2026-10-15_38a4507b4fa9c0c9d0b8a57e517673bd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-10-15_38a4507b4fa9c0c9d0b8a57e517673bd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample261016-xmkccabc59
SHA256 afcb0a84933eefee23bc192c741f869c140a11e363eadd74cee950f81cea0bec
MD5 38a4507b4fa9c0c9d0b8a57e517673bd
SHA1 310153554887e1dd65e29fb27ffe5f885be73ec6
SHA512 f6a1c44eafb39ac4029594e32b91e8eb2abb3f7b820112240ec3044d10003bc869dc38d89284130e9205ca779f8f31188a7855cfea3135f91c0293be7aeaf23a
SSDEEP 98304:oVrwvJpGIidfwTeMIhJcBHGLMaePtJWkIV4Dvm6HndOrPJa:oGQ4SXTyPJWUvmWITJa
TLSH
T13D161222F4419032F6D58077A1B9ABBE4FFD262D2335D4DF26AC24789E200D9A739747
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-15_38a4507b4fa9c0c9d0b8a57e517673bd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-10-15_38a4507b4fa9c0c9d0b8a57e517673bd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-10-15_38a4507b4fa9c0c9d0b8a57e517673bd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH aa0794eb0d983f4c24888762f53ed4f3
SHA256 afcb0a84933eefee23bc192c741f869c140a11e363eadd74cee950f81cea0bec
MD5 38a4507b4fa9c0c9d0b8a57e517673bd
SHA1 310153554887e1dd65e29fb27ffe5f885be73ec6
SHA512 f6a1c44eafb39ac4029594e32b91e8eb2abb3f7b820112240ec3044d10003bc869dc38d89284130e9205ca779f8f31188a7855cfea3135f91c0293be7aeaf23a
SSDEEP 98304:oVrwvJpGIidfwTeMIhJcBHGLMaePtJWkIV4Dvm6HndOrPJa:oGQ4SXTyPJWUvmWITJa
TLSH
T13D161222F4419032F6D58077A1B9ABBE4FFD262D2335D4DF26AC24789E200D9A739747
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

633475

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError GetCurrentProcess SetUnhandledExceptionFilter GetModuleHandleW QueryPerformanceCounter GetProcAddress Sleep FreeLibrary MultiByteToWideChar LocalFree DeleteCriticalSection GetProcessHeap ExitProcess GetModuleFileNameW GetStdHandle GetCommandLineW SetEvent GetACP FormatMessageW GetFileType TlsGetValue GetModuleHandleA InitializeCriticalSection GetConsoleMode TlsSetValue CreateEventW TlsAlloc HeapSize TlsFree SetFilePointer GetFileAttributesW CompareStringW RtlUnwind InitializeCriticalSectionAndSpinCount GetOEMCP SetStdHandle FreeEnvironmentStringsW FindNextFileW FindFirstFileW DeleteFileW VirtualAlloc GetCommandLineA DecodePointer SetEndOfFile ResetEvent ReleaseMutex CreateFileA EncodePointer VirtualFree GetLocaleInfoW GetFullPathNameW LoadResource

user32

TranslateMessage DispatchMessageW ShowWindow ReleaseDC PostQuitMessage SetWindowLongW GetWindowLongW GetMessageW GetSystemMetrics GetWindowRect SendMessageW SetWindowPos EnableWindow LoadCursorW GetParent SetTimer SetFocus GetSysColor ScreenToClient SetCursor RegisterClassW GetWindowTextW SystemParametersInfoW GetKeyState CharUpperW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-15_38a4507b4fa9c0c9d0b8a57e517673bd_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic