2026-10-22_87e6cd6e8f14f54794d485ae47a83e63_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-10-22_87e6cd6e8f14f54794d485ae47a83e63_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample261024-glgbasxv4j
SHA256 727d8d4e04547f36b18ea9cf5e891fabad013800e8288c32450378259e295ffe
MD5 87e6cd6e8f14f54794d485ae47a83e63
SHA1 6606a820df4603e9217bb964c2252919b4897fc8
SHA512 907e692031b91de86c8bec8c31deccce4d0a8eade1bfe10dcce67b68a04606710d8523fd7730fa135f39fee8367e74f9a6132421b582f1527f27375be2d4e1e8
SSDEEP 98304:XVrwvJpGM3ouqUdkv5SVf9YjaMWTjarFfl8cLTGr8RHNsKg1cZK:XS3Lq+k06hWTjan8c7RtsKkq
TLSH
T18A16121BB4404032F7920136A57A8BFE9F3C52293375D4DBE39428EF6B645D12AB9B43
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_87e6cd6e8f14f54794d485ae47a83e63_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-10-22_87e6cd6e8f14f54794d485ae47a83e63_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-10-22_87e6cd6e8f14f54794d485ae47a83e63_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH f4205887a3c85aaecef2588be9640475
SHA256 727d8d4e04547f36b18ea9cf5e891fabad013800e8288c32450378259e295ffe
MD5 87e6cd6e8f14f54794d485ae47a83e63
SHA1 6606a820df4603e9217bb964c2252919b4897fc8
SHA512 907e692031b91de86c8bec8c31deccce4d0a8eade1bfe10dcce67b68a04606710d8523fd7730fa135f39fee8367e74f9a6132421b582f1527f27375be2d4e1e8
SSDEEP 98304:XVrwvJpGM3ouqUdkv5SVf9YjaMWTjarFfl8cLTGr8RHNsKg1cZK:XS3Lq+k06hWTjan8c7RtsKkq
TLSH
T18A16121BB4404032F7920136A57A8BFE9F3C52293375D4DBE39428EF6B645D12AB9B43
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4183240

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError GetCurrentProcess GetCurrentProcessId GetModuleHandleW QueryPerformanceCounter GetProcAddress UnhandledExceptionFilter WideCharToMultiByte SetLastError HeapFree LocalFree DeleteCriticalSection WriteFile WaitForSingleObject GetProcessHeap CreateFileW ExitProcess GetStdHandle IsDebuggerPresent GetCommandLineW ReadFile RaiseException GetACP GetFileType TlsGetValue GetModuleHandleA InitializeCriticalSection HeapReAlloc GetConsoleMode FlushFileBuffers TlsAlloc HeapSize WriteConsoleW GetFileAttributesW GetStringTypeW RtlUnwind GetEnvironmentStringsW SetStdHandle FreeEnvironmentStringsW FindNextFileW IsValidCodePage FindFirstFileW VirtualAlloc GetConsoleCP LocalAlloc GetVersionExW CreateFileA GetFileSize EncodePointer VirtualFree lstrlenW LoadLibraryA GetLocaleInfoW GetExitCodeProcess CreateProcessW

user32

TranslateMessage LoadStringW DispatchMessageW DestroyWindow ReleaseDC DefWindowProcW MessageBoxW PostQuitMessage CreateWindowExW GetDC PostMessageW SendMessageW GetClientRect EnableWindow LoadCursorW GetParent EndDialog SetWindowTextW SetFocus GetSysColor PeekMessageW ScreenToClient SetCursor InvalidateRect RegisterClassW EnableMenuItem GetKeyState MessageBoxA CharUpperW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_87e6cd6e8f14f54794d485ae47a83e63_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic