2026-07-03_5fb3a95acd46ede9b3c9dedb4bde7a34_amadey_darkgate_elex_floxif_glassworm_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-03_5fb3a95acd46ede9b3c9dedb4bde7a34_amadey_darkgate_elex_floxif_glassworm_luca-stealer_lynx_njrat
Size 1002KB
Sample260703-e2k83sbt7y
SHA256 1c955f9343e4569c1d61b93a1721bde26c7c8a61f51d0f3adfc1df07518f8c06
MD5 5fb3a95acd46ede9b3c9dedb4bde7a34
SHA1 7cd47a9b0e7c5b320bfe50b12d7c0a2c20fc3f83
SHA512 2b87611d871970cf782506f521912261063f543bb34b62a658648ae089210bb7a23730d221af64b6d932814214b498ce13373ff182be289aab54c3a64eefbf8e
SSDEEP 24576:C4pVMY5kynAkO/kFthiYnOTEybYUstecirEH7a:pJkH/kFthiYOTEybYUi8
TLSH
T173259E317296D172D06240B09928AEB764ACBC2C4BB636DFB3D47F6D38741C25E34B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-03_5fb3a95acd46ede9b3c9dedb4bde7a34_amadey_darkgate_elex_floxif_glassworm_luca-stealer_lynx_njrat

File Explorer

2026-07-03_5fb3a95acd46ede9b3c9dedb4bde7a34_amadey_darkgate_elex_floxif_glassworm_luca-stealer_lynx_njrat

.exe 1002KB

2026-07-03_5fb3a95acd46ede9b3c9dedb4bde7a34_amadey_darkgate_elex_floxif_glassworm_luca-stealer_lynx_njrat

IMPHASH 924a35a18e0a1989b5fd00f0e44bc971
SHA256 1c955f9343e4569c1d61b93a1721bde26c7c8a61f51d0f3adfc1df07518f8c06
MD5 5fb3a95acd46ede9b3c9dedb4bde7a34
SHA1 7cd47a9b0e7c5b320bfe50b12d7c0a2c20fc3f83
SHA512 2b87611d871970cf782506f521912261063f543bb34b62a658648ae089210bb7a23730d221af64b6d932814214b498ce13373ff182be289aab54c3a64eefbf8e
SSDEEP 24576:C4pVMY5kynAkO/kFthiYnOTEybYUstecirEH7a:pJkH/kFthiYOTEybYUi8
TLSH
T173259E317296D172D06240B09928AEB764ACBC2C4BB636DFB3D47F6D38741C25E34B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

8f:9a:da:a9:8d:85:c6:e1:e2:2a:ba:2e:7a:18:d8:1e:07:12:e1:e0:71:62:e4:15:4f:65:2d:8d:79:e6:43:bf

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jun 5, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

07:4f:bf:17:05:09:33:a4:1c:8d:93:c8:7b:aa:2a:b1

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 6, 2025 - Oct 5, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

434912

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\ccd-app\nightly_build\build\msvs_win32_x86\Release\x86\sym\AdobeUpdateService\AdobeUpdateService\AdobeUpdateService.pdb

kernel32

WideCharToMultiByte CopyFileW GetExitCodeProcess QueryPerformanceFrequency FreeLibrary GetProcAddress CloseHandle DeleteFileW MultiByteToWideChar SetFileAttributesW OpenProcess WaitForSingleObject FindClose GetTempPathW GetModuleFileNameW GetCurrentProcess FindNextFileW FindFirstFileW DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GetProcessHeap HeapAlloc CreateThread GetLastError Sleep HeapFree ResumeThread SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW ReadConsoleW EnumSystemLocalesW IsValidLocale GetLocaleInfoW CompareStringW GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileType GetCommandLineW GetCommandLineA GetModuleHandleExW ExitProcess GetStdHandle GetTimeZoneInformation LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InterlockedPushEntrySList VerifyVersionInfoW RtlUnwind RaiseException OutputDebugStringW GetStartupInfoW IsDebuggerPresent GetFileSizeEx CreateFileW SetLastError TerminateProcess LocalAlloc HeapSize CreateToolhelp32Snapshot CreateEventW ProcessIdToSessionId Process32NextW SetEvent GlobalAlloc Process32FirstW GlobalFree HeapReAlloc ResetEvent LocalFree GetCurrentProcessId GetModuleHandleW lstrcmpiW lstrcmpW ReadFile EnterCriticalSection WriteFile CreateNamedPipeW LeaveCriticalSection InitializeCriticalSection ConnectNamedPipe SetFilePointer GetCurrentThreadId GetFileAttributesW MoveFileExW FlushFileBuffers GetFileInformationByHandle GetUserDefaultLangID FileTimeToSystemTime GetLocalTime GetTimeFormatW SystemTimeToFileTime GetDateFormatW CreateMutexW ReleaseMutex OpenMutexW GetVersionExW GetUserDefaultUILanguage LCMapStringW GetUserDefaultLCID GetStringTypeW EncodePointer LCMapStringEx GetCPInfo InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime VerSetConditionMask

advapi32

CryptGenRandom GetTokenInformation DuplicateTokenEx CreateProcessAsUserW FreeSid AllocateAndInitializeSid EqualSid GetNamedSecurityInfoW RegQueryValueExW RegOpenKeyExW RegCloseKey OpenProcessToken StartServiceCtrlDispatcherW CryptReleaseContext CryptAcquireContextA RegisterServiceCtrlHandlerW SetServiceStatus

shell32

SHGetSpecialFolderPathW SHCreateDirectoryExW SHGetFolderLocation SHGetPathFromIDListW SHGetFolderPathW

ole32

StringFromGUID2 CoTaskMemFree CoCreateGuid CoInitialize CoUninitialize

oleaut32

VariantClear

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQueryUserToken

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

shlwapi

PathFileExistsW PathIsDirectoryW PathFindFileNameW PathRemoveFileSpecW PathRenameExtensionW PathIsFileSpecW PathAddExtensionW PathRemoveExtensionW PathAppendW

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain WTHelperGetProvCertFromChain WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-03_5fb3a95acd46ede9b3c9dedb4bde7a34_amadey_darkgate_elex_floxif_glassworm_luca-stealer_lynx_njrat

PE Signature issue

kernel32

advapi32

shell32

ole32

oleaut32

wtsapi32

userenv

version

shlwapi

crypt32

wintrust

generic