2026-10-29_17ec3f889277ff7bb51cd702b240ac8c_amadey_elex_glassworm_luca-stealer_lynx_njrat

General

Target
2026-10-29_17ec3f889277ff7bb51cd702b240ac8c_amadey_elex_glassworm_luca-stealer_lynx_njrat
Size 1.1MB
Sample261029-vft7vs1y4n
SHA256 42036fc91f0601b6059f340d5d695c8f5d9d09595084b6cd406a36849aafeefc
MD5 17ec3f889277ff7bb51cd702b240ac8c
SHA1 18f35fd08ce76e51ad3b90b0ae75c93a49453703
SHA512 6a87b3657c9021f420b2c936c7dec8c3badfcc7e354266894940e523ba7f33ec5f039be9b9a8aa51e7b9bdc89d9461cb833ef869a9350a7545c716f7f552bcc9
SSDEEP 24576:PDz7N/qyFIPTMRAKd10gZTpyBfL/ik3eQci4Tfb:bN/quSTyAk0+TOTleM4P
TLSH
T11935F13075B1C032C4115D325A259BB5896FA8226F2444FFE3A66F7ECE343D1AA32767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-29_17ec3f889277ff7bb51cd702b240ac8c_amadey_elex_glassworm_luca-stealer_lynx_njrat

File Explorer

2026-10-29_17ec3f889277ff7bb51cd702b240ac8c_amadey_elex_glassworm_luca-stealer_lynx_njrat

.exe 1.1MB

2026-10-29_17ec3f889277ff7bb51cd702b240ac8c_amadey_elex_glassworm_luca-stealer_lynx_njrat

IMPHASH 50e76645e1768050ad923de0baa1b61b
SHA256 42036fc91f0601b6059f340d5d695c8f5d9d09595084b6cd406a36849aafeefc
MD5 17ec3f889277ff7bb51cd702b240ac8c
SHA1 18f35fd08ce76e51ad3b90b0ae75c93a49453703
SHA512 6a87b3657c9021f420b2c936c7dec8c3badfcc7e354266894940e523ba7f33ec5f039be9b9a8aa51e7b9bdc89d9461cb833ef869a9350a7545c716f7f552bcc9
SSDEEP 24576:PDz7N/qyFIPTMRAKd10gZTpyBfL/ik3eQci4Tfb:bN/quSTyAk0+TOTleM4P
TLSH
T11935F13075B1C032C4115D325A259BB5896FA8226F2444FFE3A66F7ECE343D1AA32767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

85485

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\.jenkins\workspace\CCMini_Windows\Win32\Products\Release_Win32\CCMini.pdb

ws2_32

recv listen htons ioctlsocket setsockopt closesocket bind accept htonl send socket WSAStartup gethostbyname __WSAFDIsSet connect select ntohs getsockname WSAGetLastError

shell32

CommandLineToArgvW

kernel32

GetModuleHandleW SetEndOfFile HeapSize GetProcessHeap SetEnvironmentVariableW GetCommandLineW Sleep EnterCriticalSection LeaveCriticalSection InitializeCriticalSection MultiByteToWideChar LoadLibraryW GetProcAddress DeleteCriticalSection WaitForSingleObject TerminateThread CloseHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle GetFullPathNameW GetCurrentDirectoryW TlsSetValue GetCurrentThreadId TlsAlloc TlsGetValue QueryPerformanceCounter WideCharToMultiByte EncodePointer DecodePointer InitializeCriticalSectionEx LCMapStringEx GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW WriteConsoleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetModuleHandleExW CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetTimeZoneInformation ExitProcess GetModuleFileNameW GetStdHandle WriteFile HeapAlloc HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-29_17ec3f889277ff7bb51cd702b240ac8c_amadey_elex_glassworm_luca-stealer_lynx_njrat

ws2_32

shell32

kernel32

generic