RtlUnwind LCMapStringW InitializeCriticalSectionAndSpinCount GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW IsProcessorFeaturePresent FindNextFileW IsValidCodePage FindFirstFileW GetConsoleCP DecodePointer ReleaseMutex OutputDebugStringW lstrlenW LoadLibraryA GetModuleHandleExW CreateDirectoryW

user32

DispatchMessageW DestroyWindow MessageBoxW PostQuitMessage CreateWindowExW SetWindowLongW GetWindowLongW GetMessageW GetDlgItem GetSystemMetrics SendMessageW GetClientRect EnableWindow LoadCursorW GetParent SetWindowTextW SetFocus SetForegroundWindow GetSysColor EndPaint ScreenToClient SetCursor RegisterClassW GetWindowTextW UpdateWindow SystemParametersInfoW CharUpperW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-04_ec37e9eddb508a4f13509064b93fbc93_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic