2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat
Size 2.0MB
Sample260708-bcb3bsgz2v
SHA256 5586e43089f03a635a3656f5ac8da537f65cc0cd9d9598721e7feceedb8e0388
MD5 52bf1de2815e87874e9e4fc8fcb24763
SHA1 49d96c1dcaeb75426f313082d667c47310d5d550
SHA512 33718a36fd936e845d9f460acfbdb557fe4d2b7806ffe829a857398823fc3bc2b940870dbd6b008c70bdc7ebce8e8110a375c0c3b8199163bed0d837b0e6c56e
SSDEEP 49152:MVxeyk+tWoS/0PUa6xDv40bk+BiTwXFw0W0i/+K6bxW:SxFx4oSMu40bkOy/+K6b
TLSH
T137A5AE033283C031DCA211B08969DFAB86ADA4345B7148DB67D46E6ED8F22D15E35B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat

File Explorer

2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat

.exe 2.0MB

2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat

IMPHASH 5dfcee4f18b5dbad341c297eaf956b80
SHA256 5586e43089f03a635a3656f5ac8da537f65cc0cd9d9598721e7feceedb8e0388
MD5 52bf1de2815e87874e9e4fc8fcb24763
SHA1 49d96c1dcaeb75426f313082d667c47310d5d550
SHA512 33718a36fd936e845d9f460acfbdb557fe4d2b7806ffe829a857398823fc3bc2b940870dbd6b008c70bdc7ebce8e8110a375c0c3b8199163bed0d837b0e6c56e
SSDEEP 49152:MVxeyk+tWoS/0PUa6xDv40bk+BiTwXFw0W0i/+K6bxW:SxFx4oSMu40bkOy/+K6b
TLSH
T137A5AE033283C031DCA211B08969DFAB86ADA4345B7148DB67D46E6ED8F22D15E35B7F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

685536

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1@3\build\Win32\Release\SaBsi.pdb

kernel32

WTSGetActiveConsoleSessionId CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess K32EnumProcesses QueryFullProcessImageNameW TerminateProcess GetCurrentProcess GlobalAlloc GetTickCount HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap LoadResource LockResource FindResourceW CreateFileW WriteFile FreeLibrary LoadLibraryW OutputDebugStringW InitializeCriticalSectionEx DeleteCriticalSection GetEnvironmentVariableW FindResourceExW SizeofResource GetFileAttributesExW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetExitCodeProcess CreateProcessW GetFileSize CreateFileMappingW MapViewOfFileEx UnmapViewOfFile MultiByteToWideChar SetEvent CreateEventW CreateSemaphoreW ReleaseSemaphore WaitForMultipleObjects WideCharToMultiByte WritePrivateProfileStringW WritePrivateProfileStructW GetTempFileNameW FindResourceA GetTempPathW CreateDirectoryW FindNextFileW FindFirstFileW GetFileAttributesW MoveFileExW DeleteFileW FindClose LocalFree GetLongPathNameW GetModuleFileNameW ReleaseMutex WaitForSingleObject GetLastError CreateMutexW GetProcAddress GetModuleHandleW CloseHandle GetCurrentProcessId DecodePointer GlobalFree Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection GetSystemWow64DirectoryW GetSystemDirectoryW IsWow64Process2 GetLargePageMinimum RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA FormatMessageA GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId QueryPerformanceCounter InitOnceBeginInitialize InitOnceComplete GetLocaleInfoEx FindFirstFileExW GetFinalPathNameByHandleW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx WaitForSingleObjectEx GetExitCodeThread GetNativeSystemInfo EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetSystemTimeAsFileTime CompareStringEx GetCPInfo InitializeCriticalSectionAndSpinCount ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwind InterlockedPushEntrySList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle GetFileType GetModuleHandleExW WriteConsoleW CreateThread ExitThread FreeLibraryAndExitThread ExitProcess GetTimeZoneInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle ReadConsoleW SetEndOfFile FormatMessageW IsWow64Process RtlCaptureContext RaiseFailFastException

advapi32

RegDeleteTreeW RegDeleteKeyValueW RegQueryInfoKeyW RegEnumValueW SetNamedSecurityInfoW GetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyExW RegSetValueExA RegSetValueExW RegCreateKeyExW RegQueryValueExW RegQueryValueExA RegCloseKey

shell32

CommandLineToArgvW SHGetSpecialFolderPathW SHGetKnownFolderPath

ole32

StringFromGUID2 CoCreateGuid StringFromCLSID CoCreateInstance CoUninitialize CoTaskMemFree CoInitializeEx OleRun

oleaut32

SysAllocString SysFreeString VarUdateFromDate VariantTimeToSystemTime SystemTimeToVariantTime VariantClear

shlwapi

PathFileExistsW StrRChrW PathFindExtensionW

Name

.text

Size

965KB

Virtual Size

965KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

324KB

Virtual Size

324KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

136KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

616KB

Virtual Size

620KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat

kernel32

advapi32

shell32

ole32

oleaut32

shlwapi

generic