2026-10-26_49bd400e6ccf1bdb3f827b397d3f2859_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_49bd400e6ccf1bdb3f827b397d3f2859_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader
Size 1.8MB
Sample261027-wymq6sec29
SHA256 03e8fbc8e08d2b4b63581950c30b6b3097e41dafc94150d254af8c232f393211
MD5 49bd400e6ccf1bdb3f827b397d3f2859
SHA1 1f865985c456a083542c811d9976c7c814742ff9
SHA512 7975976ef97a574bf7c696e4740f207ab7e359f875d8b6ddcd6e4509e4d7fbcb3097a475e79660fe07c706a2abe76100b1954384ac83ad4bf590157dc058a17f
SSDEEP 24576:OKCHj+tVyxDOLEU+PjaBt5WE/DhN3XpB6tyHAYGZbE:OKCHj+tVyxDOopWBHWE/DhN30MGW
TLSH
T194952821F941922AFDF711BB8AFD6F2D965CD990035D28D781CC16CE8791BE23A325C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_49bd400e6ccf1bdb3f827b397d3f2859_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader

File Explorer

2026-10-26_49bd400e6ccf1bdb3f827b397d3f2859_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader

.exe 1.8MB

2026-10-26_49bd400e6ccf1bdb3f827b397d3f2859_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader

IMPHASH da228f4f5f5233df809cf4bc5ea2836f
SHA256 03e8fbc8e08d2b4b63581950c30b6b3097e41dafc94150d254af8c232f393211
MD5 49bd400e6ccf1bdb3f827b397d3f2859
SHA1 1f865985c456a083542c811d9976c7c814742ff9
SHA512 7975976ef97a574bf7c696e4740f207ab7e359f875d8b6ddcd6e4509e4d7fbcb3097a475e79660fe07c706a2abe76100b1954384ac83ad4bf590157dc058a17f
SSDEEP 24576:OKCHj+tVyxDOLEU+PjaBt5WE/DhN3XpB6tyHAYGZbE:OKCHj+tVyxDOopWBHWE/DhN30MGW
TLSH
T194952821F941922AFDF711BB8AFD6F2D965CD990035D28D781CC16CE8791BE23A325C2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23680

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleFileNameA GetModuleFileNameW GetModuleHandleW GetModuleHandleExA GetProcAddress LoadLibraryExW LoadLibraryW GetCurrentDirectoryW CreateDirectoryW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetVersionExW FreeLibrary CreateFileW GetFileSizeEx ReadFile DecodePointer CloseHandle InitializeCriticalSectionEx LocalFree GetPrivateProfileStringW OutputDebugStringA GetCurrentThreadId WriteConsoleW HeapSize GetTimeZoneInformation SetStdHandle Sleep GetProcessHeap HeapFree HeapAlloc GetLastError RaiseException GetFileAttributesW FindNextFileW FindFirstFileExW FindClose GetCurrentProcess SetEnvironmentVariableW SetConsoleCtrlHandler FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead FormatMessageA WideCharToMultiByte MultiByteToWideChar GetStringTypeW EncodePointer LCMapStringEx GetLocaleInfoEx CompareStringEx GetCPInfo OutputDebugStringW RtlUnwind InterlockedPushEntrySList InterlockedFlushSList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCurrentThread GetFileType GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx ReadConsoleW HeapReAlloc SetEndOfFile

user32

UnregisterClassW GetSystemMetrics

advapi32

RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegDeleteKeyExW RegDeleteKeyW RegCreateKeyExW RegCloseKey

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

oleaut32

SysFreeString

shlwapi

PathRemoveFileSpecW

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

180KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.giats

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eecseg

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_49bd400e6ccf1bdb3f827b397d3f2859_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

generic