2026-07-20_96674adef85351e1b11e6e4f1bc15754_amadey_darkgate_elex_floxif_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_96674adef85351e1b11e6e4f1bc15754_amadey_darkgate_elex_floxif_luca-stealer_lynx_medusalocker_njrat
Size 1.9MB
Sample260720-xt1mxaes3y
SHA256 ce434a16527c107aacafcfec4354abeb2c656c9932fd940be4b76856f84d2b80
MD5 96674adef85351e1b11e6e4f1bc15754
SHA1 d627ac91cfb45ea968a87d4ea93bf43811a6ff1a
SHA512 c59d85072d074736cd12e56a48588c69ac8a3b2e2644717cc9a1b93584f8affc0b534e7c91949d2408d55efb226822b18f1b7e8bba113f18714ba7b8c07860d9
SSDEEP 49152:k6PHz6SkaJuP94bJTAa1T2ZJa7tZ0Grc1e+ECs4SZjh:1PHkaJc4b9AJa7taac9W
TLSH
T127958E21B642C136DA9301B06D7CAF6AC4ACEB350B7805D773D80F2E59741D36B36A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-20_96674adef85351e1b11e6e4f1bc15754_amadey_darkgate_elex_floxif_luca-stealer_lynx_medusalocker_njrat

File Explorer

2026-07-20_96674adef85351e1b11e6e4f1bc15754_amadey_darkgate_elex_floxif_luca-stealer_lynx_medusalocker_njrat

.exe 1.9MB

2026-07-20_96674adef85351e1b11e6e4f1bc15754_amadey_darkgate_elex_floxif_luca-stealer_lynx_medusalocker_njrat

IMPHASH f1563bdaee81d2116f8c6124adf625a3
SHA256 ce434a16527c107aacafcfec4354abeb2c656c9932fd940be4b76856f84d2b80
MD5 96674adef85351e1b11e6e4f1bc15754
SHA1 d627ac91cfb45ea968a87d4ea93bf43811a6ff1a
SHA512 c59d85072d074736cd12e56a48588c69ac8a3b2e2644717cc9a1b93584f8affc0b534e7c91949d2408d55efb226822b18f1b7e8bba113f18714ba7b8c07860d9
SSDEEP 49152:k6PHz6SkaJuP94bJTAa1T2ZJa7tZ0Grc1e+ECs4SZjh:1PHkaJc4b9AJa7taac9W
TLSH
T127958E21B642C136DA9301B06D7CAF6AC4ACEB350B7805D773D80F2E59741D36B36A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

63:84:2d:cb:2b:8f:b3:25:b4:f5:4a:3e:40:5c:22:76:64:49:a0:d0:fb:15:12:c2:1b:49:c4:bf:99:17:3d:fd

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,OU=OP BG-MB BU-SYS SW RD Ctr,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Chains

Jun 16, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

04:e1:d6:69:bc:6c:5b:ca:5d:9c:d2:64:47:77:6b:07

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 24, 2024 - Sep 26, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1108101

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\AsusFanControlService\Release\AsusFanControlService.pdb

wtsapi32

WTSSendMessageW

wintrust

WinVerifyTrust

crypt32

CryptQueryObject CryptMsgClose CryptMsgGetParam CertCloseStore CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore

shlwapi

PathIsDirectoryW ord217 PathAddBackslashW PathAppendW PathRemoveFileSpecW PathFileExistsW

ntdll

RtlUnwind

kernel32

DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection SetEvent ResetEvent CreateEventW CreateThread GetCurrentThreadId GetModuleHandleW LoadLibraryExW LoadResource SizeofResource FindResourceW LocalSize FormatMessageW lstrcmpiW lstrlenW WTSGetActiveConsoleSessionId CreateToolhelp32Snapshot Process32FirstW Process32NextW ReleaseMutex CreateMutexW OpenMutexW OpenEventW OpenProcess QueryFullProcessImageNameW DuplicateHandle FormatMessageA Thread32First Thread32Next EnterCriticalSection LeaveCriticalSection CreateFileW ReadFile WriteFile GetFileAttributesExW K32EnumDeviceDrivers K32GetDeviceDriverBaseNameW GetStdHandle GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute WriteConsoleW GetFileAttributesA GetCurrentProcessId GetDynamicTimeZoneInformation CreateFileA DeleteFileA SetFileAttributesA GetCurrentDirectoryW TryEnterCriticalSection QueryPerformanceCounter FindClose FindFirstFileExW FindNextFileW SetEndOfFile SetFilePointerEx WaitForSingleObjectEx SwitchToThread GetExitCodeThread InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue GetCommandLineW TlsFree GetSystemTimeAsFileTime EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW OutputDebugStringW GetModuleHandleExW ExitProcess HeapSize CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualProtect VirtualAlloc FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer GetCurrentThread SetLastError CloseHandle GetFileAttributesW GetModuleFileNameA DeleteFileW CreateDirectoryW OutputDebugStringA WideCharToMultiByte MultiByteToWideChar GetModuleHandleA GetModuleFileNameW FreeLibrary GetSystemDirectoryW GetLastError GetTickCount lstrcmpW LocalFree LocalAlloc LoadLibraryW GetProcAddress Sleep IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW ExitThread GetSystemInfo VirtualQuery SetStdHandle GetFileType GetVersionExW GetCurrentProcess WaitForSingleObject TlsSetValue ResumeThread InitializeCriticalSection SetEnvironmentVariableW GetTimeZoneInformation HeapReAlloc GetFileSizeEx FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW HeapAlloc HeapFree GetProcessHeap GetConsoleCP ReadConsoleW MoveFileExW CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait RemoveDirectoryW

user32

ShowWindow CharNextW RegisterClassExW PostQuitMessage DefWindowProcW PostThreadMessageW PostMessageW DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW LoadStringW MessageBoxW wsprintfW MessageBoxA CharUpperW UpdateWindow FindWindowW LoadCursorW LoadIconW CreateWindowExW ExitWindowsEx

advapi32

QueryServiceStatus BuildTrusteeWithSidW SetNamedSecurityInfoW GetNamedSecurityInfoW GetAce FreeSid EqualSid DeleteAce AllocateAndInitializeSid RegNotifyChangeKeyValue SetSecurityDescriptorDacl InitializeSecurityDescriptor StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfigW RegSetValueExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW ReportEventW RegisterEventSourceW DeregisterEventSource RegSetValueExA RegQueryValueExA RegQueryInfoKeyW RegOpenKeyExA RegCreateKeyExA LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegQueryValueExW RegOpenKeyExW RegCloseKey

ole32

CoSetProxyBlanket CoInitializeSecurity CoRegisterClassObject CoInitialize CLSIDFromProgID CoCreateInstance CoRevokeClassObject CoResumeClassObjects CoAddRefServerProcess CoReleaseServerProcess StringFromGUID2 CoInitializeEx CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoUninitialize

shell32

SHGetFolderPathAndSubDirW

oleaut32

SafeArrayAccessData SafeArrayUnaccessData VariantClear SysAllocString SysFreeString SysStringLen VarUI4FromStr SafeArrayCreate RegisterTypeLi UnRegisterTypeLi SysAllocStringLen SysStringByteLen SysAllocStringByteLen VariantInit VariantCopy LoadRegTypeLi LoadTypeLi

hid

HidD_GetHidGuid HidD_GetAttributes

setupapi

SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_96674adef85351e1b11e6e4f1bc15754_amadey_darkgate_elex_floxif_luca-stealer_lynx_medusalocker_njrat

PE Signature issue

wtsapi32

wintrust

crypt32

shlwapi

ntdll

kernel32

user32

advapi32

ole32

shell32

oleaut32

hid

setupapi

generic