2026-10-23_78c32c4623ea7b7fc5fd8495dec7b06b_akira_amadey_blankgrabber_elex_glassworm_luca-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-23_78c32c4623ea7b7fc5fd8495dec7b06b_akira_amadey_blankgrabber_elex_glassworm_luca-stealer
Size 3.7MB
Sample261023-mpmkda1x9k
SHA256 eea3b8083e542b12e60f487c10d3d5f1f5e3d904be97857db9ea1ae3cc89baa7
MD5 78c32c4623ea7b7fc5fd8495dec7b06b
SHA1 cccaad095633806cda7e5c0b875a6cac673868b0
SHA512 8a930d407ca1a928798337bc16f1c07c89197f7e2778acb8173e12c84796f877ff2c15fe2e9e06d63945e5e41b4348adb052f6ca930ff481ffac6274645aeb8b
SSDEEP 49152:50z1f+viTnGsRHs8jVrr3TZlzW1qmHVpFkSZk:++v0ntHsOnaH
TLSH
T18A06AE62FF42D0F7C48A01B5E42DF37D9A36A2558B6A85C392A94C4C6CE13B09C5739F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-23_78c32c4623ea7b7fc5fd8495dec7b06b_akira_amadey_blankgrabber_elex_glassworm_luca-stealer

.exe 3.7MB

2026-10-23_78c32c4623ea7b7fc5fd8495dec7b06b_akira_amadey_blankgrabber_elex_glassworm_luca-stealer

IMPHASH c06cf0cb9719d4659ab380800e751381
SHA256 eea3b8083e542b12e60f487c10d3d5f1f5e3d904be97857db9ea1ae3cc89baa7
MD5 78c32c4623ea7b7fc5fd8495dec7b06b
SHA1 cccaad095633806cda7e5c0b875a6cac673868b0
SHA512 8a930d407ca1a928798337bc16f1c07c89197f7e2778acb8173e12c84796f877ff2c15fe2e9e06d63945e5e41b4348adb052f6ca930ff481ffac6274645aeb8b
SSDEEP 49152:50z1f+viTnGsRHs8jVrr3TZlzW1qmHVpFkSZk:++v0ntHsOnaH
TLSH
T18A06AE62FF42D0F7C48A01B5E42DF37D9A36A2558B6A85C392A94C4C6CE13B09C5739F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

37:c1:3f:4c:c5:74:d4:35:fc:e3:59:61:ce:de:f4:28:bb:65:ea:25:60:64:c5:d5:0f:84:66:49:28:04:42:ed

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=AFTERIMAGE SOFTWARE LTD,O=AFTERIMAGE SOFTWARE LTD,L=London,C=GB

Chains

Oct 16, 2026

CN=AFTERIMAGE SOFTWARE LTD,O=AFTERIMAGE SOFTWARE LTD,L=London,C=GB

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=AFTERIMAGE SOFTWARE LTD,O=AFTERIMAGE SOFTWARE LTD,L=London,C=GB

Serial Number

33:00:08:a0:6b:11:92:28:69:c4:d5:7e:a9:00:00:00:08:a0:6b

Issuer

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 15, 2026 - Oct 18, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:16:31:92:8d:92:02:65:7b:9a:00:00:00:00:00:16

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:7A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5b:4a:b5:8d:41:32:6d:dc:74:00:00:00:00:00:5b

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

2221449

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

update.pdb

kernel32

GetModuleFileNameW SetThreadErrorMode LoadLibraryExW SetUnhandledExceptionFilter SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetTimeZoneInformationForYear CloseHandle GetCommandLineW TlsSetValue UnhandledExceptionFilter GetFileInformationByHandleEx SetFileInformationByHandle FindClose GetFullPathNameW TlsGetValue GetSystemInfo WakeAllConditionVariable WakeConditionVariable SwitchToThread SleepConditionVariableSRW GetCurrentProcess DuplicateHandle AcquireSRWLockExclusive GetFileInformationByHandle InitOnceBeginInitialize TlsAlloc InitOnceComplete TlsFree ReleaseSRWLockExclusive MultiByteToWideChar WaitForSingleObject GetCurrentThread ReleaseMutex SetLastError GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA lstrlenW GetCurrentProcessId CreateMutexA WideCharToMultiByte GetCurrentThreadId GetEnvironmentVariableW GetModuleHandleA CreateThread GetProcAddress ReadFileEx SleepEx WriteFileEx CompareStringOrdinal GetModuleHandleW CreateFileW SetFileTime FindFirstFileExW SetFilePointerEx TryAcquireSRWLockExclusive SetHandleInformation GetSystemTimeAsFileTime CreateDirectoryW ExitProcess GetExitCodeProcess GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetTempPathW RemoveDirectoryW DeleteFileW CopyFileExW MoveFileExW CreateSymbolicLinkW CreateWaitableTimerExW SetWaitableTimer Sleep SetCurrentDirectoryW FindNextFileW GetFileSizeEx OpenProcess GetProcessTimes ExpandEnvironmentStringsW GetLongPathNameW HeapSize TerminateProcess QueryFullProcessImageNameW VirtualQuery GetLastError IsWow64Process GetProcessId GetUserPreferredUILanguages LoadLibraryExA VirtualProtect SetThreadStackGuarantee GetConsoleOutputCP FreeLibrary GetProcessHeap HeapFree HeapAlloc FormatMessageW GetConsoleMode GetStdHandle WriteConsoleW SetConsoleMode SetConsoleTextAttribute GetConsoleScreenBufferInfo OutputDebugStringA OutputDebugStringW AddVectoredExceptionHandler HeapReAlloc SetStdHandle DecodePointer RtlUnwind RtlCaptureContext IsDebuggerPresent QueryPerformanceFrequency QueryPerformanceCounter RaiseException EncodePointer GetModuleHandleExW InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount WriteFile GetCommandLineA IsValidCodePage GetACP GetOEMCP GetCPInfo SetEnvironmentVariableW GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx CompareStringW LCMapStringW FlushFileBuffers

ntdll

NtReadFile NtWriteFile NtCreateFile RtlInitUnicodeString NtOpenFile NtCreateNamedPipeFile RtlNtStatusToDosError NtQueryInformationProcess

user32

EndDialog AllowSetForegroundWindow SendMessageW

combase

CoTaskMemFree CoTaskMemAlloc

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-23_78c32c4623ea7b7fc5fd8495dec7b06b_akira_amadey_blankgrabber_elex_glassworm_luca-stealer

kernel32

ntdll

user32

combase

generic