2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat
Size 3.5MB
Sample260629-2bd4eagw6t
SHA256 e5402e78b469cb9ea076c5e24eb5653dca0feb72b850f06347b5911cb238d450
MD5 53dc00b0d924c399f0f7e4eb8a7ae4ac
SHA1 174059841f02b30e17d50f7b0189ca19b98b6365
SHA512 dc878801c98c314e187cca31ef6de935d48a90f2cba05bd1a99761b11f6f1888ef5bdcd341ba612264375cd762830a485ded86b53eb7994ee6ff8ddbfd506289
SSDEEP 98304:R4Z/RUixPo/hVxtVNDO57g4NRvMJRQjUXdWPt:RVi6/Hf4NRvPAXc
TLSH
T19806F132B1038136C2F51230D02ADB96402A6D78973548DFABD93E2D7F7D1D39A75A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

installer

Malware Config

Signatures

Custom signature

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

File Explorer

2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat

.exe 3.5MB

2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat

IMPHASH 8e833527413e37736523e5e51c03608e
SHA256 e5402e78b469cb9ea076c5e24eb5653dca0feb72b850f06347b5911cb238d450
MD5 53dc00b0d924c399f0f7e4eb8a7ae4ac
SHA1 174059841f02b30e17d50f7b0189ca19b98b6365
SHA512 dc878801c98c314e187cca31ef6de935d48a90f2cba05bd1a99761b11f6f1888ef5bdcd341ba612264375cd762830a485ded86b53eb7994ee6ff8ddbfd506289
SSDEEP 98304:R4Z/RUixPo/hVxtVNDO57g4NRvMJRQjUXdWPt:RVi6/Hf4NRvPAXc
TLSH
T19806F132B1038136C2F51230D02ADB96402A6D78973548DFABD93E2D7F7D1D39A75A3A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects executables packed with VMProtect.
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

274842

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\广告相关\桌标\Release\桌标.pdb

kernel32

GetWindowsDirectoryA SetFileAttributesA DecodePointer GetFileSize DeleteCriticalSection CreateDirectoryA GetProcessTimes DeviceIoControl WriteFile ReadFile GetModuleFileNameA OpenEventA SizeofResource WaitNamedPipeA EnterCriticalSection OutputDebugStringA TerminateProcess LeaveCriticalSection InitializeCriticalSection FindResourceA FindClose CreateMutexA GetCurrentThreadId ResumeThread GetModuleHandleA FreeResource OpenMutexA SetEvent LockResource LoadResource GetLocalTime CreateFileMappingA LocalFree GetCurrentProcessId WideCharToMultiByte OpenThread SetUnhandledExceptionFilter WaitForSingleObject RaiseException GetTickCount MultiByteToWideChar SetFilePointer CreateFileW LocalFileTimeToFileTime GetCurrentDirectoryW SystemTimeToFileTime WaitForSingleObjectEx ResetEvent DeleteFileA CreateFileA GetLastError WriteConsoleW SetEndOfFile HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW Sleep DuplicateHandle InitializeCriticalSectionEx GetPrivateProfileStringA MapViewOfFile OpenFileMappingA GetLogicalDriveStringsA CloseHandle Process32FirstW Process32NextW GetCurrentProcess GetFileAttributesA CreateToolhelp32Snapshot OpenProcess UnmapViewOfFile QueryDosDeviceA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapReAlloc FlushFileBuffers GetFileType HeapAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP HeapFree EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW K32GetProcessImageFileNameA CreateEventA GetStringTypeW EncodePointer LCMapStringEx GetCPInfo InitializeSListHead UnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetSystemTimeAsFileTime OutputDebugStringW QueryPerformanceFrequency RtlUnwind InterlockedPushEntrySList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW CompareStringW CreateEventW

user32

wsprintfA

advapi32

ProcessTrace BuildExplicitAccessWithNameA SetEntriesInAclA ControlTraceA RegCloseKey StopTraceA SetNamedSecurityInfoA EnableTraceEx StartTraceA GetNamedSecurityInfoA RegOpenKeyExA RegDeleteValueA RegEnumKeyExA OpenTraceA LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

shell32

ShellExecuteA SHChangeNotify SHGetSpecialFolderPathA

ole32

CoCreateGuid CoInitialize

psapi

GetProcessImageFileNameA

shlwapi

StrStrIA

wininet

InternetQueryOptionA InternetConnectA InternetCloseHandle InternetOpenA InternetReadFile InternetSetOptionA HttpOpenRequestA HttpQueryInfoA HttpSendRequestA

iphlpapi

GetAdaptersInfo

Name

.text

Size

464KB

Virtual Size

463KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat

kernel32

user32

advapi32

shell32

ole32

psapi

shlwapi

wininet

iphlpapi

generic