2026-07-09_034ef5dc5e441c8bc6f1bcb0627c212d_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_034ef5dc5e441c8bc6f1bcb0627c212d_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat
Size 3.5MB
Sample260709-qe8xeabs4m
SHA256 7bbc2fcd5928f29ffbae5b268d101c1ff1692c5e3b06dcfcc5964497eb9ea467
MD5 034ef5dc5e441c8bc6f1bcb0627c212d
SHA1 43935ff0edbc852fa22bba615d980ef87fc83c6c
SHA512 da2d2534575ac8fc52590cc4ffcbea991b900dbf75ac8f21f94a618099d3f7e059c26c77e270881fedde9c531a3154d87c72658576e83c791330b3c295d91398
SSDEEP 98304:T4Z/RUixPo/hVxtVNDO57g4NRvMJRQjUXdWPt:TVi6/Hf4NRvPAXc
TLSH
T18A06F132B1038136C2F51230D02ADB96402A6D78973548DFABD93E2D7F7D1D39A75A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

installer

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_034ef5dc5e441c8bc6f1bcb0627c212d_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

File Explorer

2026-07-09_034ef5dc5e441c8bc6f1bcb0627c212d_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat

.exe 3.5MB

2026-07-09_034ef5dc5e441c8bc6f1bcb0627c212d_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat

IMPHASH 8e833527413e37736523e5e51c03608e
SHA256 7bbc2fcd5928f29ffbae5b268d101c1ff1692c5e3b06dcfcc5964497eb9ea467
MD5 034ef5dc5e441c8bc6f1bcb0627c212d
SHA1 43935ff0edbc852fa22bba615d980ef87fc83c6c
SHA512 da2d2534575ac8fc52590cc4ffcbea991b900dbf75ac8f21f94a618099d3f7e059c26c77e270881fedde9c531a3154d87c72658576e83c791330b3c295d91398
SSDEEP 98304:T4Z/RUixPo/hVxtVNDO57g4NRvMJRQjUXdWPt:TVi6/Hf4NRvPAXc
TLSH
T18A06F132B1038136C2F51230D02ADB96402A6D78973548DFABD93E2D7F7D1D39A75A3A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects executables packed with VMProtect.
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

274842

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\广告相关\桌标\Release\桌标.pdb

kernel32

GetWindowsDirectoryA SetFileAttributesA DecodePointer GetFileSize DeleteCriticalSection CreateDirectoryA GetProcessTimes DeviceIoControl WriteFile ReadFile GetModuleFileNameA OpenEventA SizeofResource WaitNamedPipeA EnterCriticalSection OutputDebugStringA TerminateProcess LeaveCriticalSection InitializeCriticalSection FindResourceA FindClose CreateMutexA GetCurrentThreadId ResumeThread GetModuleHandleA FreeResource OpenMutexA SetEvent LockResource LoadResource GetLocalTime CreateFileMappingA LocalFree GetCurrentProcessId WideCharToMultiByte OpenThread SetUnhandledExceptionFilter WaitForSingleObject RaiseException GetTickCount MultiByteToWideChar SetFilePointer CreateFileW LocalFileTimeToFileTime GetCurrentDirectoryW SystemTimeToFileTime WaitForSingleObjectEx ResetEvent DeleteFileA CreateFileA GetLastError WriteConsoleW SetEndOfFile HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW Sleep DuplicateHandle InitializeCriticalSectionEx GetPrivateProfileStringA MapViewOfFile OpenFileMappingA GetLogicalDriveStringsA CloseHandle Process32FirstW Process32NextW GetCurrentProcess GetFileAttributesA CreateToolhelp32Snapshot OpenProcess UnmapViewOfFile QueryDosDeviceA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapReAlloc FlushFileBuffers GetFileType HeapAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP HeapFree EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW K32GetProcessImageFileNameA CreateEventA GetStringTypeW EncodePointer LCMapStringEx GetCPInfo InitializeSListHead UnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetSystemTimeAsFileTime OutputDebugStringW QueryPerformanceFrequency RtlUnwind InterlockedPushEntrySList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW CompareStringW CreateEventW

user32

wsprintfA

advapi32

ProcessTrace BuildExplicitAccessWithNameA SetEntriesInAclA ControlTraceA RegCloseKey StopTraceA SetNamedSecurityInfoA EnableTraceEx StartTraceA GetNamedSecurityInfoA RegOpenKeyExA RegDeleteValueA RegEnumKeyExA OpenTraceA LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

shell32

ShellExecuteA SHChangeNotify SHGetSpecialFolderPathA

ole32

CoCreateGuid CoInitialize

psapi

GetProcessImageFileNameA

shlwapi

StrStrIA

wininet

InternetQueryOptionA InternetConnectA InternetCloseHandle InternetOpenA InternetReadFile InternetSetOptionA HttpOpenRequestA HttpQueryInfoA HttpSendRequestA

iphlpapi

GetAdaptersInfo

Name

.text

Size

464KB

Virtual Size

463KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_034ef5dc5e441c8bc6f1bcb0627c212d_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat

kernel32

user32

advapi32

shell32

ole32

psapi

shlwapi

wininet

iphlpapi

generic