2026-07-23_c0412aa35000404d8fefc9f16b605caa_amadey_darkgate_elex_luca-stealer_lynx_njrat_remcos

General

Target
2026-07-23_c0412aa35000404d8fefc9f16b605caa_amadey_darkgate_elex_luca-stealer_lynx_njrat_remcos
Size 1.7MB
Sample260723-fb1rhsdr2w
SHA256 1466b82806ecaed96b0fa2eb405d8724d14e8523a9344de6383c5237cbb56132
MD5 c0412aa35000404d8fefc9f16b605caa
SHA1 93a11a55234c813d1680f1eca8d7ec87d7fade37
SHA512 4bcc5ba7b32ae5789c3d66ed54ca3d1c60e5a0e882fbec1f842d20dcac736503fbf615ef5dfad49e1fdeaf89c3913aab22d8d9532cec56e18fc9465cd2c8fa85
SSDEEP 24576:90NvXuVghSbjs2gL25x6Yt2ku7TpssilSatr0zAiX90z/F0jsFB3SQke:9pPbjs2G258H7TeblSaB0zj0yjoB2
TLSH
T1EC85E11235D1D432C5B311B249AE875A9279BD700B7288DBE3C8172D5F709D2AB33EB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_c0412aa35000404d8fefc9f16b605caa_amadey_darkgate_elex_luca-stealer_lynx_njrat_remcos

File Explorer

2026-07-23_c0412aa35000404d8fefc9f16b605caa_amadey_darkgate_elex_luca-stealer_lynx_njrat_remcos

.exe 1.7MB

2026-07-23_c0412aa35000404d8fefc9f16b605caa_amadey_darkgate_elex_luca-stealer_lynx_njrat_remcos

IMPHASH 70ac13cda5d9728ade81378aec8b09b7
SHA256 1466b82806ecaed96b0fa2eb405d8724d14e8523a9344de6383c5237cbb56132
MD5 c0412aa35000404d8fefc9f16b605caa
SHA1 93a11a55234c813d1680f1eca8d7ec87d7fade37
SHA512 4bcc5ba7b32ae5789c3d66ed54ca3d1c60e5a0e882fbec1f842d20dcac736503fbf615ef5dfad49e1fdeaf89c3913aab22d8d9532cec56e18fc9465cd2c8fa85
SSDEEP 24576:90NvXuVghSbjs2gL25x6Yt2ku7TpssilSatr0zAiX90z/F0jsFB3SQke:9pPbjs2G258H7TeblSaB0zj0yjoB2
TLSH
T1EC85E11235D1D432C5B311B249AE875A9279BD700B7288DBE3C8172D5F709D2AB33EB6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

202256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\cruser\workspace\CR-Windows-x86-Client-Builder\CRLogTransport\public\binary\Win\x86\Release_MT\CRLogTransport.pdb

shlwapi

PathIsDirectoryW PathFileExistsW

wininet

InternetConnectW InternetCloseHandle HttpSendRequestW InternetCrackUrlW InternetSetOptionW InternetSetOptionA InternetOpenW InternetSetStatusCallbackW InternetQueryDataAvailable InternetQueryOptionW HttpOpenRequestW InternetReadFile HttpQueryInfoW

kernel32

GetACP MultiByteToWideChar WideCharToMultiByte CompareFileTime FindFirstFileW FindNextFileW FindClose CreateFileW FreeEnvironmentStringsW DeleteFileW CloseHandle GetProcAddress MoveFileExW FreeLibrary GetEnvironmentStringsW GetFileTime GetLastError FlushFileBuffers GetModuleFileNameW HeapFree InitializeCriticalSectionEx HeapSize Sleep HeapReAlloc RaiseException HeapAlloc DecodePointer DeleteCriticalSection GetProcessHeap GetSystemTimeAsFileTime WriteFile GetFileSizeEx GetCommandLineW GetConsoleCP GetConsoleMode GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW SetStdHandle GetTimeZoneInformation WriteConsoleW FindFirstFileExW IsValidCodePage GetOEMCP SetEnvironmentVariableW ReadFile GetStdHandle GetModuleHandleExW ExitProcess SetConsoleCtrlHandler FormatMessageW GetStringTypeW EnterCriticalSection LeaveCriticalSection SetLastError InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent SetEvent ResetEvent WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead FormatMessageA LocalFree SetEndOfFile SetFilePointerEx AreFileApisANSI OutputDebugStringW RtlUnwind LoadLibraryExW GetFileType GetCommandLineA

shell32

SHCreateDirectoryExW SHGetFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_c0412aa35000404d8fefc9f16b605caa_amadey_darkgate_elex_luca-stealer_lynx_njrat_remcos

shlwapi

wininet

kernel32

shell32

generic