2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat

General

Target
2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat
Size 3.2MB
Sample260708-ev3vjsbt8m
SHA256 13253f3186d3e08ea5fb8083a57c3b692e5702231b32ed492a2414863f29037e
MD5 b363d0147fb6a6af4c2c8e25da26f789
SHA1 9a7f6144ba5bf23c89eacc22823d3958ae3ddfa7
SHA512 92ac5fca0f0e5404a9a987f43f3fbcc3129f3ec2bc860cf3fb75ea01099b0c8a89fdef54176cb1f421caf8c0e30a46a90c07f94f62d906617b786490cdace5bf
SSDEEP 49152:2gZd02qItsVrJjyCwAeyfvE0Z3R0Tnxn1o2d5HliWS1SZBnHTAsi:pdvqItsV9gAeKtwnW2ocNzAz
TLSH
T1DEF5AF21B2918120E5F39370297EB7EA5B75BC256F76408F32DCBA390B725C09D35B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat

File Explorer

2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat

.exe 3.2MB

2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat

IMPHASH 8c1be39b6ace6c7da85b7edd83bef6f8
SHA256 13253f3186d3e08ea5fb8083a57c3b692e5702231b32ed492a2414863f29037e
MD5 b363d0147fb6a6af4c2c8e25da26f789
SHA1 9a7f6144ba5bf23c89eacc22823d3958ae3ddfa7
SHA512 92ac5fca0f0e5404a9a987f43f3fbcc3129f3ec2bc860cf3fb75ea01099b0c8a89fdef54176cb1f421caf8c0e30a46a90c07f94f62d906617b786490cdace5bf
SSDEEP 49152:2gZd02qItsVrJjyCwAeyfvE0Z3R0Tnxn1o2d5HliWS1SZBnHTAsi:pdvqItsV9gAeKtwnW2ocNzAz
TLSH
T1DEF5AF21B2918120E5F39370297EB7EA5B75BC256F76408F32DCBA390B725C09D35B26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

606997

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Jenkins\workspace\MBAM-Windows\A_MB5_MBSetup\bin\Win32\Release\MBSetup.pdb

kernel32

LeaveCriticalSection EnterCriticalSection GetLastError MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW InitializeCriticalSectionEx DeleteCriticalSection RaiseException IsWow64Process GetCurrentProcess VerifyVersionInfoW VerSetConditionMask GetSystemDirectoryW CreateFileW DeviceIoControl CloseHandle GetCurrentThreadId SetLastError LockResource FindResourceExW Sleep DeleteFileW GlobalFree LocalFree FormatMessageW LocalAlloc CallNamedPipeW GetWindowsDirectoryW SetCurrentDirectoryW GetCommandLineW DecodePointer lstrcmpiW GetNativeSystemInfo GetDiskFreeSpaceExW FindFirstFileW FindClose CreateProcessW FindNextFileW WideCharToMultiByte GlobalAlloc GlobalLock SetThreadUILanguage LoadLibraryW CreateDirectoryW GetLogicalDrives GetTempPathW MoveFileExW InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList OpenProcess ResumeThread TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW GetCurrentDirectoryW GetCurrentProcessId GetModuleFileNameA OutputDebugStringW GetLocalTime WriteConsoleW SetStdHandle SetEnvironmentVariableW GetProcAddress GetModuleHandleW FreeLibrary GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy CreateMutexW MulDiv FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW SetEndOfFile LCMapStringW GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA FormatMessageA GetStringTypeW GetLocaleInfoEx FindFirstFileExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle AreFileApisANSI CopyFileW GetFileInformationByHandleEx QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive EncodePointer LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime GetCPInfo IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetCommandLineA GetStdHandle WriteFile GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx ReadFile GetFileSizeEx GetDateFormatW GetTimeFormatW CompareStringW

dwmapi

DwmGetWindowAttribute

crypt32

CryptMsgClose CertCloseStore CertFreeCertificateContext CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CryptQueryObject

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat

kernel32

dwmapi

crypt32

rpcrt4

generic