2026-07-07_0481643d684e849a52b83bd08841d87c_amadey_darkgate_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-07_0481643d684e849a52b83bd08841d87c_amadey_darkgate_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_njrat
Size 8.6MB
Sample260707-t4yphsaw6r
SHA256 00afaa904cc60ce75a9a200ae5d702160b51df1271f478de0f50ab4bf2ed3e02
MD5 0481643d684e849a52b83bd08841d87c
SHA1 8927380d9cf63b8acc2a848f865bff527c63c064
SHA512 c9730ee7df96f1e5a0392a93edd53b31b87970f55735467691f3bb20a0a5b20f2d0352d7a970ed4a451fb170c0f304e7b8e45093a00e12324308676b5b173af2
SSDEEP 196608:Q45JoA+rUX+B8k7uHmovJrlFzQO7iYWyaP3BeZFTzeMG8JGx:OrUXqgmohrlxriYWpPBeZVI8+
TLSH
T14996BF3375C080B7D15202B0A98CBB9597FDF9700A72969BAB8C361D2F718C1AB36757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-07_0481643d684e849a52b83bd08841d87c_amadey_darkgate_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_njrat

File Explorer

2026-07-07_0481643d684e849a52b83bd08841d87c_amadey_darkgate_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_njrat

.exe 8.6MB

2026-07-07_0481643d684e849a52b83bd08841d87c_amadey_darkgate_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_njrat

IMPHASH 000be447f074278bb98f09367f4b4617
SHA256 00afaa904cc60ce75a9a200ae5d702160b51df1271f478de0f50ab4bf2ed3e02
MD5 0481643d684e849a52b83bd08841d87c
SHA1 8927380d9cf63b8acc2a848f865bff527c63c064
SHA512 c9730ee7df96f1e5a0392a93edd53b31b87970f55735467691f3bb20a0a5b20f2d0352d7a970ed4a451fb170c0f304e7b8e45093a00e12324308676b5b173af2
SSDEEP 196608:Q45JoA+rUX+B8k7uHmovJrlFzQO7iYWyaP3BeZFTzeMG8JGx:OrUXqgmohrlxriYWpPBeZVI8+
TLSH
T14996BF3375C080B7D15202B0A98CBB9597FDF9700A72969BAB8C361D2F718C1AB36757
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d7:26:fd:71:65:63:a1:37:3d:39:db:40:61:d9:51:30:37:50:a2:ef:85:cd:24:7e:aa:a7:c2:bd:e3:c9:2f:42

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

Chains

Nov 26, 2025

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

Serial Number

0d:d1:cb:d1:68:65:b1:63:9d:b9:84:5c:ce:cb:d2:a2

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 31, 2023 - Jan 30, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

5454018

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins-workspace\workspace\token-wallet-pipeline\build\MinSizeRel\helper.pdb

advapi32

RegCloseKey RegOpenKeyExW InitializeSecurityDescriptor SetSecurityDescriptorDacl RegGetValueW RegGetValueA RegEnumKeyExA RegOpenKeyExA RegQueryValueExA SystemFunction036

iphlpapi

FreeMibTable GetUnicastIpAddressTable GetAdaptersAddresses GetBestRoute2

ws2_32

setsockopt select ntohs WSARecvFrom bind closesocket connect ioctlsocket getsockname getsockopt htonl htons listen WSAStartup getservbyname send recvfrom recv gethostname WSACleanup WSAConnect inet_pton getpeername WSAGetOverlappedResult socket inet_ntop shutdown freeaddrinfo getaddrinfo WSARecv WSAIoctl accept __WSAFDIsSet WSASocketW WSASend WSAGetLastError WSASetLastError ntohl

crypt32

CryptUnprotectData CryptBinaryToStringW CertCloseStore CertFreeCertificateContext CertEnumCertificatesInStore CryptProtectData CertOpenSystemStoreW

dbghelp

SymGetModuleBase64 SymInitialize SymFromAddr StackWalk64 SymFunctionTableAccess64 SymSetOptions SymGetOptions

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winhttp

WinHttpCrackUrl WinHttpOpen WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSetCredentials WinHttpSendRequest WinHttpOpenRequest WinHttpConnect WinHttpCloseHandle

kernel32

GetDriveTypeW SetConsoleCtrlHandler GetModuleHandleExW ExitThread RtlUnwind QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore FreeLibraryAndExitThread UnregisterWait SetThreadAffinityMask ReadConsoleW GetConsoleCP GetTimeZoneInformation ExitProcess GetStdHandle GetDateFormatW GetTimeFormatW IsValidLocale GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SetThreadPriority SignalObjectAndWait CreateTimerQueue GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter InitializeSListHead ResetEvent GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW DecodePointer EncodePointer InitOnceComplete VerSetConditionMask CloseHandle GetLastError SetLastError CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent WaitForSingleObject SleepEx CreateEventW SetWaitableTimer Sleep WaitForMultipleObjects CreateWaitableTimerW QueueUserAPC GetCurrentProcessId GetCurrentThreadId TerminateThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleFileNameW LocalFree FormatMessageA FormatMessageW VerifyVersionInfoW GetDynamicTimeZoneInformation WideCharToMultiByte InitializeCriticalSection GetSystemTimeAsFileTime GetFileAttributesA SwitchToThread GetCurrentProcess DuplicateHandle CreateMutexA ReleaseMutex UnmapViewOfFile CreateFileMappingA MapViewOfFileEx OpenFileMappingA GetSystemInfo GetProcAddress GetModuleHandleA GetUserDefaultLCID FreeEnvironmentStringsW CreateFileA AreFileApisANSI SetHandleInformation TerminateProcess GetExitCodeProcess CreateProcessW GetSystemDirectoryW UnregisterWaitEx RegisterWaitForSingleObject MultiByteToWideChar VirtualLock FlushFileBuffers GetTickCount QueryPerformanceCounter PeekNamedPipe CreateFileMappingW GetSystemTime FreeLibrary SystemTimeToFileTime GetProcessHeap GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc DeleteFileW DeleteFileA GetVersionExA WaitForSingleObjectEx LoadLibraryA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate GetVersionExW GetFileAttributesW CreateFileW CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate ReadFile TryEnterCriticalSection ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared ExpandEnvironmentStringsA GetWindowsDirectoryA GetEnvironmentVariableW SetEnvironmentVariableW QueryPerformanceFrequency GetCurrentProcessorNumber CreateThread InitializeSRWLock InitOnceExecuteOnce GetCurrentDirectoryW FindClose FindFirstFileW FindNextFileW InitializeConditionVariable WakeConditionVariable SleepConditionVariableSRW VirtualAlloc VirtualFree LoadLibraryExW GetLogicalProcessorInformation GetModuleHandleW SetCurrentDirectoryW CreateDirectoryW GetFileInformationByHandle RemoveDirectoryW SetFilePointerEx DeviceIoControl MoveFileExW GetCurrentThread GetThreadId SetUnhandledExceptionFilter SetErrorMode GetTickCount64 VirtualQuery CreateToolhelp32Snapshot Module32FirstW Module32NextW RtlCaptureStackBackTrace RaiseException SleepConditionVariableCS GetModuleFileNameA GetThreadTimes VirtualProtect InitOnceBeginInitialize GetStringTypeW GetExitCodeThread EnumSystemLocalesW GetFileSizeEx IsValidCodePage SystemTimeToTzSpecificLocalTime GetACP GetOEMCP FindFirstFileExW GetCommandLineA GetCommandLineW GetFileType FileTimeToSystemTime SetStdHandle MapViewOfFile GetConsoleMode GetEnvironmentStringsW WriteConsoleW

user32

IsWindowVisible GetWindowThreadProcessId GetDC ReleaseDC GetShellWindow GetWindow

gdi32

CreateCompatibleBitmap CreateCompatibleDC SelectObject CombineRgn BitBlt CreateRectRgnIndirect DeleteDC DeleteObject GetRgnBox OffsetRgn SelectClipRgn CreateRectRgn

shell32

SHGetFileInfoW SHGetKnownFolderPath

ole32

CoTaskMemFree

mswsock

AcceptEx GetAcceptExSockaddrs

bcrypt

BCryptGenRandom BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-07_0481643d684e849a52b83bd08841d87c_amadey_darkgate_elex_floxif_glassworm_luca-stealer_lynx_medusalocker_njrat

PE Signature issue

advapi32

iphlpapi

ws2_32

crypt32

dbghelp

version

winhttp

kernel32

user32

gdi32

shell32

ole32

mswsock

bcrypt

generic