2026-09-27_dad7459c00faa384f6c1773a603b1961_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Malware with C2 and injection
Native libcurl Tor client over SOCKSUnsigned VirtualAlloc stub shells cmd.exe
SHA-2564c7a39e2b2dd840a8923bb17e95934d1b985ad1deb7f5204f6e34b7f13392d28
Evidence
⋯3 more rows
0x142bffffff000f841a020000e9040c000058...............X
0x143b64a1300000008985f0feffff8b85f0fed.0.............
0x144bffff8b480c8b511483ea088955e88b45...H..Q.....U..E
0x146b6fc645a261c645a364c645a46dc645a5o.E.a.E.d.E.m.E.
0x147b65c645a600c6453101c745b000000000e.E...E1..E.....
0x148be9080e0000e91f0f0000c6456701c745...........Eg..E
0x149bd800000000e9f0fdffff8b4d1c83c101...........M....
0x14ab894d1c8b55500fb7420639451c0f8c57.M..UP..B.9E...W
0x14bb000000e9bffdffffe98df9ffff0fbe4d...............M
0x14cb3283f9010f857a010000e9aa0e00008b2.....z.........
0x14db453c8b4d2c0fb754410483fa580f847fE<.M,..TA...X...
0x14ebfbffffe9630d0000648b3530000000e9....c...d.50....
0x14fb2a0c00006b5500288b45608b4d08034c*...kU.(.E`.M..L
0x150b100c894d44e95c1100006b4d1c288b55...MD.\...kM.(.U
0x151b608b454c8b4c0a0c3b48200f86740000`.EL.L..;H ..t..
0x152b00e9fb0300008b4d0483c101894d048b.......M.....M..
0x153b554c8b45043b42180f82e8030000e9fbUL.E.;B.........
0x154b0300008b4d58034dd40fbe1185d20f84....MX.M........
0x155ba9fdffffe9730000008b4d58034dd00f.....s....MX.M..
0x156bbe118b45d00fbe4c05983bd10f8449f9...E...L..;...I.
0x157bffffe9a0faffff8b552083c201895520........U ....U
0x158b8b45500fb74806394d200f8cd6030000.EP..H.9M ......
0x159be94efcffff6b551c286b451c288b4d60.N...kU.(kE.(.M`
0x15ab8b54110c8b4d60035401108b454c3b50.T...M`.T...EL;P
⋯15 more rows
⋯5 more rows
0x7a5df004f0054005c00430049004d00560032.O.T.\.C.I.M.V.2
0x7a5ef000000000053454c4543542043617074.....SELECT Capt
0x7a5ff696f6e2046524f4d2057696e33325f56ion FROM Win32_V
0x7a60f6964656f436f6e74726f6c6c65720000ideoController..
0x7a61f0057514c00430061007000740069006f.WQL.C.a.p.t.i.o
0x7a62f006e0000004e56494449410000414d44.n...NVIDIA..AMD
0x7a63f0053454c454354204e616d652046524f.SELECT Name FRO
0x7a64f4d2057696e33325f50726f636573736fM Win32_Processo
0x7a65f720000000057514c004e0061006d0065r....WQL.N.a.m.e
0x7a66f000000000053454c4543542053657269.....SELECT Seri
⋯4 more rows
0x7a6bf00650072000000000054006100670000.e.r.....T.a.g..
0x7a6cf005c005c002e005c0050004800590053.\.\...\.P.H.Y.S
0x7a6df004900430041004c0044005200490056.I.C.A.L.D.R.I.V
0x7a6ef00450030000000000072620000257370.E.0.....rb..%sp
0x7a6ff257500000025736d256c6c7500257373%u...%sm%llu.%ss
0x7a70f68740000004d454d4c4f41443a202573ht...MEMLOAD: %s
0x7a71f0a000000007262000025735c25730000.....rb..%s\%s..
0x7a72f00726200004552524f52204d454d4c4f.rb..ERROR MEMLO
0x7a73f41443a2043414e542046494e44202573AD: CANT FIND %s
⋯4 more rows
0x7a78f00454e5445522025702025730a000000.ENTER %p %s....
0x7a79f00433a5c57696e646f77735c53797357.C:\Windows\SysW
0x7a7af4f5736345c636d642e65786500435245OW64\cmd.exe.CRE
0x7a7bf4154454420434d442e4558450a000000ATED CMD.EXE....
0x7a7cf007262000068656b2e646c6c0046494c.rb..hek.dll.FIL
⋯3 more rows
0x7a80f5448524541440a00004652454520504cTHREAD...FREE PL
0x7a81f53205245540a000000433a5c57696e64S RET....C:\Wind
0x7a82f6f77735c53797374656d33325c636d64ows\System32\cmd
0x7a83f2e65786500435245415445442036340a.exe.CREATED 64.
0x7a84f007262000068656b36342e646c6c0000.rb..hek64.dll..
0x7a85f006c6f61646d650000454e5452593a20.loadme..ENTRY:
0x7a86f256c6c5820256c6c580a0000006e0074%llX %llX....n.t
0x7a87f0064006c006c002e0064006c006c0000.d.l.l...d.l.l..
⋯7 more rows
0x7adbc6557000044656c65746546696c655700eW..DeleteFileW.
0x7adcc5669727475616c416c6c6f6300000000VirtualAlloc....
0x7addc476574436f6e736f6c65435000000000GetConsoleCP....
⋯15 more rows
⋯7 more rows
0x821c761756c740021000000434c49454e5420ault.!...CLIENT
0x821d76c69626375726c20372e36332e300d0alibcurl 7.63.0..
0x821e74d415443482025732025732025730d0aMATCH %s %s %s..
⋯15 more rows
⋯7 more rows
0x835fc282564292c20556e6b6e6f776e2e0000(%d), Unknown...
0x8360c534f434b53353a20636f6e6e65637469SOCKS5: connecti
0x8361c6e6720746f20485454502070726f7879ng to HTTP proxy
0x8362c20257320706f72742025640a00000000 %s port %d.....
0x8363c00000000534f434b53353a2073657276....SOCKS5: serv
0x8364c6572207265736f6c76696e6720646973er resolving dis
0x8365c61626c656420666f7220686f73746e61abled for hostna
0x8366c6d6573206f66206c656e677468203e20mes of length >
0x8367c323535205b61637475616c206c656e3d255 [actual len=
0x8368c257a755d0a000000534f434b53353a20%zu]....SOCKS5:
0x8369c6e6f20636f6e6e656374696f6e206865no connection he
0x836ac72650000534f434b53353a20636f6e6ere..SOCKS5: conn
0x836bc656374696f6e2074696d656f75740000ection timeout..
0x836cc534f434b53353a206572726f72206f63SOCKS5: error oc
0x836dc63757272656420647572696e6720636fcurred during co
0x836ec6e6e656374696f6e000000007761726ennection....warn
0x836fc696e673a20756e737570706f72746564ing: unsupported
0x8370c2076616c75652070617373656420746f value passed to
0x8371c204355524c4f50545f534f434b53355f CURLOPT_SOCKS5_
0x8372c415554483a20256c750a0000534f434bAUTH: %lu...SOCK
0x8373c533520636f6d6d756e69636174696f6eS5 communication
0x8374c20746f2025733a25640a0000556e6162 to %s:%d...Unab
0x8375c6c6520746f2073656e6420696e697469le to send initi
0x8376c616c20534f434b533520726571756573al SOCKS5 reques
0x8377c742e0000534f434b5335206e6f746869t...SOCKS5 nothi
0x8378c6e6720746f20726561640000534f434bng to read..SOCK
⋯15 more rows