General
- Target 2026-11-09_9a3bd1e68f2b9399a92d5aca61b96573_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
- Size 4.0MB
- Sample261110-phfjlah13p
- SHA256 c8b6ff7b5efc09d3c83525a0dda9730b09e1281b7da319ab2a88a5e6f2561ce6
Score
8/10
Malware Config
Targets
-
- Target 2026-11-09_9a3bd1e68f2b9399a92d5aca61b96573_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
- Size 4.0MB
- SHA256 c8b6ff7b5efc09d3c83525a0dda9730b09e1281b7da319ab2a88a5e6f2561ce6
Score8/10Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
Executes dropped EXE
Outbound SSH connection to public host
SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
Network activity triggered a Suricata alert
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1