2026-07-19_baacbe2937af2150becf351af8dcd944_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-19_baacbe2937af2150becf351af8dcd944_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat
Size 4.1MB
Sample260720-a2ap5aat4n
SHA256 74b87e6977acc410d6438b330be85bd5a9d71928d596dc173c887949e2fee2ae
MD5 baacbe2937af2150becf351af8dcd944
SHA1 840aef6b6c6cb01689a55f45b5386e861eea0e5a
SHA512 884a064f42b771cf1ca07bd7adc68f6586d1c63d7b9be7e49487f6c2e25bb660a21c5e21d80d0e6055dd3eccc97e2e701505c7ca6c4de57fdc8cc7900cf834cb
SSDEEP 98304:0NqmeozF4WYWNDpmG8O+ymWVbPw7WCpkOJElB57SwsotedqEiKS6cyaiKS6GCvnp:0NqmeJWht5rMqR
TLSH
T184168E303A46C576E78210B6497CFAFF626CD5190FB641C3E3986B2EAD706C22F3155A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-19_baacbe2937af2150becf351af8dcd944_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

.exe 4.1MB

2026-07-19_baacbe2937af2150becf351af8dcd944_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

IMPHASH 185846b50a111eaa912e80fd0fb45eae
SHA256 74b87e6977acc410d6438b330be85bd5a9d71928d596dc173c887949e2fee2ae
MD5 baacbe2937af2150becf351af8dcd944
SHA1 840aef6b6c6cb01689a55f45b5386e861eea0e5a
SHA512 884a064f42b771cf1ca07bd7adc68f6586d1c63d7b9be7e49487f6c2e25bb660a21c5e21d80d0e6055dd3eccc97e2e701505c7ca6c4de57fdc8cc7900cf834cb
SSDEEP 98304:0NqmeozF4WYWNDpmG8O+ymWVbPw7WCpkOJElB57SwsotedqEiKS6cyaiKS6GCvnp:0NqmeJWht5rMqR
TLSH
T184168E303A46C576E78210B6497CFAFF626CD5190FB641C3E3986B2EAD706C22F3155A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

b1:86:aa:9c:6c:31:75:da:c9:ea:db:a8:93:84:52:5f:67:ec:68:3e:6c:04:a3:67:8e:4c:69:8c:a6:05:f8:2e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91510100677184972A,CN=四川迅游网络科技股份有限公司,O=四川迅游网络科技股份有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Apr 24, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

09:bd:24:99:a4:05:3d:92:34:bd:bf:65:6c:57:55:01

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 11, 2025 - Mar 13, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1596758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\GitLab-Runner\builds\iTDBTU9H\0\xunyou7.0\XunYouFramework7\Release\XunYou.pdb

xyinteractive

InteractiveGetMainWnd

kernel32

FindFirstFileW lstrcmpW FindNextFileW FindClose CreatePipe GetStartupInfoA CreateProcessA WaitForSingleObject GetExitCodeProcess CreateProcessW GetEnvironmentVariableW SetEnvironmentVariableW SetDllDirectoryW SetPriorityClass GetCurrentProcess CreateMutexW SetCurrentDirectoryW FormatMessageA InitializeCriticalSectionAndSpinCount TryEnterCriticalSection DeleteFileW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx HeapReAlloc HeapSize GetFileType HeapFree HeapAlloc GetStdHandle ExitProcess FreeLibraryAndExitThread ResumeThread ExitThread CreateThread GetDriveTypeW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InterlockedFlushSList InterlockedPushEntrySList RtlUnwind GetThreadTimes GetCurrentThread GetCurrentProcessId GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LeaveCriticalSection SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer SwitchToThread SetThreadpoolTimer CreateThreadpoolTimer FreeLibraryWhenCallbackReturns GetTickCount64 GetSystemTimeAsFileTime GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW InitOnceExecuteOnce GetCPInfo CompareStringEx LCMapStringEx EncodePointer QueryPerformanceFrequency QueryPerformanceCounter GetStringTypeW GetNativeSystemInfo GetExitCodeThread WaitForSingleObjectEx SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW MoveFileExW WritePrivateProfileStringW GetPrivateProfileSectionW GetCurrentThreadId GetVersionExA GetVersionExW GlobalUnlock GlobalLock SetFilePointer WriteFile ReadFile GlobalFindAtomW InitializeCriticalSection SetLastError FindResourceW LoadResource LockResource SizeofResource Sleep GetTickCount DecodePointer InitializeCriticalSectionEx EnterCriticalSection GetModuleFileNameW GetPrivateProfileIntW CreateDirectoryW GetTempPathW SetConsoleCtrlHandler CopyFileW CreateDirectoryExW DeviceIoControl AreFileApisANSI SetFileTime SetFileInformationByHandle SetFileAttributesW GetFullPathNameW CreateFileW GetFinalPathNameByHandleW CreateFileMappingW MapViewOfFile SetEndOfFile WriteConsoleW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindFirstFileExW GetCurrentDirectoryW GetLocaleInfoEx LocalFree TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive IsDebuggerPresent LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo RaiseException GetTimeZoneInformation IsValidCodePage GetACP GetModuleHandleW GetModuleHandleExW GetModuleFileNameA FreeLibrary DeleteCriticalSection WaitForThreadpoolTimerCallbacks OutputDebugStringW UnmapViewOfFile CloseHandle LoadLibraryW GetProcAddress OutputDebugStringA GlobalAlloc MultiByteToWideChar GlobalFree GetLastError WideCharToMultiByte ReadConsoleW CloseThreadpoolWait HeapQueryInformation SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP

user32

DestroyCaret MapWindowPoints GetClientRect GetActiveWindow GetWindow EnableWindow IsWindow ShowWindowAsync SendMessageTimeoutW MessageBoxW MoveWindow IsWindowEnabled BroadcastSystemMessageW ChangeWindowMessageFilterEx SetPropW GetIconInfo DrawIconEx LoadImageW CreateIconFromResourceEx OpenClipboard LookupIconIdFromDirectory CloseClipboard EmptyClipboard IsRectEmpty GetClipboardData SetClipboardData GetAsyncKeyState GetParent GetWindowLongW GetKeyState GetDC LoadStringW SetWindowLongW ReleaseDC GetFocus SetCaretPos GetKeyboardLayoutNameW CreateCaret CreateIconFromResource PostQuitMessage MonitorFromWindow SetRect UnregisterClassW PostMessageW SetForegroundWindow IsWindowVisible IsIconic MonitorFromRect GetMonitorInfoW GetWindowRect RegisterWindowMessageW CopyRect InflateRect SetCursor SendMessageW SetWindowPos WindowFromPoint ClientToScreen ScreenToClient GetCursorPos TrackMouseEvent PtInRect GetCapture GetDoubleClickTime GetSystemMetrics GetMessageTime DefWindowProcW ShowWindow IntersectRect KillTimer SetTimer OffsetRect DestroyIcon

gdi32

SelectObject GetDeviceCaps DeleteObject SetStretchBltMode CreateHalftonePalette DeleteDC GetStockObject CreateDCW GetDIBits GetObjectW GetPixel SetPixelV SetDIBitsToDevice BitBlt CreateDIBSection SetDIBColorTable CreateCompatibleDC StretchBlt GdiFlush GetPaletteEntries

advapi32

RegOpenKeyExW RegCloseKey RegSetValueExW RegDeleteValueW CryptGenRandom CryptReleaseContext CryptAcquireContextA RegQueryValueExW

shell32

ShellExecuteW SHGetPathFromIDListW Shell_NotifyIconW SHGetMalloc SHGetSpecialFolderLocation

ole32

OleUninitialize OleInitialize CoUninitialize CreateStreamOnHGlobal CoCreateInstance CoInitialize CoInitializeEx

oleaut32

GetErrorInfo SetErrorInfo VariantChangeType CreateErrorInfo SysAllocString VariantClear VariantInit SysStringLen SysFreeString SystemTimeToVariantTime

shlwapi

PathRemoveFileSpecA PathAddBackslashA PathRemoveFileSpecW PathAppendW PathAddBackslashW PathFileExistsW StrTrimW ord156 StrToIntExW PathIsDirectoryW PathFindFileNameA StrCpyNW

imm32

ImmAssociateContextEx ImmSetCandidateWindow ImmGetCompositionStringW ImmReleaseContext ImmGetContext ImmNotifyIME

crypt32

CertOpenSystemStoreA CertFreeCertificateContext CertCreateCertificateContext CryptStringToBinaryA CertAddCertificateContextToStore CertEnumCertificatesInStore CertCloseStore CertGetNameStringW CertOpenStore CertGetNameStringA CertDeleteCertificateFromStore

gdiplus

GdipGetImageEncoders GdipCloneImage GdipBitmapUnlockBits GdipAlloc GdipDisposeImage GdipFree GdipBitmapLockBits GdipGetImageEncodersSize GdipSaveImageToStream GdipCreateBitmapFromScan0

ws2_32

WSAStartup

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-19_baacbe2937af2150becf351af8dcd944_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

xyinteractive

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

imm32

crypt32

gdiplus

ws2_32

generic