2026-07-14_db1fc5b83e1f9701e05229446b7fae6d_amadey_darkgate_elex_luca-stealer_lynx_njrat_risepro

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_db1fc5b83e1f9701e05229446b7fae6d_amadey_darkgate_elex_luca-stealer_lynx_njrat_risepro
Size 2.1MB
Sample260714-deacmae171
SHA256 b3ba389612e930f22f0fa78277d7be15150fe4d810b18ca62bfdf24e1558e8a8
MD5 db1fc5b83e1f9701e05229446b7fae6d
SHA1 396926a07efe58367953aa12f4d91352df776f6f
SHA512 de3940309afa46f3ca46b2141244a8c2dbfef08295704d32def2fd1fa82cbe585bf9b61bbd2118cd7d938e9a5711417a524860d2e4eaf952d49a649b0cfc804b
SSDEEP 49152:VezoGaU2h/O6YnnGykhGBkPQEil0C6NtAV4um649wFMBRy0:VezfHnGyiGBiS0C68nmJ
TLSH
T11EA56B32B245C022E4B225B2583CDE7B842DBD350B2154C7E7E0BE6E68B55C3663AF57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-14_db1fc5b83e1f9701e05229446b7fae6d_amadey_darkgate_elex_luca-stealer_lynx_njrat_risepro

.exe 2.1MB

2026-07-14_db1fc5b83e1f9701e05229446b7fae6d_amadey_darkgate_elex_luca-stealer_lynx_njrat_risepro

IMPHASH 786cd137d88048a9c6fa1b10aff4408f
SHA256 b3ba389612e930f22f0fa78277d7be15150fe4d810b18ca62bfdf24e1558e8a8
MD5 db1fc5b83e1f9701e05229446b7fae6d
SHA1 396926a07efe58367953aa12f4d91352df776f6f
SHA512 de3940309afa46f3ca46b2141244a8c2dbfef08295704d32def2fd1fa82cbe585bf9b61bbd2118cd7d938e9a5711417a524860d2e4eaf952d49a649b0cfc804b
SSDEEP 49152:VezoGaU2h/O6YnnGykhGBkPQEil0C6NtAV4um649wFMBRy0:VezfHnGyiGBiS0C68nmJ
TLSH
T11EA56B32B245C022E4B225B2583CDE7B842DBD350B2154C7E7E0BE6E68B55C3663AF57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

PE Signature issue

Digest

0f:17:43:bb:ad:0d:42:12:72:f5:8a:ee:6c:96:b7:41:4d:17:73:7e:a1:39:2d:7a:6c:41:98:a6:5c:ba:ec:d1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=ESET\, spol. s r.o.,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Chains

Jul 6, 2026

CN=ESET\, spol. s r.o.,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

CN=ESET Code Signing CA 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

CN=ESET Root Certificate Authority 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Digest

0f:17:43:bb:ad:0d:42:12:72:f5:8a:ee:6c:96:b7:41:4d:17:73:7e:a1:39:2d:7a:6c:41:98:a6:5c:ba:ec:d1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=31333532,CN=ESET\, spol. s r.o.,O=ESET\, spol. s r.o.,L=Bratislava,C=SK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302534b

Chains

Jul 6, 2026

SERIALNUMBER=31333532,CN=ESET\, spol. s r.o.,O=ESET\, spol. s r.o.,L=Bratislava,C=SK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302534b

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=31333532,CN=ESET\, spol. s r.o.,O=ESET\, spol. s r.o.,L=Bratislava,C=SK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302534b

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=31333532,CN=ESET\, spol. s r.o.,O=ESET\, spol. s r.o.,L=Bratislava,C=SK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302534b

Serial Number

03:31:e2:bf:18:5b:7f:ec:ee:f4:39:27:12:a8:6d:5e

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 16, 2023 - Aug 16, 2026

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:1c:b2:8a:00:00:00:00:00:26

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=ESET\, spol. s r.o.,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Serial Number

02:6c:8d:34:96:d7:b7:72:05:df:dd:e5:c1:e1:64:65:0c:c5:a5:09

Issuer

CN=ESET Code Signing CA 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 15, 2026 - Jul 14, 2027

Subject

CN=ESET Code Signing CA 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Serial Number

7d:90:d1:7c:6b:36:ca:f6:8f:b9:b7:2f:65:68:b8:22:3d:30:2d:a8

Issuer

CN=ESET Root Certificate Authority 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 17, 2020 - Jul 17, 2030

Subject

CN=ESET Root Certificate Authority 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Serial Number

3d:1f:d8:47:f9:7a:4d:60:55:54:9f:7c:d2:22:cf:46:53:9e:7b:34

Issuer

CN=ESET Root Certificate Authority 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 15, 2020 - Jul 15, 2045

Subject

CN=ESET Timestamp,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Serial Number

1d:24:b6:6c:99:3c:6f:c9:ba:b9:52:a8:f7:29:ee:31:1b:c0:21:12

Issuer

CN=ESET Timestamping CA 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 14, 2026 - Jul 15, 2027

Subject

CN=ESET Timestamping CA 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Serial Number

76:79:fc:14:55:72:11:3a:f7:92:d1:f4:af:3c:4e:3a:8a:8a:6e:38

Issuer

CN=ESET Root Certificate Authority 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2020 - Jul 16, 2030

Minor OS version

Major OS version

Entry point

1404384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Bootstrapper.pdb

rpcrt4

UuidCreate

kernel32

HeapSize WriteConsoleW SetLastError InitializeCriticalSection GetTickCount GetModuleHandleA GetModuleHandleW GetCurrentThread GetLastError GetCurrentProcess LoadLibraryW FreeLibrary GetProcAddress FindFirstFileW FindClose LocalFree WideCharToMultiByte MultiByteToWideChar FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDateFormatW GetSystemTime GetTimeFormatW GetCurrentProcessId Sleep FindFirstFileExW FindNextFileW RemoveDirectoryW CreateDirectoryW SetEvent ResetEvent WaitForSingleObject WaitForMultipleObjects ReadFile WriteFile SetEndOfFile SetFilePointer GetFileSize DeleteFileW MoveFileW CopyFileW GetTempPathW GetTempFileNameW FlushFileBuffers GetFileInformationByHandle GetSystemInfo MapViewOfFile UnmapViewOfFile QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimeAsFileTime VirtualAlloc VirtualFree VirtualProtect DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection GetCurrentThreadId CreateSemaphoreW ReleaseSemaphore GetExitCodeThread SystemTimeToFileTime MoveFileExW GetCurrentDirectoryW FindResourceW SizeofResource LoadResource LockResource ExpandEnvironmentStringsW GetEnvironmentVariableW VerSetConditionMask VerifyVersionInfoW GetVersion GetLocaleInfoW GetTimeZoneInformation GetModuleFileNameW LoadLibraryExW OpenProcess CreateMutexW ReleaseMutex CreateProcessW GetExitCodeProcess GetCommandLineW GetComputerNameW GetSystemDirectoryW CreateMutexA OpenMutexA FlushViewOfFile SleepEx WaitForSingleObjectEx GetEnvironmentVariableA FormatMessageW SwitchToThread RaiseException VirtualQuery LoadLibraryExA GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage SetStdHandle GetFullPathNameW HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW HeapFree HeapAlloc GetStdHandle ExitProcess GetConsoleOutputCP ReadConsoleW GetConsoleMode FreeLibraryAndExitThread ExitThread GetFileAttributesExW PeekNamedPipe GetFileType TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo LCMapStringEx GetStringTypeW

ws2_32

inet_addr gethostbyname WSACloseEvent WSACreateEvent WSASetEvent WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents WSAEnumNetworkEvents WSAIoctl WSASetLastError getpeername WSACleanup WSAStartup shutdown select __WSAFDIsSet accept listen bind connect getsockname ioctlsocket setsockopt getsockopt sendto send recvfrom recv closesocket socket gethostbyaddr getservbyport ntohs inet_ntoa getservbyname htons WSAGetLastError htonl

shell32

CommandLineToArgvW

ole32

StringFromGUID2

wintrust

CryptSIPGetSignedDataMsg

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

309KB

Virtual Size

309KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

76KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_db1fc5b83e1f9701e05229446b7fae6d_amadey_darkgate_elex_luca-stealer_lynx_njrat_risepro

PE Signature issue

rpcrt4

kernel32

ws2_32

shell32

ole32

wintrust

generic