2026-06-30_79582c18d6509b02e71a0e5f7052eac9_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_79582c18d6509b02e71a0e5f7052eac9_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat
Size 28.8MB
Sample260701-evn2dsf16t
SHA256 7de4e6a7540901f753b3b2356fc9ef3595fcf218a053e38d82d443343c7f4b2e
MD5 79582c18d6509b02e71a0e5f7052eac9
SHA1 941d89f26eb4a61e467bb04e184fc9629a79c2dd
SHA512 53ea1bccf153cb8889074a99d533f6b7d6245c39d006e5d1f35f530905c21087da567092278dacb990679bb4c88d891886178cb6214b691a52fa23d8c1a2dfa5
SSDEEP 786432:LStGzntUlotzi4F0fZGfeDyO38IpJBobWgIZCi0g6xviD:mtGzntU+tzi4F0fUfBIpJBgHIQguq
TLSH
T193677D62B686827BD55200F15A3D9F6F831CBE5507A005DB47ECB6AA3D309D30E36B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-06-30_79582c18d6509b02e71a0e5f7052eac9_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat

File Explorer

2026-06-30_79582c18d6509b02e71a0e5f7052eac9_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat

.exe 28.8MB

2026-06-30_79582c18d6509b02e71a0e5f7052eac9_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat

IMPHASH 6d984553b297db58074232d8a09a1a81
SHA256 7de4e6a7540901f753b3b2356fc9ef3595fcf218a053e38d82d443343c7f4b2e
MD5 79582c18d6509b02e71a0e5f7052eac9
SHA1 941d89f26eb4a61e467bb04e184fc9629a79c2dd
SHA512 53ea1bccf153cb8889074a99d533f6b7d6245c39d006e5d1f35f530905c21087da567092278dacb990679bb4c88d891886178cb6214b691a52fa23d8c1a2dfa5
SSDEEP 786432:LStGzntUlotzi4F0fZGfeDyO38IpJBobWgIZCi0g6xviD:mtGzntU+tzi4F0fUfBIpJBgHIQguq
TLSH
T193677D62B686827BD55200F15A3D9F6F831CBE5507A005DB47ECB6AA3D309D30E36B27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

14:6e:48:5b:22:c0:d7:42:16:11:5b:16:86:f5:65:f9:33:31:52:76

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,ST=Baden-Württemberg,C=DE

Chains

Jul 2, 2020

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,ST=Baden-Württemberg,C=DE

Subject

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,ST=Baden-Württemberg,C=DE

Serial Number

0b:44:65:46:c3:65:25:bf:5f:08:4f:6b:bb:ba:70:97

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 19, 2019 - Dec 23, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

Major OS version

Entry point

21371808

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\JA\workspace\tv_publicrelease-windows\build_cmake_win\QJ\Release\TeamViewer.pdb

dwmapi

DwmDefWindowProc DwmGetColorizationColor DwmExtendFrameIntoClientArea DwmIsCompositionEnabled DwmGetWindowAttribute

kernel32

SystemTimeToTzSpecificLocalTime SetThreadExecutionState GetProcessTimes GetSystemTimes WriteConsoleW GetCommandLineA LoadLibraryExA GetModuleHandleA GetModuleFileNameA GetSystemDirectoryA InitializeCriticalSectionEx FormatMessageW GetLastError SetEvent CloseHandle RaiseException DecodePointer LocalFree DeleteCriticalSection WideCharToMultiByte FormatMessageA CreateEventA GetCurrentThreadId WaitForSingleObjectEx Sleep SetLastError EnterCriticalSection LeaveCriticalSection HeapFree WaitForMultipleObjects WaitForSingleObject HeapSize PostQueuedCompletionStatus TerminateThread TlsAlloc HeapReAlloc HeapAlloc QueueUserAPC HeapDestroy GetProcessHeap TlsFree InitializeCriticalSection GetSystemTimeAsFileTime TlsGetValue SetWaitableTimer GetQueuedCompletionStatus TlsSetValue SleepEx CreateEventW CreateIoCompletionPort InitializeCriticalSectionAndSpinCount VerifyVersionInfoW VerSetConditionMask CreateWaitableTimerW GetTickCount GetCurrentProcess MulDiv GlobalAlloc GlobalFree GlobalSize GlobalLock GlobalUnlock GetPrivateProfileStringW WritePrivateProfileStringW GetCommandLineW ExpandEnvironmentStringsW SetErrorMode SetProcessShutdownParameters GetModuleFileNameW CreateMutexW ReleaseMutex MoveFileExW GetTempPathW CreateDirectoryW GetUserGeoID GetGeoInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW GetLogicalProcessorInformation GetSystemInfo GlobalMemoryStatusEx GetComputerNameW DeleteFileW MoveFileW FileTimeToSystemTime GetLocalTime SystemTimeToFileTime SetFilePointer GetFileInformationByHandle GetFileSize ReadFile CreateFileW CreateFileMappingW MapViewOfFile WriteFile UnmapViewOfFile LocalAlloc GetFileAttributesW GetCurrentDirectoryW MultiByteToWideChar LocalFileTimeToFileTime SetFileTime ResetEvent OpenEventA GetCurrentProcessId SetSearchPathMode SetDllDirectoryW HeapSetInformation SetProcessDEPPolicy GetTickCount64 IsWow64Process UnregisterWaitEx OpenProcess FindFirstFileW FindNextFileW FindClose WaitNamedPipeW ResumeThread CreateProcessW TerminateProcess K32GetModuleBaseNameW QueryFullProcessImageNameW K32GetModuleFileNameExW K32EnumProcesses GetProcessId ProcessIdToSessionId WTSGetActiveConsoleSessionId RegisterWaitForSingleObject GetExitCodeProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW SetThreadPriority LoadLibraryW LoadLibraryExW GetProcAddress FreeLibrary GetSystemDirectoryW GetDynamicTimeZoneInformation GetTimeZoneInformation GetTimeFormatW GetDateFormatW TzSpecificLocalTimeToSystemTime SetFilePointerEx OpenMutexW DuplicateHandle CreateSemaphoreA ReleaseSemaphore GetNativeSystemInfo GetSystemPowerStatus GetModuleHandleW lstrcmpiW SizeofResource LoadResource FindResourceW OpenEventW LockResource FindResourceExW QueryPerformanceCounter QueryPerformanceFrequency GetSystemDefaultLangID lstrlenW GlobalReAlloc CopyFileW lstrcmpW GlobalHandle GetCurrentThread DeviceIoControl GetOverlappedResult GetVolumeInformationW K32EnumProcessModules GetSystemFirmwareTable GetTempFileNameW GetFileAttributesExW GetDriveTypeW GetLogicalDriveStringsW SetFileAttributesW SetEndOfFile CreateThread GetExitCodeThread WakeConditionVariable SleepConditionVariableCS InitializeConditionVariable CreateSemaphoreW TryEnterCriticalSection WakeAllConditionVariable GetPriorityClass SetPriorityClass GetStdHandle IsDebuggerPresent OutputDebugStringA SetUnhandledExceptionFilter Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetPrivateProfileIntW GetPrivateProfileSectionW ExpandEnvironmentStringsA GetFileSizeEx SwitchToThread CreateFileMappingA OpenFileMappingA MapViewOfFileEx GetThreadTimes FindFirstFileExW VirtualProtect VirtualQuery GetStringTypeW EncodePointer GetCPInfo CompareStringW LCMapStringW OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryA GetStringTypeExW LCMapStringA GetUserDefaultLCID GetStringTypeExA GetEnvironmentVariableW GetFileTime GetFullPathNameW RemoveDirectoryW GetWindowsDirectoryW CreateDirectoryExW AreFileApisANSI WaitForMultipleObjectsEx CreateWaitableTimerA UnhandledExceptionFilter GetStartupInfoW CreateTimerQueue SignalObjectAndWait GetThreadPriority CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask UnregisterWait FreeLibraryAndExitThread GetVersionExW InterlockedFlushSList QueryDepthSList RtlUnwind ExitThread GetModuleHandleExW ExitProcess GetFileType PeekNamedPipe SetEnvironmentVariableW GetConsoleMode ReadConsoleW GetConsoleCP IsValidLocale EnumSystemLocalesW FlushFileBuffers SetStdHandle IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW

Name

.text

Size

22.5MB

Virtual Size

22.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

842KB

Virtual Size

952KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

298KB

Virtual Size

297KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=211, id=261, version=26213,

count=1, id=149, productName=VS2008 build 21022, version=21022,

count=5, id=199, version=41118,

count=35, id=259, version=26706,

count=40, id=260, version=26706,

count=45, id=259, version=26213,

count=147, id=261, version=26706,

count=58, id=260, version=26213,

count=5, id=262, version=26213,

count=134, id=205, version=50522,

count=5, id=257, version=26213,

count=2, id=263, version=26213,

count=199, id=261, version=27034,

count=54, id=260, version=27034,

count=2, id=171, productName=VS2010 build 30319, version=30319,

count=1, id=260, version=26715,

count=1020, productName=Unmarked objects (old),

count=532, id=260, version=27031,

count=118, id=261, version=27031,

count=955, id=1, productName=Unmarked objects,

count=3822, id=265, version=27034,

count=1, id=255, version=27034,

count=1, id=151,

count=1, id=258, version=27034,