2026-06-02_7d6de5f0b89b37c390ae1c7614cb6374_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-02_7d6de5f0b89b37c390ae1c7614cb6374_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat
Size 4.2MB
Sample260602-v2byeabw3t
SHA256 4a75a0c819b96027e60399b8753510481dbc5f538dc1e50b49d5f42a20851ec0
MD5 7d6de5f0b89b37c390ae1c7614cb6374
SHA1 ba517957461f2025cf90a11eb2b6af0b6564a9b3
SHA512 531fa38a093007e209036234c1d84abab128a70d71d76ad3500cc1afcd21269c09220b9516392759b7c8172a5d625cabbbd6c16c0f74d3962907f0d441bc810c
SSDEEP 98304:s8OMeY5tYYszAVALvpeGurBtXwZwn6vD527BWG:sjMeUtYYszAVALvcIVQBWG
TLSH
T129268E603686C135D672117A4EBDBFBB8C1DA8251BB051CB92C58F6E29211D32F36F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-02_7d6de5f0b89b37c390ae1c7614cb6374_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

File Explorer

2026-06-02_7d6de5f0b89b37c390ae1c7614cb6374_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

.exe 4.2MB

2026-06-02_7d6de5f0b89b37c390ae1c7614cb6374_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

IMPHASH 8976d8d03da8a522c6b40328f9ee2d0f
SHA256 4a75a0c819b96027e60399b8753510481dbc5f538dc1e50b49d5f42a20851ec0
MD5 7d6de5f0b89b37c390ae1c7614cb6374
SHA1 ba517957461f2025cf90a11eb2b6af0b6564a9b3
SHA512 531fa38a093007e209036234c1d84abab128a70d71d76ad3500cc1afcd21269c09220b9516392759b7c8172a5d625cabbbd6c16c0f74d3962907f0d441bc810c
SSDEEP 98304:s8OMeY5tYYszAVALvpeGurBtXwZwn6vD527BWG:sjMeUtYYszAVALvcIVQBWG
TLSH
T129268E603686C135D672117A4EBDBFBB8C1DA8251BB051CB92C58F6E29211D32F36F1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2040176

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\buildagent-cd_8818\p4\989747040\services\AMTSW\Release\UNS\Release\lms.pdb

kernel32

GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW MultiByteToWideChar GetFileSizeEx SetEnvironmentVariableW SetStdHandle FindFirstFileExW IsValidCodePage LocalAlloc LocalFree FormatMessageW GetOEMCP GetFullPathNameW FreeLibraryAndExitThread ExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW VirtualQuery VirtualProtect GetCommandLineA VirtualAlloc GetModuleHandleExW FreeEnvironmentStringsW RtlUnwind GetCurrentDirectoryW SetConsoleCtrlHandler GetConsoleMode ReadConsoleW GetConsoleOutputCP HeapSize HeapReAlloc LCMapStringW lstrcmpiW FindResourceW GetDateFormatW WriteConsoleW LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary GetCurrentThreadId GetCurrentThread GetTimeFormatW OutputDebugStringW GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo CompareStringEx GetLocaleInfoEx LCMapStringEx EncodePointer GetStringTypeW WaitForSingleObjectEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock GetFileInformationByHandle WaitForMultipleObjects WaitForMultipleObjectsEx QueryPerformanceFrequency SizeofResource CompareStringW GetTimeZoneInformation ExpandEnvironmentStringsW GetComputerNameExW WideCharToMultiByte CreateFileW GetFinalPathNameByHandleW LoadLibraryW CreateThread GetCurrentProcess CreateEventW lstrlenW WaitForSingleObject SetEvent DeleteCriticalSection IsWow64Process VerSetConditionMask OutputDebugStringA VerifyVersionInfoW GetSystemPowerStatus QueryPerformanceCounter GetComputerNameA GetSystemInfo GetACP GetCurrentProcessId InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection HeapAlloc HeapFree GetProcessHeap GetSystemDefaultLCID GetSystemTime SetFilePointer SetEndOfFile CreateFileA CancelIo ReadFile WriteFile DeviceIoControl GetOverlappedResult InitializeCriticalSectionAndSpinCount FlushFileBuffers GlobalFree GlobalAlloc SetLastError InitializeCriticalSection TryEnterCriticalSection SetThreadPriority ResumeThread GetLastError RaiseException CloseHandle DuplicateHandle TlsAlloc TlsGetValue TlsSetValue TlsFree RegisterWaitForSingleObject UnregisterWait GetModuleHandleA GetModuleFileNameA GetSystemDirectoryA LoadLibraryA TerminateProcess GetStdHandle DecodePointer GetCommandLineW SetDllDirectoryW Sleep ResetEvent ReleaseSemaphore ReleaseMutex CreateMutexW CreateEventA CreateSemaphoreW GetExitCodeThread SuspendThread GetThreadId GetSystemTimeAsFileTime FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetEnvironmentStringsW ExitProcess GetVersionExW LockFileEx SetFilePointerEx UnlockFileEx LoadLibraryExA

advapi32

RegCreateKeyW InitiateSystemShutdownExW LookupPrivilegeValueW AdjustTokenPrivileges SetEntriesInAclW RegSetKeySecurity RegDeleteKeyExW SetSecurityDescriptorDacl FreeSid AllocateAndInitializeSid ChangeServiceConfig2W CloseServiceHandle OpenProcessToken OpenThreadToken ControlService CreateServiceW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW CopySid GetLengthSid GetTokenInformation InitializeSecurityDescriptor IsValidSid SetSecurityDescriptorGroup SetSecurityDescriptorOwner RegCreateKeyExW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey ConvertSidToStringSidW LookupAccountSidW EqualSid CreateWellKnownSid StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW OpenServiceW OpenSCManagerW DeleteService ChangeServiceConfigW

user32

GetMessageW CharUpperW CharNextW PostThreadMessageW UnregisterDeviceNotification TranslateMessage LoadStringW DispatchMessageW RegisterDeviceNotificationW MessageBoxW

ole32

CoUninitialize CoCreateInstance StringFromGUID2 CoInitializeEx CoResumeClassObjects CoTaskMemFree CoAddRefServerProcess CoRegisterClassObject CoTaskMemAlloc PropVariantClear CoImpersonateClient CoRevertToSelf CoReleaseServerProcess CoRevokeClassObject CoTaskMemRealloc CoSetProxyBlanket CoInitializeSecurity

oleaut32

SysAllocStringByteLen SysStringByteLen VariantClear VariantChangeType VariantInit SysAllocString SysFreeString SysStringLen VarUI4FromStr LoadTypeLi RegisterTypeLi UnRegisterTypeLi VarBstrCat LoadRegTypeLi SafeArrayCreate SafeArrayGetUBound SafeArrayGetLBound SafeArrayLock SafeArrayUnlock SafeArrayPutElement SafeArrayCreateVector SysAllocStringLen

iphlpapi

IpRenewAddress GetInterfaceInfo GetPerAdapterInfo GetAdaptersInfo GetIpAddrTable CancelIPChangeNotify NotifyRouteChange CancelMibChangeNotify2 NotifyIpInterfaceChange GetAdaptersAddresses SetTcpEntry GetExtendedTcpTable

cfgmgr32

CM_Get_Device_Interface_ListA CM_Get_Device_Interface_List_SizeA

crypt32

CertCloseStore CryptMsgGetParam CryptMsgClose CertFreeCertificateContext CertGetNameStringW CryptQueryObject CertOpenStore CertGetNameStringA CertFindCertificateInStore

ws2_32

WSAAddressToStringA freeaddrinfo getaddrinfo WSAAccept WSAGetLastError getsockopt shutdown setsockopt send inet_addr recv ntohs listen htons getsockname getpeername ioctlsocket connect closesocket bind __WSAFDIsSet inet_ntoa htonl gethostbyaddr gethostbyname getservbyport WSASend getservbyname WSAStartup accept WSACloseEvent WSACleanup gethostname WSASetLastError ntohl WSACreateEvent getnameinfo WSAEventSelect WSAEnumNetworkEvents select socket

wintrust

WinVerifyTrust

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winhttp

WinHttpQueryAuthSchemes WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpOpen WinHttpSetCredentials WinHttpQueryHeaders WinHttpSendRequest WinHttpReceiveResponse

shell32

SHGetSpecialFolderPathW

api-ms-win-power-setting-l1-1-0

PowerReadDCValue PowerReadACValue

api-ms-win-power-base-l1-1-0

GetPwrCapabilities

powrprof

SetSuspendState

rpcrt4

UuidCreate UuidToStringA RpcStringFreeA

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

758KB

Virtual Size

757KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

173KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

828KB

Virtual Size

832KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=22, id=259, version=29395,

count=252, id=261, version=29395,

count=5, id=253, version=28518,

count=19, id=260, version=29804,

count=26, id=259, version=29804,

count=116, id=261, version=30152,

count=35, id=260, version=30152,

count=2, id=260, productName=VS2019 v16.8.4 build 29336, version=29336,

count=16, id=257, version=29395,

count=101, id=261, version=29804,

count=438, id=1, productName=Unmarked objects,

count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=31, id=260, version=29395,

count=385, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,

count=29, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,

count=1, id=256, productName=VS2019 v16.9.2 build 29913, version=29913,

count=1, id=255, productName=VS2019 v16.9.2 build 29913, version=29913,

count=2, id=151,

count=1, id=258, productName=VS2019 v16.9.2 build 29913, version=29913,