2026-07-11_c9e659f05cb7d9a53ea24068d4e3b201_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-11_c9e659f05cb7d9a53ea24068d4e3b201_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat
Size 3.7MB
Sample260711-plpxfacs2w
SHA256 98625d982249b0b6b12c7636fa6b991d7b034e84e1a5b3534cf225f7a5c322ab
MD5 c9e659f05cb7d9a53ea24068d4e3b201
SHA1 b8d74bea6bedae4a0a254eb04517ff6d31099bb1
SHA512 c608d9b139ceee2babd410e02b24f9a7c68a5e83d2348accab661e31ecbcaeed6808decb571875b62aecfd7ec848ed5dc600c1a0835e1816a25330b5c832df54
SSDEEP 49152:344VeKB7PCwbBKqCR/ohRnVPDqbEMxT9m9/HHk84QPq+FmeZzX5z3kj4ZBqcBA06:D+mKFZ6wN4xHk8ZPqClRa4S
TLSH
T197068C117A05C035E6A041B25A3CAFB5845CBD395FA144C7B2E42F6A55B09E3BE33F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-11_c9e659f05cb7d9a53ea24068d4e3b201_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

.exe 3.7MB

2026-07-11_c9e659f05cb7d9a53ea24068d4e3b201_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

IMPHASH fe0753aef6e2fb7a052ccb21a56c7d52
SHA256 98625d982249b0b6b12c7636fa6b991d7b034e84e1a5b3534cf225f7a5c322ab
MD5 c9e659f05cb7d9a53ea24068d4e3b201
SHA1 b8d74bea6bedae4a0a254eb04517ff6d31099bb1
SHA512 c608d9b139ceee2babd410e02b24f9a7c68a5e83d2348accab661e31ecbcaeed6808decb571875b62aecfd7ec848ed5dc600c1a0835e1816a25330b5c832df54
SSDEEP 49152:344VeKB7PCwbBKqCR/ohRnVPDqbEMxT9m9/HHk84QPq+FmeZzX5z3kj4ZBqcBA06:D+mKFZ6wN4xHk8ZPqClRa4S
TLSH
T197068C117A05C035E6A041B25A3CAFB5845CBD395FA144C7B2E42F6A55B09E3BE33F2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

8b:01:80:b7:62:2a:be:28:eb:91:bd:68:ca:c1:65:2b:54:e6:c6:0b:04:b4:ae:d4:c3:d8:b8:8b:9a:43:52:b4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91510100394487762T,CN=成都奇鲁科技有限公司,O=成都奇鲁科技有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jun 24, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:07:8e:70:ea:ee:48:ff:eb:95:76:bd:d4:00:be:98

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 21, 2024 - May 20, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1455081

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\jenkins\.jenkins\workspace\group_clean\sys_boost_group\client\sys_boost\Release\sys_boost_ui.pdb

wevtapi

EvtRender EvtNext EvtQuery EvtClose

dbghelp

MakeSureDirectoryPathExists

kernel32

lstrcatW K32GetProcessImageFileNameW GetEnvironmentVariableW GetFullPathNameW GetTempPathW DeviceIoControl lstrlenW SystemTimeToFileTime lstrcmpiW DeleteFileW ReadDirectoryChangesW SetUnhandledExceptionFilter SetErrorMode HeapSetInformation SetPriorityClass VirtualProtect IsBadReadPtr GetCommandLineW SetEvent OpenEventW GetPrivateProfileStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale ExitProcess GetTimeZoneInformation GetConsoleMode GetConsoleOutputCP GetFileType ExitThread RtlUnwind QueryDepthSList InterlockedFlushSList FreeLibraryAndExitThread GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SignalObjectAndWait CreateTimerQueue FindAtomW AddAtomW DeleteAtom VerifyVersionInfoW VerSetConditionMask lstrcmpiA lstrcmpA GetSystemWindowsDirectoryW FreeResource CreateSemaphoreW WaitForMultipleObjectsEx WaitNamedPipeW lstrcpyW FormatMessageW LocalFree GetSystemDirectoryW FindNextFileW FindFirstFileW FindClose CreateProcessW FormatMessageA CreateEventW ExpandEnvironmentStringsW Process32NextW Process32FirstW CreateToolhelp32Snapshot K32GetProcessMemoryInfo K32GetModuleFileNameExW GetWindowsDirectoryW GetSystemTimes RegisterWaitForSingleObject UnregisterWaitEx GetStartupInfoW GetTickCount64 GetProcessTimes OpenProcess GetProcessId Sleep CreateMutexW WaitForSingleObject GetTickCount GetCurrentThreadId GetCurrentProcessId SetLastError GetModuleHandleW WideCharToMultiByte CopyFileW TerminateProcess AreFileApisANSI HeapCreate GetDiskFreeSpaceW GetFullPathNameA UnlockFileEx HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW FlushViewOfFile CreateFileA LoadLibraryA GetVersionExA DeleteFileA GetSystemInfo HeapCompact CreateFileMappingA LoadLibraryExW MapViewOfFileEx WritePrivateProfileStringW LockFileEx GetSystemTime OpenFileMappingW GetVersionExW OutputDebugStringA GetModuleHandleExW GetModuleHandleExA GetModuleHandleA SetFilePointerEx SetFilePointer WaitForMultipleObjects SetEndOfFile WriteFile FlushFileBuffers GetStdHandle LoadLibraryW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleFileNameW FreeLibrary FindResourceExW LeaveCriticalSection EnterCriticalSection InitializeCriticalSection MultiByteToWideChar DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError UnlockFile LockFile ResetEvent PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort RaiseException SetThreadPriority CreateThread GetCurrentProcess ReleaseSemaphore QueryDosDeviceW GetLogicalDriveStringsW GetFileSizeEx GetFileAttributesW CloseHandle DecodePointer ReadFile InterlockedCompareExchange InterlockedExchange GlobalMemoryStatusEx GetDiskFreeSpaceExW GetFileSize CreateFileW SetEnvironmentVariableW WriteConsoleW GetStringTypeW TryEnterCriticalSection QueryPerformanceCounter QueryPerformanceFrequency EncodePointer InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime DuplicateHandle WaitForSingleObjectEx GetCurrentThread GetNativeSystemInfo CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA ReleaseMutex CreateFileMappingW MapViewOfFile UnmapViewOfFile UnhandledExceptionFilter

user32

GetDesktopWindow GetWindow GetWindowInfo GetAncestor LoadStringW PostThreadMessageW ExitWindowsEx LoadIconW GetParent GetCursorPos TrackPopupMenu GetSubMenu DestroyMenu LoadMenuW PostQuitMessage GetForegroundWindow UnregisterPowerSettingNotification RegisterPowerSettingNotification SetForegroundWindow ShowWindow WaitForInputIdle WindowFromPoint MonitorFromPoint PostMessageW RegisterWindowMessageW GetWindowThreadProcessId LoadCursorW FindWindowW SetWindowLongW GetWindowLongW KillTimer SetTimer DestroyWindow IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW CallWindowProcW DefWindowProcW SendMessageTimeoutW SendMessageW GetIconInfo DestroyIcon UnregisterClassW GetWindowRect GetMonitorInfoW GetMessageW wsprintfW CharNextW GetShellWindow TranslateMessage DispatchMessageW PeekMessageW WaitMessage CallMsgFilterW GetQueueStatus MsgWaitForMultipleObjectsEx

gdi32

DeleteObject GetObjectW

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl RegEnumKeyExA RegOpenKeyExA RegQueryValueExA GetTokenInformation RegDeleteKeyW GetUserNameW RegGetValueW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken QueryServiceConfigW OpenServiceW OpenSCManagerW CloseServiceHandle RegSetValueExW RegQueryInfoKeyW RegNotifyChangeKeyValue RegEnumValueW RegEnumKeyExW RegDeleteValueW RegDeleteKeyExW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

SHGetSpecialFolderPathW SHGetFileInfoW ord165 SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetFolderPathW SHCreateDirectoryExW CommandLineToArgvW Shell_NotifyIconW ShellExecuteExW

ole32

CoCreateInstance CoInitializeEx CoTaskMemAlloc CoUninitialize CoCreateGuid CoInitializeSecurity CoCreateFreeThreadedMarshaler CoTaskMemRealloc CoInitialize CoTaskMemFree

oleaut32

SysStringLen SetErrorInfo VariantInit SysAllocString SysFreeString VariantClear VarUI4FromStr GetErrorInfo

shlwapi

StrToIntW StrStrIW PathStripToRootW PathCombineW PathIsDirectoryW PathFindFileNameW PathFindExtensionW SHSetValueW SHGetValueW PathFileExistsW PathRemoveFileSpecW PathAppendW PathIsRelativeW PathIsRootW StrStrIA StrCmpIW StrCmpNIW StrTrimA SHGetValueA SHSetValueA PathRenameExtensionW PathMatchSpecW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

pdh

PdhAddCounterW PdhCloseQuery PdhGetFormattedCounterValue PdhCollectQueryData PdhOpenQueryW

gdiplus

GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromHICON GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromScan0 GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipSaveImageToFile GdipDisposeImage GdipCloneImage GdiplusShutdown GdipAlloc GdipFree

powrprof

PowerSetActiveScheme PowerReadFriendlyName PowerGetActiveScheme

winmm

timeGetTime timeBeginPeriod timeEndPeriod

crypt32

CryptStringToBinaryW CertGetNameStringW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

secur32

GetUserNameExW

generic

count=3, id=261, version=27031,

count=26, id=259, version=30795,

count=209, id=261, version=30795,

count=2, id=264, version=27051,

count=1, productName=Unmarked objects (old),

count=12, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=1, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,

count=2, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=7, id=261, version=27032,

count=25, id=259, version=26706,

count=139, id=261, version=26706,

count=38, id=260, version=26706,

count=32, id=260, version=30795,

count=2, id=262, version=30795,

count=47, id=257, version=30795,

count=531, id=1, productName=Unmarked objects,

count=135, id=261, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,