2026-11-03_684b40ed3ab0111b63319d5bfa4b341b_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

General

Target
2026-11-03_684b40ed3ab0111b63319d5bfa4b341b_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 4.0MB
Sample261104-wtk2sattez
SHA256 ce3b9788b6d7a409db25100ae76c4e09ea85abc3fbb109bd2c675d00e3639a46
MD5 684b40ed3ab0111b63319d5bfa4b341b
SHA1 de46cf6e14ab356055416bd054dd5fd4fec3ed1e
SHA512 0276d6da8091fd8de97f8213d6a90743c7f64f60fb02596c336b5ce196988652ad9e9191a2017047d4cd6301281655c7275cf0d0dcac8083aabde474774be4c1
SSDEEP 98304:2bloxHh5Z+EFNMh/ChP3Rg2A6//i5LJo4mXq20ep/cmVrwvJpG:2qxHd+EFmhq3AS65NJgJNpUm
TLSH
T1E2161261A803A13AF597C03DE1EE877E276E12B51318A4D733D196F0AE711D1723AF86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_684b40ed3ab0111b63319d5bfa4b341b_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

File Explorer

2026-11-03_684b40ed3ab0111b63319d5bfa4b341b_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 4.0MB

2026-11-03_684b40ed3ab0111b63319d5bfa4b341b_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH 4fb5937e0e895fe665997a00c3028c2b
SHA256 ce3b9788b6d7a409db25100ae76c4e09ea85abc3fbb109bd2c675d00e3639a46
MD5 684b40ed3ab0111b63319d5bfa4b341b
SHA1 de46cf6e14ab356055416bd054dd5fd4fec3ed1e
SHA512 0276d6da8091fd8de97f8213d6a90743c7f64f60fb02596c336b5ce196988652ad9e9191a2017047d4cd6301281655c7275cf0d0dcac8083aabde474774be4c1
SSDEEP 98304:2bloxHh5Z+EFNMh/ChP3Rg2A6//i5LJo4mXq20ep/cmVrwvJpG:2qxHd+EFmhq3AS65NJgJNpUm
TLSH
T1E2161261A803A13AF597C03DE1EE877E276E12B51318A4D733D196F0AE711D1723AF86
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

3552795

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentThreadId GetCurrentProcess GetSystemTimeAsFileTime SetUnhandledExceptionFilter QueryPerformanceCounter TerminateProcess UnhandledExceptionFilter Sleep GetTickCount MultiByteToWideChar WideCharToMultiByte HeapFree DeleteCriticalSection EnterCriticalSection WaitForSingleObject GetProcessHeap CreateFileW GetModuleFileNameW GetStartupInfoW GetCommandLineW SetEvent GetACP GetFileType TlsGetValue InitializeCriticalSection GetConsoleMode FlushFileBuffers CreateEventW HeapSetInformation CreateThread SetFilePointer CompareStringW GetStringTypeW GetModuleFileNameA GetEnvironmentStringsW SetStdHandle FreeEnvironmentStringsW IsProcessorFeaturePresent IsValidCodePage DeleteFileW VirtualAlloc ResetEvent GetVersionExW CreateFileA OutputDebugStringW lstrlenW GetFullPathNameW CreateProcessW

user32

DispatchMessageW ShowWindow DestroyWindow DefWindowProcW PostQuitMessage CreateWindowExW GetSystemMetrics GetDC GetWindowRect SendMessageW EnableWindow IsWindow LoadCursorW GetParent SetTimer LoadIconW SetFocus SetForegroundWindow PeekMessageW SetCursor KillTimer RegisterClassW EnableMenuItem GetWindow

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_684b40ed3ab0111b63319d5bfa4b341b_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

kernel32

user32

generic