2026-07-18_ee76ee899fd09281dbd059a893416df9_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-18_ee76ee899fd09281dbd059a893416df9_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat
Size 2.0MB
Sample260718-glrf9sc13w
SHA256 31d9c919b832082020ba1d9bdf991dd40fd83983ea41231aeddc540877ee8e64
MD5 ee76ee899fd09281dbd059a893416df9
SHA1 3c7dcee38c7d8a0ecd31dc0ec78c5d607a0a0bc0
SHA512 a32c5bb63b1ed1e79408590984882040f0cdefd1fde1bff9ffda10e60bcb8ae9be5813fdd73efd9f43e294bb4197f2502baf845901071674ef66da3e2068d9c1
SSDEEP 49152:BrvjDwlIX2v/fG3hiaacHlyDcp0ZxcKbHQdV:9rZ1HEDcNKbH+
TLSH
T191A5AE51BBC7C0B2C9462270987DF72F856967250B31DCEBB3D01E6D9A242C32936B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-18_ee76ee899fd09281dbd059a893416df9_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

.exe 2.0MB

2026-07-18_ee76ee899fd09281dbd059a893416df9_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

IMPHASH a14afff00befb46e04eea1e49fd91019
SHA256 31d9c919b832082020ba1d9bdf991dd40fd83983ea41231aeddc540877ee8e64
MD5 ee76ee899fd09281dbd059a893416df9
SHA1 3c7dcee38c7d8a0ecd31dc0ec78c5d607a0a0bc0
SHA512 a32c5bb63b1ed1e79408590984882040f0cdefd1fde1bff9ffda10e60bcb8ae9be5813fdd73efd9f43e294bb4197f2502baf845901071674ef66da3e2068d9c1
SSDEEP 49152:BrvjDwlIX2v/fG3hiaacHlyDcp0ZxcKbHQdV:9rZ1HEDcNKbH+
TLSH
T191A5AE51BBC7C0B2C9462270987DF72F856967250B31DCEBB3D01E6D9A242C32936B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

96:36:c9:f2:45:44:6d:d9:79:04:7c:ff:87:e3:e3:5b:65:1f:64:17:dd:39:d0:eb:46:d4:b5:b1:fc:70:11:63

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Codeorigin\, LLC,O=Codeorigin\, LLC,L=Tampa,ST=Florida,C=US

Chains

Jul 9, 2026

CN=Codeorigin\, LLC,O=Codeorigin\, LLC,L=Tampa,ST=Florida,C=US

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Codeorigin\, LLC,O=Codeorigin\, LLC,L=Tampa,ST=Florida,C=US

Serial Number

33:00:02:f7:21:8a:a1:8b:7f:c9:f1:ff:65:00:00:00:02:f7:21

Issuer

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 8, 2026 - Jul 11, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:15:05:3e:6e:19:8e:93:29:d9:00:00:00:00:00:15

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7A00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:58:65:cd:eb:3f:a1:d7:fc:d2:00:00:00:00:00:58

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

1455448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

imm32

ImmNotifyIME ImmReleaseContext ImmSetCompositionFontW ImmGetContext ImmGetCompositionStringW ImmEscapeW ImmSetCompositionStringW ImmSetCandidateWindow ImmSetCompositionWindow

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionW

shell32

CommandLineToArgvW

user32

GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW AttachThreadInput DefWindowProcW PostQuitMessage RegisterClassExW IsWindow DestroyWindow ShowWindow SetWindowPos BringWindowToTop SetFocus MessageBoxW SetTimer KillTimer UpdateWindow GetForegroundWindow SetForegroundWindow InvalidateRect SetWindowTextW GetClientRect GetWindowRect GetWindowLongW SetWindowLongW GetWindowThreadProcessId LoadCursorW LoadIconW IsDialogMessageW SystemParametersInfoW EndPaint BeginPaint GetCursorPos ReleaseDC GetAncestor ReleaseCapture GetKeyState FillRect FrameRect RedrawWindow CallWindowProcA MapWindowPoints AdjustWindowRectEx MonitorFromPoint MonitorFromRect MonitorFromWindow GetSystemMetrics CreatePopupMenu TrackPopupMenu CreateIconIndirect GetDoubleClickTime GetMonitorInfoA GetSysColor DestroyMenu SetScrollInfo RegisterClipboardFormatW GetUpdateRgn LoadCursorA GetDC HideCaret PostMessageA ScreenToClient NotifyWinEvent GetScrollInfo MsgWaitForMultipleObjects DestroyCursor SetCaretPos OpenClipboard SetWindowLongA GetDlgCtrlID ClientToScreen CloseClipboard EmptyClipboard IsChild CreateCaret GetWindowLongA ValidateRect TrackMouseEvent GetKeyboardLayout GetMessageTime DefWindowProcA CreateWindowExA GetClipboardData SendMessageA DestroyCaret SetCapture SetClipboardData SetCursor SystemParametersInfoA AppendMenuA IsClipboardFormatAvailable GetCaretBlinkTime ShowCaret GetParent PtInRect CreateWindowExW RegisterClassExA

kernel32

GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapReAlloc GetFileType HeapAlloc HeapFree ExitProcess GetStdHandle RtlUnwind LoadLibraryW UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualProtect VirtualAlloc GetVersionExW GetModuleHandleA GetModuleFileNameW FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue GetStartupInfoW IsDebuggerPresent InitializeSListHead GetCurrentProcessId TerminateProcess UnhandledExceptionFilter ResetEvent GetCommandLineW DeleteFileW GetTempPathW SetUnhandledExceptionFilter GetModuleHandleW GetProcAddress LocalFree CreateFileW GetFileSizeEx ReadFile CloseHandle GetLastError MultiByteToWideChar WideCharToMultiByte WriteFile OutputDebugStringW GetCurrentThreadId GetLocalTime GetTickCount GetLocaleInfoA Sleep GlobalSize GlobalAlloc GlobalLock LCMapStringW GlobalUnlock MulDiv FreeLibrary LoadLibraryExW LoadLibraryExA SetEvent GetLocaleInfoW CompareStringW GetCPInfo GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW InitializeCriticalSectionAndSpinCount SetLastError GetNativeSystemInfo GetCurrentThread SwitchToThread GetCurrentProcess WaitForSingleObjectEx DuplicateHandle DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection GetModuleHandleExW QueueUserWorkItem IsProcessorFeaturePresent QueryPerformanceFrequency QueryPerformanceCounter RaiseException GetOEMCP DecodePointer EncodePointer GetStringTypeW FormatMessageW WriteConsoleW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap HeapSize SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers

gdi32

CreateBitmap ExtCreatePen CreateRectRgnIndirect GetDeviceCaps CreateRectRgn DeleteObject CombineRgn CreateSolidBrush Polygon CreatePen CreateCompatibleBitmap SaveDC ExtTextOutA GetTextExtentPoint32A GetTextExtentExPointW GdiAlphaBlend Polyline GetTextExtentExPointA CreatePatternBrush GetTextExtentPoint32W SetTextColor SetBkMode LineTo GetObjectW MoveToEx SetBkColor Ellipse RestoreDC GetTextMetricsA SetTextAlign RoundRect ExtTextOutW IntersectClipRect BitBlt CreateFontIndirectW SelectObject CreateDIBSection CreateCompatibleDC DeleteDC CreateFontW

ole32

CoCreateInstance RevokeDragDrop RegisterDragDrop OleInitialize CLSIDFromProgID OleUninitialize ReleaseStgMedium CoInitializeEx CoUninitialize DoDragDrop

oleaut32

SysFreeString SysAllocStringLen

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_ee76ee899fd09281dbd059a893416df9_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

imm32

comctl32

shlwapi

shell32

user32

kernel32

gdi32

ole32

oleaut32

advapi32

generic