2026-05-28_7b913eca5cdfe7190abb68c177b5fa6a_amadey_darkgate_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-28_7b913eca5cdfe7190abb68c177b5fa6a_amadey_darkgate_elex_luca-stealer_lynx_njrat
Size 1.3MB
Sample260528-scddtscs2q
SHA256 f3bf4d85f5039671c3efe53eea6631df24e94e118f3fa4905ba0dc288174ad0f
MD5 7b913eca5cdfe7190abb68c177b5fa6a
SHA1 a8be4d49bacb7b2ccc6bf195e526595e9871d50e
SHA512 dc86d0c6fd512a443467d154203c5727f4815055021f30eb6844fecd0bd81b15c336e35b5810d766018feb4291370512461920dddf24858b69c277a139ae1f9b
SSDEEP 24576:O2lYDHHhrWn3pr+1UO38LlMM+NhN3UcIxzmz30o9AdZUYRrdEA:oYr+qO3gMMahN3UcIZmzkogUErD
TLSH
T13755BF21795AC036E57102711939AF6A906EBD384B7509CB7BC00F7E99642E36F31F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-28_7b913eca5cdfe7190abb68c177b5fa6a_amadey_darkgate_elex_luca-stealer_lynx_njrat

File Explorer

2026-05-28_7b913eca5cdfe7190abb68c177b5fa6a_amadey_darkgate_elex_luca-stealer_lynx_njrat

.exe 1.3MB

2026-05-28_7b913eca5cdfe7190abb68c177b5fa6a_amadey_darkgate_elex_luca-stealer_lynx_njrat

IMPHASH e86214367fc76f32b47c7fc3a6cbeb14
SHA256 f3bf4d85f5039671c3efe53eea6631df24e94e118f3fa4905ba0dc288174ad0f
MD5 7b913eca5cdfe7190abb68c177b5fa6a
SHA1 a8be4d49bacb7b2ccc6bf195e526595e9871d50e
SHA512 dc86d0c6fd512a443467d154203c5727f4815055021f30eb6844fecd0bd81b15c336e35b5810d766018feb4291370512461920dddf24858b69c277a139ae1f9b
SSDEEP 24576:O2lYDHHhrWn3pr+1UO38LlMM+NhN3UcIxzmz30o9AdZUYRrdEA:oYr+qO3gMMahN3UcIZmzkogUErD
TLSH
T13755BF21795AC036E57102711939AF6A906EBD384B7509CB7BC00F7E99642E36F31F2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

415335

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\build\bin\Win32\Release\ProductAgentService.pdb

kernel32

VerSetConditionMask WaitForMultipleObjects WTSGetActiveConsoleSessionId GetWindowsDirectoryW GetSystemDefaultLocaleName Thread32Next Thread32First SizeofResource TerminateProcess IsWow64Process WideCharToMultiByte GetCurrentThread WaitForSingleObject ProcessIdToSessionId LockResource OpenProcess GetCurrentProcessId K32GetModuleFileNameExW CreateProcessW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetTickCount SetCurrentDirectoryW SetEnvironmentVariableW GetCommandLineW CreateThread GetSystemDirectoryW LoadLibraryExW DecodePointer GetModuleHandleW InitializeCriticalSectionEx RaiseException MultiByteToWideChar LocalFree GetModuleFileNameW GetModuleHandleExW DeleteCriticalSection Sleep CloseHandle LoadResource GetCurrentProcess FindResourceW FreeLibrary GetProcAddress LoadLibraryW GetLastError VerifyVersionInfoW FormatMessageA LocalAlloc WriteConsoleW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapSize HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetStringTypeW CreateDirectoryW CreateFileW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle SetEndOfFile SetFileInformationByHandle SetFilePointerEx AreFileApisANSI CopyFileW MoveFileExW GetFileInformationByHandleEx CreateSymbolicLinkW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetCurrentThreadId GetNativeSystemInfo InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection InitOnceComplete InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork IsProcessorFeaturePresent InitOnceBeginInitialize EncodePointer LCMapStringEx GetSystemTimeAsFileTime CompareStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead RtlUnwind SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree SetConsoleCtrlHandler ExitProcess GetStdHandle WriteFile HeapFree HeapAlloc GetFileType GetFileSizeEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW

user32

PostThreadMessageW GetSystemMetrics

advapi32

CryptReleaseContext CryptDestroyHash CryptCreateHash CryptGetHashParam CryptHashData ConvertSidToStringSidW SetTokenInformation DuplicateTokenEx GetTokenInformation RegEnumKeyW RegQueryInfoKeyW RegQueryValueExW OpenSCManagerW OpenServiceW ImpersonateSelf OpenThreadToken ImpersonateLoggedOnUser RevertToSelf OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW CloseServiceHandle RegSetKeyValueW RegSetValueExW RegOpenKeyExW RegDeleteKeyValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey ControlService StartServiceW QueryServiceStatus RegGetValueW CryptAcquireContextW

shell32

CommandLineToArgvW SHGetKnownFolderPath

ole32

CoUninitialize CoSetProxyBlanket CoCreateInstance CoInitializeEx CoTaskMemFree CoInitializeSecurity

oleaut32

VariantChangeType VariantCopy VariantClear VariantInit SysFreeString SysAllocString

winmm

timeGetTime

shlwapi

PathIsRelativeW

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW

crypt32

CryptUnprotectData CryptBinaryToStringW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-28_7b913eca5cdfe7190abb68c177b5fa6a_amadey_darkgate_elex_luca-stealer_lynx_njrat

kernel32

user32

advapi32

shell32

ole32

oleaut32

winmm

shlwapi

wtsapi32

crypt32

generic