2026-07-20_f2b5feaa018eb0e121cf1f46bd6debb0_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_f2b5feaa018eb0e121cf1f46bd6debb0_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat
Size 1.4MB
Sample260720-rca32aet8t
SHA256 3e27cc1bfbd01a9f001d4c42f05358d875bd30d2a191d29601d3e85db11535b3
MD5 f2b5feaa018eb0e121cf1f46bd6debb0
SHA1 470cb75a18b3f12e86701666dcd9c2388828ad4d
SHA512 2161635dcb4cc8740b6b4b4bbb75b23ca57957eb73a417231ed8b02cc9803b340814b0f58c892fd0c7a979f4cb2f9a7e9cf2a8f438eb10aaa81f6a5f877d5f0a
SSDEEP 24576:Z4pVMY5kynAkO/xFthijnOTEybYUsteczgXe4i7ojhsP5Lgrk1TWb4AN5:MJkH/xFthijOTEybYUiKe30jaNf1TWbp
TLSH
T1EF65CF317296D032D06240F08938AEB7A56CBC284BB576DF63E47F6E78741C25E34B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_f2b5feaa018eb0e121cf1f46bd6debb0_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat

File Explorer

2026-07-20_f2b5feaa018eb0e121cf1f46bd6debb0_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat

.exe 1.4MB

2026-07-20_f2b5feaa018eb0e121cf1f46bd6debb0_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat

IMPHASH 924a35a18e0a1989b5fd00f0e44bc971
SHA256 3e27cc1bfbd01a9f001d4c42f05358d875bd30d2a191d29601d3e85db11535b3
MD5 f2b5feaa018eb0e121cf1f46bd6debb0
SHA1 470cb75a18b3f12e86701666dcd9c2388828ad4d
SHA512 2161635dcb4cc8740b6b4b4bbb75b23ca57957eb73a417231ed8b02cc9803b340814b0f58c892fd0c7a979f4cb2f9a7e9cf2a8f438eb10aaa81f6a5f877d5f0a
SSDEEP 24576:Z4pVMY5kynAkO/xFthijnOTEybYUsteczgXe4i7ojhsP5Lgrk1TWb4AN5:MJkH/xFthijOTEybYUiKe30jaNf1TWbp
TLSH
T1EF65CF317296D032D06240F08938AEB7A56CBC284BB576DF63E47F6E78741C25E34B5A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

434912

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\ccd-app\nightly_build\build\msvs_win32_x86\Release\x86\sym\AdobeUpdateService\AdobeUpdateService\AdobeUpdateService.pdb

kernel32

WideCharToMultiByte CopyFileW GetExitCodeProcess QueryPerformanceFrequency FreeLibrary GetProcAddress CloseHandle DeleteFileW MultiByteToWideChar SetFileAttributesW OpenProcess WaitForSingleObject FindClose GetTempPathW GetModuleFileNameW GetCurrentProcess FindNextFileW FindFirstFileW DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GetProcessHeap HeapAlloc CreateThread GetLastError Sleep HeapFree ResumeThread SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW ReadConsoleW EnumSystemLocalesW IsValidLocale GetLocaleInfoW CompareStringW GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileType GetCommandLineW GetCommandLineA GetModuleHandleExW ExitProcess GetStdHandle GetTimeZoneInformation LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InterlockedPushEntrySList VerifyVersionInfoW RtlUnwind RaiseException OutputDebugStringW GetStartupInfoW IsDebuggerPresent GetFileSizeEx CreateFileW SetLastError TerminateProcess LocalAlloc HeapSize CreateToolhelp32Snapshot CreateEventW ProcessIdToSessionId Process32NextW SetEvent GlobalAlloc Process32FirstW GlobalFree HeapReAlloc ResetEvent LocalFree GetCurrentProcessId GetModuleHandleW lstrcmpiW lstrcmpW ReadFile EnterCriticalSection WriteFile CreateNamedPipeW LeaveCriticalSection InitializeCriticalSection ConnectNamedPipe SetFilePointer GetCurrentThreadId GetFileAttributesW MoveFileExW FlushFileBuffers GetFileInformationByHandle GetUserDefaultLangID FileTimeToSystemTime GetLocalTime GetTimeFormatW SystemTimeToFileTime GetDateFormatW CreateMutexW ReleaseMutex OpenMutexW GetVersionExW GetUserDefaultUILanguage LCMapStringW GetUserDefaultLCID GetStringTypeW EncodePointer LCMapStringEx GetCPInfo InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime VerSetConditionMask

advapi32

CryptGenRandom GetTokenInformation DuplicateTokenEx CreateProcessAsUserW FreeSid AllocateAndInitializeSid EqualSid GetNamedSecurityInfoW RegQueryValueExW RegOpenKeyExW RegCloseKey OpenProcessToken StartServiceCtrlDispatcherW CryptReleaseContext CryptAcquireContextA RegisterServiceCtrlHandlerW SetServiceStatus

shell32

SHGetSpecialFolderPathW SHCreateDirectoryExW SHGetFolderLocation SHGetPathFromIDListW SHGetFolderPathW

ole32

StringFromGUID2 CoTaskMemFree CoCreateGuid CoInitialize CoUninitialize

oleaut32

VariantClear

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQueryUserToken

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

shlwapi

PathFileExistsW PathIsDirectoryW PathFindFileNameW PathRemoveFileSpecW PathRenameExtensionW PathIsFileSpecW PathAddExtensionW PathRemoveExtensionW PathAppendW

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain WTHelperGetProvCertFromChain WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_f2b5feaa018eb0e121cf1f46bd6debb0_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat

kernel32

advapi32

shell32

ole32

oleaut32

wtsapi32

userenv

version

shlwapi

crypt32

wintrust

generic