2026-07-20_e8fe93d47f23ba576cb51e82dc125511_amadey_darkgate_elex_floxif_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_e8fe93d47f23ba576cb51e82dc125511_amadey_darkgate_elex_floxif_luca-stealer_lynx_medusalocker_njrat
Size 1.3MB
Sample260720-vavlfaat2s
SHA256 3b1e0416a7a3225630ed6ff18ec895fb2086e138b9829928c45e9cf72091b785
MD5 e8fe93d47f23ba576cb51e82dc125511
SHA1 725ae506fbbae70f1be533d46e24ccc9e9874084
SHA512 8b9958d3a7cd174bfcc996577a7ab4035dc89b03a4dec1cc10cf5a92acf204ffb78b6b57b986339027ad58f903971ff91ecfa194eb93c8a65136f46a5381bb81
SSDEEP 24576:vj9hXHwNoeq4Cckyv8HwiKs+phAamIkRyjaLnI83Vza3j2Q3ohZrEH7vh:5hsFCvKs+puamjnzI835a3jJ3ohUh
TLSH
T14A559E603682C136E5A180B1693CDB2A816DBEB50B7754C7E3D45F2E0F359C35B39A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-20_e8fe93d47f23ba576cb51e82dc125511_amadey_darkgate_elex_floxif_luca-stealer_lynx_medusalocker_njrat

File Explorer

2026-07-20_e8fe93d47f23ba576cb51e82dc125511_amadey_darkgate_elex_floxif_luca-stealer_lynx_medusalocker_njrat

.exe 1.3MB

2026-07-20_e8fe93d47f23ba576cb51e82dc125511_amadey_darkgate_elex_floxif_luca-stealer_lynx_medusalocker_njrat

IMPHASH 00c443173639834ce0ea2a40bf17cac1
SHA256 3b1e0416a7a3225630ed6ff18ec895fb2086e138b9829928c45e9cf72091b785
MD5 e8fe93d47f23ba576cb51e82dc125511
SHA1 725ae506fbbae70f1be533d46e24ccc9e9874084
SHA512 8b9958d3a7cd174bfcc996577a7ab4035dc89b03a4dec1cc10cf5a92acf204ffb78b6b57b986339027ad58f903971ff91ecfa194eb93c8a65136f46a5381bb81
SSDEEP 24576:vj9hXHwNoeq4Cckyv8HwiKs+phAamIkRyjaLnI83Vza3j2Q3ohZrEH7vh:5hsFCvKs+puamjnzI835a3jJ3ohUh
TLSH
T14A559E603682C136E5A180B1693CDB2A816DBEB50B7754C7E3D45F2E0F359C35B39A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

24:06:46:ff:c3:2f:fc:c6:90:59:15:4f:b5:10:63:46:44:4f:4f:56:b0:d7:ce:39:0a:0c:5b:b1:a3:92:e7:d4

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 1, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

77:d9:12:68:10:b4:7a:d8:41:65:66:51

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 8, 2024 - Feb 7, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

568915

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\980511\out\Release\QHService.pdb

kernel32

ProcessIdToSessionId lstrcmpiW GetFileAttributesExW FreeResource CreateToolhelp32Snapshot Process32FirstW Process32NextW WTSGetActiveConsoleSessionId SetFilePointer FlushFileBuffers SetEndOfFile GetModuleHandleA GetModuleHandleExW CreateDirectoryW MoveFileW CopyFileW GetCommandLineW LockFileEx UnlockFileEx GetLocalTime GetEnvironmentVariableW SetEnvironmentVariableW GlobalLock GlobalUnlock GetDiskFreeSpaceW GlobalAlloc OpenEventA QueryDepthSList InterlockedPopEntrySList GetProcessAffinityMask ChangeTimerQueueTimer GetThreadPriority SetThreadPriority SignalObjectAndWait CreateTimerQueue TryEnterCriticalSection GetModuleFileNameW FreeLibrary WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetConsoleOutputCP ReadConsoleW GetConsoleMode IsValidLocale GetFileType GetCurrentThread GetStdHandle GetCommandLineA ExitProcess FreeLibraryAndExitThread ExitThread InterlockedFlushSList InterlockedPushEntrySList RtlUnwind lstrcmpiA lstrcmpA FormatMessageA GetStartupInfoW InitializeSListHead DeleteTimerQueueTimer CreateTimerQueueTimer UnregisterWaitEx QueueUserWorkItem UnmapViewOfFile MapViewOfFileEx MapViewOfFile DeviceIoControl CreateFileMappingW VirtualQuery VirtualFree VirtualProtect VirtualAlloc GetVersionExW GetWindowsDirectoryW GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo IsProcessorFeaturePresent GetThreadTimes CreateProcessW GetExitCodeThread GetCurrentThreadId CreateThread SwitchToThread TerminateProcess GetCurrentProcessId GetCurrentProcess CreateSemaphoreW WaitForMultipleObjects Sleep CreateEventW CreateEventA CreateMutexW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection HeapSize HeapFree HeapReAlloc HeapAlloc QueryPerformanceCounter SetLastError GetLastError RaiseException GetLongPathNameW SetUnhandledExceptionFilter UnhandledExceptionFilter GetVolumeInformationW CancelIo CreateNamedPipeW DisconnectNamedPipe ConnectNamedPipe PeekNamedPipe SetNamedPipeHandleState HeapWalk HeapUnlock HeapLock SetFilePointerEx GetFileSizeEx CreateFileA LocalFileTimeToFileTime GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc OutputDebugStringW IsDebuggerPresent FindFirstFileW CreateFileW GetCurrentDirectoryW MoveFileExW SetFileAttributesW RemoveDirectoryW DeleteFileW GetFileAttributesW SystemTimeToFileTime GetSystemTime GetSystemWindowsDirectoryW GetFileSize WritePrivateProfileStringW GetDriveTypeW GetPrivateProfileStringW TerminateThread GetOverlappedResult FindNextFileW ResumeThread InitializeCriticalSection DeleteCriticalSection UnlockFile LockFile GetVersion FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcessHeap HeapDestroy FindClose EnumSystemLocalesW GetUserDefaultLCID GetLocaleInfoW LCMapStringW WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetTimeZoneInformation UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask LocalFree LocalAlloc GlobalFree GetProcAddress GetModuleHandleW ExpandEnvironmentStringsW

user32

wsprintfW GetSystemMetrics RegisterDeviceNotificationW UnregisterDeviceNotification CharNextW LoadStringW

advapi32

SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCreateKeyExW RegDeleteKeyW SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW RegQueryValueW RegQueryInfoKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW ChangeServiceConfig2W ChangeServiceConfigW CreateServiceW SetNamedSecurityInfoW SetEntriesInAclW GetNamedSecurityInfoW QueryServiceStatus StartServiceW QueryServiceConfig2W CloseServiceHandle OpenServiceW OpenSCManagerW CreateProcessAsUserW GetLengthSid SetTokenInformation DuplicateTokenEx CloseEventLog ReadEventLogW OpenEventLogW ConvertSidToStringSidW EqualSid AllocateAndInitializeSid FreeSid ConvertStringSidToSidW OpenProcessToken RegNotifyChangeKeyValue RegEnumValueW RegEnumKeyExW RegSetValueExW RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegDeleteValueW RegEnumKeyExA

shell32

ShellExecuteExW ord165 SHGetFolderPathW ord680 SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetSpecialFolderPathW

ole32

CoCreateInstance CoTaskMemFree CoTaskMemAlloc CoInitialize GetHGlobalFromStream CoInitializeSecurity CoTaskMemRealloc CreateStreamOnHGlobal CoUninitialize

oleaut32

SysAllocString SysFreeString SysAllocStringByteLen SysStringLen VarUI4FromStr

shlwapi

SHDeleteKeyW SHGetValueW PathFindExtensionW PathFindFileNameW StrStrIW StrCmpIW PathAppendW PathFileExistsW PathCombineW ord437 PathIsPrefixW PathRemoveBackslashW StrCatW StrCpyW SHGetValueA StrStrIA SHDeleteValueW SHSetValueW PathRemoveFileSpecW PathIsDirectoryW SHSetValueA

ws2_32

htonl htons ntohs ntohl

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

psapi

EnumProcessModules GetModuleFileNameExW

iphlpapi

GetAdaptersInfo

winmm

timeGetTime

wininet

InternetOpenUrlW InternetReadFile InternetOpenW DeleteUrlCacheEntryW InternetSetOptionW InternetCloseHandle HttpQueryInfoW

wtsapi32

WTSWaitSystemEvent

userenv

ExpandEnvironmentStringsForUserW DestroyEnvironmentBlock CreateEnvironmentBlock

rpcrt4

NdrAsyncClientCall RpcStringBindingComposeW RpcBindingFromStringBindingW RpcAsyncInitializeHandle RpcAsyncCompleteCall RpcStringFreeW RpcBindingFree NdrAsyncServerCall NdrServerCall2 RpcServerUseProtseqEpW RpcServerRegisterIfEx RpcServerListen RpcMgmtStopServerListening RpcServerUnregisterIf

ntdll

NtSetInformationToken

generic

count=21, id=259, version=29395,

count=199, id=261, version=29395,

count=2, id=257, version=25203,

count=4, id=261, version=24234,

count=3, id=261, productName=VS2017 v15.0 build 25017, version=25017,

count=1, id=199, version=41118,

count=27, id=259, version=26706,

count=7, id=261, version=27054,

count=12, id=261, version=27051,

count=3, id=261, version=27045,

count=10, id=260, version=27045,

count=40, id=260, version=26706,

count=138, id=261, version=26706,

count=31, id=260, version=29395,

count=55, id=257, version=29395,

count=644, id=1, productName=Unmarked objects,

count=1, id=261, version=35226,

count=47, id=265, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,