General
- Target 2026-10-11_6ae8fcde85709ef8c63b47696d46f4de_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
- Size 4.0MB
- Sample261012-x2rd7sd18w
- SHA256 dc689cd786f531a47f5062a25c0c8b87a9191b8e979b0b1d50d4c2886258b6c2
- MD5 6ae8fcde85709ef8c63b47696d46f4de
- SHA1 0be3c5a8a994a0288fb2f707edfcac200e3bb337
- SHA512 2d13df68b5b17fec05dcb87ca1f72c0d39ec7c42abec58f66f6e503ecc4e7ca85dfb44ab5af06db6bc63fc7f32d64421dc21133f67284a9e15aec9f66d3fe41c
- SSDEEP 49152:90OXFz9wvJpGVbhLbxNUaFSNNeIPQ7Eo91Hjt/6OfZR5oZG:9VrwvJpG7bDUaFSP3+F1Dt/6Off54
- TLSH T1DD16C01D69109463F97B30789E657A761928E26373154DDF3B4480AC6EF00D2AE3BECE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-11_6ae8fcde85709ef8c63b47696d46f4de_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-11_6ae8fcde85709ef8c63b47696d46f4de_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-11_6ae8fcde85709ef8c63b47696d46f4de_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
- Size 4.0MB
- SHA256 dc689cd786f531a47f5062a25c0c8b87a9191b8e979b0b1d50d4c2886258b6c2
- MD5 6ae8fcde85709ef8c63b47696d46f4de
- SHA1 0be3c5a8a994a0288fb2f707edfcac200e3bb337
- SHA512 2d13df68b5b17fec05dcb87ca1f72c0d39ec7c42abec58f66f6e503ecc4e7ca85dfb44ab5af06db6bc63fc7f32d64421dc21133f67284a9e15aec9f66d3fe41c
- SSDEEP 49152:90OXFz9wvJpGVbhLbxNUaFSNNeIPQ7Eo91Hjt/6OfZR5oZG:9VrwvJpG7bDUaFSP3+F1Dt/6Off54
- TLSH T1DD16C01D69109463F97B30789E657A761928E26373154DDF3B4480AC6EF00D2AE3BECE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE