2026-10-16_ceba48985785c9c9ca99107bf8f040dc_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-10-16_ceba48985785c9c9ca99107bf8f040dc_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample261017-han3faay2p
SHA256 98af6e62b1b9edf788d7d0ca1161e404655b0a9b096131a8f864e2d5e98993c9
MD5 ceba48985785c9c9ca99107bf8f040dc
SHA1 70dfb36527cfd08037b29502fb3b44904187663f
SHA512 42f2d88425c62d9646cc56acbb676170b241e5250edb5ee386d0035df54eaa9ffaa81326fda4291826a43ccb341a45ef4cb8fa8187ec0de3d6a389e5b3cafd7f
SSDEEP 98304:wVrwvJpGTbN4BDMnXaRu+aH3W7wNoXvWAKqmxN2Uk+7g2N:wBuynE8HZUMxNkL4
TLSH
T123161222B5639823FCE61036D9A59B32CF3FB32D635641C73B9024E867611D36A3467A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_ceba48985785c9c9ca99107bf8f040dc_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-10-16_ceba48985785c9c9ca99107bf8f040dc_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-10-16_ceba48985785c9c9ca99107bf8f040dc_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 414550497d957ca8e56a279ef0863f77
SHA256 98af6e62b1b9edf788d7d0ca1161e404655b0a9b096131a8f864e2d5e98993c9
MD5 ceba48985785c9c9ca99107bf8f040dc
SHA1 70dfb36527cfd08037b29502fb3b44904187663f
SHA512 42f2d88425c62d9646cc56acbb676170b241e5250edb5ee386d0035df54eaa9ffaa81326fda4291826a43ccb341a45ef4cb8fa8187ec0de3d6a389e5b3cafd7f
SSDEEP 98304:wVrwvJpGTbN4BDMnXaRu+aH3W7wNoXvWAKqmxN2Uk+7g2N:wBuynE8HZUMxNkL4
TLSH
T123161222B5639823FCE61036D9A59B32CF3FB32D635641C73B9024E867611D36A3467A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

8622

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcess GetCurrentProcessId GetSystemTimeAsFileTime GetProcAddress CloseHandle SetLastError HeapFree LocalFree DeleteCriticalSection EnterCriticalSection WaitForSingleObject GetProcessHeap CreateFileW GetStdHandle GetStartupInfoW IsDebuggerPresent RaiseException SetEvent FormatMessageW GetFileType GetModuleHandleA HeapReAlloc GetConsoleMode FlushFileBuffers CreateEventW HeapSetInformation LoadLibraryW LoadLibraryExW GetCPInfo TlsFree SetFilePointer CompareStringW GetStringTypeW RtlUnwind LCMapStringW GetModuleFileNameA GetOEMCP SetStdHandle FreeEnvironmentStringsW IsProcessorFeaturePresent FindNextFileW IsValidCodePage FindFirstFileW GetCommandLineA DecodePointer GetVersionExW CreateFileA GetFileSize EncodePointer LoadLibraryA GetFullPathNameW CreateProcessW

user32

TranslateMessage ShowWindow ReleaseDC MessageBoxW PostQuitMessage CreateWindowExW SetWindowLongW GetMessageW GetDC GetClientRect EnableWindow EndDialog SetTimer LoadIconW SetForegroundWindow PeekMessageW RegisterClassW EnableMenuItem GetWindow UpdateWindow GetKeyState MessageBoxA ClientToScreen

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_ceba48985785c9c9ca99107bf8f040dc_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic