2026-07-12_7827b28b308ec85a697e72e80ba20c69_amadey_darkgate_elex_luca-stealer_lynx_njrat

General

Target
2026-07-12_7827b28b308ec85a697e72e80ba20c69_amadey_darkgate_elex_luca-stealer_lynx_njrat
Size 1.5MB
Sample260712-vb8jpadw5n
SHA256 01b6e10dc5ff2c2faf7c97bb04be127bab4c5892793c641700ddb4a16d163fcf
MD5 7827b28b308ec85a697e72e80ba20c69
SHA1 b920b5dae5fe27f44a95b5db76cedc1244e309d7
SHA512 36fcf12d981aecf368982f82bba8c361806dd357ae43923771345d0ca8d6a2b9b6b296f7ee344dbbdcccf03f269772d8fc1da34d5a25441a244f7cea086a7d38
SSDEEP 24576:hZ/H7mubf4yu7whPQEO4RosqjnhMgeiCl7G0nehbGZpbD:jH7mubfNu7wZQEOgUDmg27RnWGj
TLSH
T17575F2127AC5E072D97101704BA9EB29953EBC300F2019EBA7D47E6E9F759D08A31F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-12_7827b28b308ec85a697e72e80ba20c69_amadey_darkgate_elex_luca-stealer_lynx_njrat

File Explorer

2026-07-12_7827b28b308ec85a697e72e80ba20c69_amadey_darkgate_elex_luca-stealer_lynx_njrat

.exe 1.5MB

2026-07-12_7827b28b308ec85a697e72e80ba20c69_amadey_darkgate_elex_luca-stealer_lynx_njrat

IMPHASH b8180d09e11cc2eabba9d2ec5570f101
SHA256 01b6e10dc5ff2c2faf7c97bb04be127bab4c5892793c641700ddb4a16d163fcf
MD5 7827b28b308ec85a697e72e80ba20c69
SHA1 b920b5dae5fe27f44a95b5db76cedc1244e309d7
SHA512 36fcf12d981aecf368982f82bba8c361806dd357ae43923771345d0ca8d6a2b9b6b296f7ee344dbbdcccf03f269772d8fc1da34d5a25441a244f7cea086a7d38
SSDEEP 24576:hZ/H7mubf4yu7whPQEO4RosqjnhMgeiCl7G0nehbGZpbD:jH7mubfNu7wZQEOgUDmg27RnWGj
TLSH
T17575F2127AC5E072D97101704BA9EB29953EBC300F2019EBA7D47E6E9F759D08A31F27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

119534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\job\jumpservice\jumpservice\lib\wire.pdb

kernel32

LeaveCriticalSection InitializeCriticalSection SetFilePointer CreateFileW GetCurrentThreadId WriteFile WaitForSingleObject CreateEventW SetEvent WideCharToMultiByte EnterCriticalSection DeleteCriticalSection GetLastError CloseHandle GetConsoleMode GetConsoleOutputCP FlushFileBuffers MultiByteToWideChar EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RtlUnwind RaiseException FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW GetTimeZoneInformation HeapFree HeapAlloc GetFileType GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize WriteConsoleW

advapi32

SetServiceStatus StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW

wire

Start_auto_num Stop_auto

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-12_7827b28b308ec85a697e72e80ba20c69_amadey_darkgate_elex_luca-stealer_lynx_njrat

kernel32

advapi32

wire

generic