2026-07-10_b5b8c9b02116cf6e0212a67c4d53f43c_amadey_darkgate_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_b5b8c9b02116cf6e0212a67c4d53f43c_amadey_darkgate_elex_luca-stealer_lynx_njrat
Size 3.2MB
Sample260710-ycevjsav2s
SHA256 85902b2e26f671d9b12035dad8b1d7ccfdf437917c0fb8fcb171c956251d5538
MD5 b5b8c9b02116cf6e0212a67c4d53f43c
SHA1 97115d32fe3a3b9fe01e1fe50e8601582670c45b
SHA512 a2d9c6584c2263372d542a31e8667d5981c6115fa0b8784db70dfef3ffed702299ba71a673a8026244c50a15aa35836dcbfdc708525839617e839be0b40b57bd
SSDEEP 49152:rg9zAAgHY7oomwAeyfvE0Z3R0Tnxn1o2d5Hptj4L3B+kn3Hnx:0dAAgHY1AeKtwnW2U+k
TLSH
T19CF5AF31B2D18120E5B39370297EA7EA4B79BC256F7640CF32D8B6390B725C09D75B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_b5b8c9b02116cf6e0212a67c4d53f43c_amadey_darkgate_elex_luca-stealer_lynx_njrat

File Explorer

2026-07-10_b5b8c9b02116cf6e0212a67c4d53f43c_amadey_darkgate_elex_luca-stealer_lynx_njrat

.exe 3.2MB

2026-07-10_b5b8c9b02116cf6e0212a67c4d53f43c_amadey_darkgate_elex_luca-stealer_lynx_njrat

IMPHASH eaf081a136938c644914ff7d564ac03d
SHA256 85902b2e26f671d9b12035dad8b1d7ccfdf437917c0fb8fcb171c956251d5538
MD5 b5b8c9b02116cf6e0212a67c4d53f43c
SHA1 97115d32fe3a3b9fe01e1fe50e8601582670c45b
SHA512 a2d9c6584c2263372d542a31e8667d5981c6115fa0b8784db70dfef3ffed702299ba71a673a8026244c50a15aa35836dcbfdc708525839617e839be0b40b57bd
SSDEEP 49152:rg9zAAgHY7oomwAeyfvE0Z3R0Tnxn1o2d5Hptj4L3B+kn3Hnx:0dAAgHY1AeKtwnW2U+k
TLSH
T19CF5AF31B2D18120E5B39370297EA7EA4B79BC256F7640CF32D8B6390B725C09D75B26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

615631

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Jenkins\workspace\MBAM-Windows\A_MB5_MBSetup\bin\Win32\Release\MBSetup.pdb

kernel32

LeaveCriticalSection EnterCriticalSection GetLastError MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW InitializeCriticalSectionEx DeleteCriticalSection RaiseException IsWow64Process GetCurrentProcess VerifyVersionInfoW VerSetConditionMask GetSystemDirectoryW CreateFileW DeviceIoControl CloseHandle GetCurrentThreadId SetLastError LockResource FindResourceExW Sleep DeleteFileW GlobalFree LocalFree FormatMessageW LocalAlloc CallNamedPipeW GetWindowsDirectoryW SetCurrentDirectoryW GetCommandLineW DecodePointer CreateMutexW lstrcmpiW GetDiskFreeSpaceExW FindFirstFileW FindClose CreateProcessW FindNextFileW WideCharToMultiByte GlobalAlloc GlobalLock SetThreadUILanguage LoadLibraryW CreateDirectoryW GetLogicalDrives GetTempPathW MoveFileExW InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList OpenProcess ResumeThread TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW GetCurrentDirectoryW GetCurrentProcessId GetModuleFileNameA ProcessIdToSessionId OutputDebugStringW GetLocalTime WaitForSingleObject GetExitCodeProcess GetFileSizeEx GetFileAttributesW WriteConsoleW SetStdHandle SetEnvironmentVariableW GetProcAddress GetModuleHandleW FreeLibrary GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetNativeSystemInfo MulDiv FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW SetEndOfFile LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW ReadFile SetFilePointerEx GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA FormatMessageA GetStringTypeW GetLocaleInfoEx FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle AreFileApisANSI CopyFileW GetFileInformationByHandleEx QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive EncodePointer LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime GetCPInfo IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetCommandLineA GetStdHandle WriteFile GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode

dwmapi

DwmGetWindowAttribute

crypt32

CryptMsgClose CertCloseStore CertFreeCertificateContext CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CryptQueryObject

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_b5b8c9b02116cf6e0212a67c4d53f43c_amadey_darkgate_elex_luca-stealer_lynx_njrat

kernel32

dwmapi

crypt32

rpcrt4

wtsapi32

wintrust

generic