2026-07-14_5053038b80280a0410e43632fd3e3264_amadey_darkgate_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_5053038b80280a0410e43632fd3e3264_amadey_darkgate_elex_luca-stealer_lynx_njrat
Size 1.5MB
Sample260714-xp8sqaet7x
SHA256 fe68908d7ed673067aa7dd597f656ce27585ba65b905cb5fef16683d1ab0e6ad
MD5 5053038b80280a0410e43632fd3e3264
SHA1 c787ff04662c20919a14681c504c8e17b7060e6e
SHA512 acfbb533465b86c782a63e2e9b48043fb8231461a16a29d3aa7ea9568c1e3b0e609173c592603df90e7a871bc97892874b4e078abf02982eb07996e1c41fdcb4
SSDEEP 24576:3Cd3zC9QNiY7A4iBOyLywQkET3DMceJnWsqjnhMgeiCl7G0nehbGZpbD:3w3zCmNMOwQkETTMHJaDmg27RnWGj
TLSH
T11675BE26F922E172D49240B181B5BFE2E9EC7F11432988D7A3D0BF2E75281D32535B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-14_5053038b80280a0410e43632fd3e3264_amadey_darkgate_elex_luca-stealer_lynx_njrat

File Explorer

2026-07-14_5053038b80280a0410e43632fd3e3264_amadey_darkgate_elex_luca-stealer_lynx_njrat

.exe 1.5MB

2026-07-14_5053038b80280a0410e43632fd3e3264_amadey_darkgate_elex_luca-stealer_lynx_njrat

IMPHASH 67904fa5fc7946f29c7ac9881ed81294
SHA256 fe68908d7ed673067aa7dd597f656ce27585ba65b905cb5fef16683d1ab0e6ad
MD5 5053038b80280a0410e43632fd3e3264
SHA1 c787ff04662c20919a14681c504c8e17b7060e6e
SHA512 acfbb533465b86c782a63e2e9b48043fb8231461a16a29d3aa7ea9568c1e3b0e609173c592603df90e7a871bc97892874b4e078abf02982eb07996e1c41fdcb4
SSDEEP 24576:3Cd3zC9QNiY7A4iBOyLywQkET3DMceJnWsqjnhMgeiCl7G0nehbGZpbD:3w3zCmNMOwQkETTMHJaDmg27RnWGj
TLSH
T11675BE26F922E172D49240B181B5BFE2E9EC7F11432988D7A3D0BF2E75281D32535B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

555928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Ugit\WXWork\WXWork\third_party\bugly\build_crashpad\crashpad\out\x86\release\crashpad_handler.pdb

kernel32

GetCurrentProcessId EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection SetLastError GetModuleFileNameW GetFileInformationByHandleEx GetCurrentProcess RegisterWaitForSingleObject GetQueuedCompletionStatus WaitForSingleObject DuplicateHandle DisconnectNamedPipe OpenProcess PostQueuedCompletionStatus CreateEventW SetEvent CreateThread UnregisterWaitEx CreateIoCompletionPort ConnectNamedPipe ExitProcess SetNamedPipeHandleState CreateNamedPipeW GetVersion TransactNamedPipe WaitNamedPipeW LoadLibraryW GetProcAddress FindClose TerminateProcess ReleaseSemaphore CreateSemaphoreW GetStdHandle WriteFile SetEndOfFile UnlockFileEx SetFilePointerEx LockFileEx GetFileType GetModuleHandleW FormatMessageA LocalFree CreateDirectoryW GetFileAttributesW DeleteFileW GetTimeZoneInformation GetSystemInfo IsProcessorFeaturePresent VerSetConditionMask VerifyVersionInfoW GetProcessId SuspendThread ResumeThread GetThreadContext GetProcessTimes GetSystemDefaultLCID GetThreadLocale GetUserDefaultLCID CreateProcessW IsWow64Process WriteProcessMemory RtlCaptureContext Sleep VirtualAllocEx ReadProcessMemory SleepEx IsDebuggerPresent SizeofResource MultiByteToWideChar LockResource GlobalAlloc GlobalFree FindResourceExW IsDBCSLeadByte LoadResource FindResourceW GlobalLock lstrcpyW GlobalUnlock GetPrivateProfileSectionW GetFileSizeEx VirtualAlloc VirtualProtect DeviceIoControl CreateFileA WideCharToMultiByte OutputDebugStringW ReadFile WritePrivateProfileStringW SetUnhandledExceptionFilter GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize GetCurrentDirectoryW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW InitializeCriticalSectionEx SwitchToThread InitializeCriticalSection VirtualQueryEx GetFileTime RemoveDirectoryW WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetModuleHandleExW GetCommandLineW GetCommandLineA LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind GetStartupInfoW InitializeSListHead UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCPInfo GetStringTypeW GetSystemTimeAsFileTime InitOnceExecuteOnce LCMapStringEx EncodePointer QueryPerformanceCounter GetLocalTime FormatMessageW GetCurrentThreadId CloseHandle GetPrivateProfileStringW GetFullPathNameW CreateFileW SetProcessShutdownParameters HeapFree VirtualFree SetConsoleCtrlHandler

advapi32

RegQueryValueExA RevertToSelf BuildSecurityDescriptorW SystemFunction036 ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyExA RegCloseKey ImpersonateNamedPipeClient RegOpenKeyExW RegQueryValueExW BuildExplicitAccessWithNameW

user32

SetWindowLongW CreateWindowExW DestroyWindow RegisterClassW DefWindowProcW GetMessageW GetWindowLongW TranslateMessage DispatchMessageW PostMessageW EnableWindow EndPaint BeginPaint InvalidateRect LoadImageW DialogBoxParamW GetSysColorBrush UnregisterClassW GetWindowTextW KillTimer DrawIconEx DrawTextW GetDlgItem GetClientRect MapDialogRect SetClipboardData SendDlgItemMessageW MapWindowPoints SetDlgItemTextW EmptyClipboard CloseClipboard ClientToScreen SetTimer GetWindowTextLengthW EndDialog SetWindowTextW GetWindowThreadProcessId GetMenuItemCount CreatePopupMenu TrackPopupMenu IsWindow DestroyMenu RegisterClipboardFormatW GetKeyState CallWindowProcW GetWindowRect SetWindowPos SendMessageW ShowWindow OpenClipboard

winhttp

WinHttpWriteData WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpConnect WinHttpSendRequest WinHttpSetTimeouts WinHttpCrackUrl

powrprof

CallNtPowerInformation

ole32

OleUninitialize CoTaskMemFree CoCreateGuid StringFromCLSID OleInitialize DoDragDrop

shlwapi

PathRemoveFileSpecW PathFileExistsW

gdiplus

GdiplusStartup

comctl32

ImageList_ReplaceIcon ImageList_Create InitCommonControlsEx

gdi32

DeleteObject SetTextColor GetStockObject CreateFontW SelectObject SetBkMode

oleaut32

SysAllocString SysFreeString SysStringByteLen SysAllocStringByteLen SysStringLen

shell32

SHGetDesktopFolder SHGetFileInfoW SHBindToParent ShellExecuteW ord155

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

Name

.text

Size

709KB

Virtual Size

708KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

171KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

600KB

Virtual Size

604KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_5053038b80280a0410e43632fd3e3264_amadey_darkgate_elex_luca-stealer_lynx_njrat

kernel32

advapi32

user32

winhttp

powrprof

ole32

shlwapi

gdiplus

comctl32

gdi32

oleaut32

shell32

version

generic