2026-10-16_624de59fa19872dd41e3e4ce690b0c0f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-10-16_624de59fa19872dd41e3e4ce690b0c0f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample261017-tkknjsas8y
SHA256 f3e3566fa35180d9b4f2c9ca12af107afcc75ee78bad4d1d274456a765108a34
MD5 624de59fa19872dd41e3e4ce690b0c0f
SHA1 25d21de3829c4357a47e17aed64605129099a085
SHA512 ddfaf9d54505c08538171e118ea95b6b7e64eb1b66e24dfeffe29adf86ab172637e7960c99a28787957381c8d08881fabe79854606e398b5738940cefaf31d7f
SSDEEP 98304:IVrwvJpGxOluwKuQVSNOoyL8/Skh8uvbRQg4NaofwW9qekLbkC4GTl/4:IW0wlTyI/SITvbag4Naofh9sLbl4GTC
TLSH
T1B61612917B415072F5AA0C7A91A9CBFE1E2C5238372D84C76790F4A475242E3673EECE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_624de59fa19872dd41e3e4ce690b0c0f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-10-16_624de59fa19872dd41e3e4ce690b0c0f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-10-16_624de59fa19872dd41e3e4ce690b0c0f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 25243d24857c3ed4113b1fc45189b334
SHA256 f3e3566fa35180d9b4f2c9ca12af107afcc75ee78bad4d1d274456a765108a34
MD5 624de59fa19872dd41e3e4ce690b0c0f
SHA1 25d21de3829c4357a47e17aed64605129099a085
SHA512 ddfaf9d54505c08538171e118ea95b6b7e64eb1b66e24dfeffe29adf86ab172637e7960c99a28787957381c8d08881fabe79854606e398b5738940cefaf31d7f
SSDEEP 98304:IVrwvJpGxOluwKuQVSNOoyL8/Skh8uvbRQg4NaofwW9qekLbkC4GTl/4:IW0wlTyI/SITvbag4Naofh9sLbl4GTC
TLSH
T1B61612917B415072F5AA0C7A91A9CBFE1E2C5238372D84C76790F4A475242E3673EECE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

8562

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError GetCurrentThreadId GetCurrentProcess GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleW QueryPerformanceCounter WideCharToMultiByte SetLastError LocalFree EnterCriticalSection GetProcessHeap ExitProcess GetModuleFileNameW GetStdHandle GetStartupInfoW IsDebuggerPresent FindClose ReadFile RaiseException GetFileType GetModuleHandleA InitializeCriticalSection FlushFileBuffers TlsSetValue TlsAlloc WriteConsoleW LoadLibraryExW CreateThread TlsFree LCMapStringW InitializeCriticalSectionAndSpinCount GetEnvironmentStringsW SetStdHandle IsProcessorFeaturePresent FindNextFileW IsValidCodePage FindFirstFileW LocalAlloc GetCommandLineA SetEndOfFile OutputDebugStringW GetFileSize VirtualFree lstrlenW LoadLibraryA GetLocaleInfoW CreateDirectoryW GetExitCodeProcess ExpandEnvironmentStringsW

user32

DispatchMessageW ShowWindow ReleaseDC MessageBoxW CreateWindowExW SetWindowLongW GetWindowLongW GetMessageW GetDC GetWindowRect PostMessageW SendMessageW GetClientRect EnableWindow IsWindow EndDialog SetTimer LoadIconW SetFocus SetForegroundWindow GetSysColor EndPaint BeginPaint SetCursor KillTimer RegisterClassW EnableMenuItem GetWindow GetKeyState

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_624de59fa19872dd41e3e4ce690b0c0f_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic