General
- Target 2026-11-09_35c6d463284732524790e4ace6ba5f24_amadey_elex_glassworm_luca-stealer_njrat_stop
- Size 22.2MB
- Sample261110-2sbdvacb23
- SHA256 ba34df20f11cbc4bf79fbc2ef1a49bbf65056823e26b43d6fb2e62c8d30a3931
- MD5 35c6d463284732524790e4ace6ba5f24
- SHA1 8a52e0be20e822e6c1b11fb11b21c298148025a3
- SHA512 2085cffd02c5f8fa2691410caa19989ae652ceaf03501c316be02bdd3da93f3461c65cf780144175e03a78b838a6846c41c7a3b9e9f6c9f4bf68fda25b12dc61
- SSDEEP 393216:cM8WFYHuXOTMdhpSwJYRlgRYKhuzf0j5dNZ5S2Ucz9F8mzaVZJBE7yQ1xp:N8WCHSOTMYvvKu65d5NtzzABE7Fbp
- TLSH T121373311B3E48126C4BF0774647686686BB5FE229768D7CFB2847A9D1EB27C04D307A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-09_35c6d463284732524790e4ace6ba5f24_amadey_elex_glassworm_luca-stealer_njrat_stop.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-09_35c6d463284732524790e4ace6ba5f24_amadey_elex_glassworm_luca-stealer_njrat_stop
- Size 22.2MB
- SHA256 ba34df20f11cbc4bf79fbc2ef1a49bbf65056823e26b43d6fb2e62c8d30a3931
- MD5 35c6d463284732524790e4ace6ba5f24
- SHA1 8a52e0be20e822e6c1b11fb11b21c298148025a3
- SHA512 2085cffd02c5f8fa2691410caa19989ae652ceaf03501c316be02bdd3da93f3461c65cf780144175e03a78b838a6846c41c7a3b9e9f6c9f4bf68fda25b12dc61
- SSDEEP 393216:cM8WFYHuXOTMdhpSwJYRlgRYKhuzf0j5dNZ5S2Ucz9F8mzaVZJBE7yQ1xp:N8WCHSOTMYvvKu65d5NtzzABE7Fbp
- TLSH T121373311B3E48126C4BF0774647686686BB5FE229768D7CFB2847A9D1EB27C04D307A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Custom signature
Detects executables manipulated with Fody
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE