2026-07-06_80c00e1bb486d92c22de4b24218917a8_amadey_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_80c00e1bb486d92c22de4b24218917a8_amadey_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat
Size 1.6MB
Sample260706-ek5ldshv8v
SHA256 43eb05e49ad8684b940bfb246242fd3b9a0334a4af04f207c6ac578bdf5d114e
MD5 80c00e1bb486d92c22de4b24218917a8
SHA1 1fb1069c49a65bd81f1cc75683ed70ffba8a3bed
SHA512 be1301a0410153ddc4459f06b4fc894556f512497f437db47d6961d41a9acce0ded64b267b75d9b8ee9abe4b1d77960760d778a62e4e76f614280656979c9b49
SSDEEP 49152:kVxeck+tWoS/0PUa6xDR40bk+BiTwXFw09:Kxrx4oSM440bkOf
TLSH
T192758C033283C075EC6211B08869DFAB86ADA4345B7148DB67D06E6ED8F22D15E35B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-06_80c00e1bb486d92c22de4b24218917a8_amadey_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat

File Explorer

2026-07-06_80c00e1bb486d92c22de4b24218917a8_amadey_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat

.exe 1.6MB

2026-07-06_80c00e1bb486d92c22de4b24218917a8_amadey_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat

IMPHASH 5dfcee4f18b5dbad341c297eaf956b80
SHA256 43eb05e49ad8684b940bfb246242fd3b9a0334a4af04f207c6ac578bdf5d114e
MD5 80c00e1bb486d92c22de4b24218917a8
SHA1 1fb1069c49a65bd81f1cc75683ed70ffba8a3bed
SHA512 be1301a0410153ddc4459f06b4fc894556f512497f437db47d6961d41a9acce0ded64b267b75d9b8ee9abe4b1d77960760d778a62e4e76f614280656979c9b49
SSDEEP 49152:kVxeck+tWoS/0PUa6xDR40bk+BiTwXFw09:Kxrx4oSM440bkOf
TLSH
T192758C033283C075EC6211B08869DFAB86ADA4345B7148DB67D06E6ED8F22D15E35B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

56:23:08:ec:84:de:e1:8a:18:4d:3b:e8:57:3e:79:bb:c8:b1:f6:b9:1d:61:55:3f:52:c1:d8:16:61:d1:3a:b9

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2306741,CN=McAfee\, LLC,O=McAfee\, LLC,STREET=6220 America Ctr Dr,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jan 24, 2025

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

47:e0:d8:57:8a:b2:00:08:39:19:fa:11

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 13, 2023 - Oct 13, 2026

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

685536

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1@3\build\Win32\Release\SaBsi.pdb

kernel32

WTSGetActiveConsoleSessionId CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess K32EnumProcesses QueryFullProcessImageNameW TerminateProcess GetCurrentProcess GlobalAlloc GetTickCount HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap LoadResource LockResource FindResourceW CreateFileW WriteFile FreeLibrary LoadLibraryW OutputDebugStringW InitializeCriticalSectionEx DeleteCriticalSection GetEnvironmentVariableW FindResourceExW SizeofResource GetFileAttributesExW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetExitCodeProcess CreateProcessW GetFileSize CreateFileMappingW MapViewOfFileEx UnmapViewOfFile MultiByteToWideChar SetEvent CreateEventW CreateSemaphoreW ReleaseSemaphore WaitForMultipleObjects WideCharToMultiByte WritePrivateProfileStringW WritePrivateProfileStructW GetTempFileNameW FindResourceA GetTempPathW CreateDirectoryW FindNextFileW FindFirstFileW GetFileAttributesW MoveFileExW DeleteFileW FindClose LocalFree GetLongPathNameW GetModuleFileNameW ReleaseMutex WaitForSingleObject GetLastError CreateMutexW GetProcAddress GetModuleHandleW CloseHandle GetCurrentProcessId DecodePointer GlobalFree Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection GetSystemWow64DirectoryW GetSystemDirectoryW IsWow64Process2 GetLargePageMinimum RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA FormatMessageA GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId QueryPerformanceCounter InitOnceBeginInitialize InitOnceComplete GetLocaleInfoEx FindFirstFileExW GetFinalPathNameByHandleW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx WaitForSingleObjectEx GetExitCodeThread GetNativeSystemInfo EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetSystemTimeAsFileTime CompareStringEx GetCPInfo InitializeCriticalSectionAndSpinCount ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwind InterlockedPushEntrySList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle GetFileType GetModuleHandleExW WriteConsoleW CreateThread ExitThread FreeLibraryAndExitThread ExitProcess GetTimeZoneInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle ReadConsoleW SetEndOfFile FormatMessageW IsWow64Process RtlCaptureContext RaiseFailFastException

advapi32

RegDeleteTreeW RegDeleteKeyValueW RegQueryInfoKeyW RegEnumValueW SetNamedSecurityInfoW GetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyExW RegSetValueExA RegSetValueExW RegCreateKeyExW RegQueryValueExW RegQueryValueExA RegCloseKey

shell32

CommandLineToArgvW SHGetSpecialFolderPathW SHGetKnownFolderPath

ole32

StringFromGUID2 CoCreateGuid StringFromCLSID CoCreateInstance CoUninitialize CoTaskMemFree CoInitializeEx OleRun

oleaut32

SysAllocString SysFreeString VarUdateFromDate VariantTimeToSystemTime SystemTimeToVariantTime VariantClear

shlwapi

PathFileExistsW StrRChrW PathFindExtensionW

Name

.text

Size

965KB

Virtual Size

965KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

324KB

Virtual Size

324KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

136KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_80c00e1bb486d92c22de4b24218917a8_amadey_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat

PE Signature issue

kernel32

advapi32

shell32

ole32

oleaut32

shlwapi

generic