2026-07-30_c22d6d67d4b88c9f11121e85bce1ebfc_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_c22d6d67d4b88c9f11121e85bce1ebfc_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat
Size 3.2MB
Sample260730-nah43swdph
SHA256 800c14f2818f617de6c05deb9af969b4de80626ff8cc3d3932590e9f4bfc1ed2
MD5 c22d6d67d4b88c9f11121e85bce1ebfc
SHA1 373d89c136cee76262666774d3fce1b46bcf26ee
SHA512 a0698052a7c33e935e400d81e7cabd955d388d36437c7ed59661bcda57f684f4fbc9155b8381c6403b992c41f315ec9e7c40aaeb66f7de6e088f4f37e67ce93a
SSDEEP 49152:g0z2ImzbWqyGWn9tHuPFHse7FAuC185o9B+GcZj+XEuB52NxiKrR:gVX+j46QFAuKcZj+XEuBQNxB
TLSH
T1BEF59D617902C032E59200B1596CEFF649ADBE311B3591CBB2D43FAD59305D3AA36F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-30_c22d6d67d4b88c9f11121e85bce1ebfc_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

.exe 3.2MB

2026-07-30_c22d6d67d4b88c9f11121e85bce1ebfc_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

IMPHASH bc411c92c8ada6cd2006cee3a02cc5bb
SHA256 800c14f2818f617de6c05deb9af969b4de80626ff8cc3d3932590e9f4bfc1ed2
MD5 c22d6d67d4b88c9f11121e85bce1ebfc
SHA1 373d89c136cee76262666774d3fce1b46bcf26ee
SHA512 a0698052a7c33e935e400d81e7cabd955d388d36437c7ed59661bcda57f684f4fbc9155b8381c6403b992c41f315ec9e7c40aaeb66f7de6e088f4f37e67ce93a
SSDEEP 49152:g0z2ImzbWqyGWn9tHuPFHse7FAuC185o9B+GcZj+XEuB52NxiKrR:gVX+j46QFAuKcZj+XEuBQNxB
TLSH
T1BEF59D617902C032E59200B1596CEFF649ADBE311B3591CBB2D43FAD59305D3AA36F2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

ba:3e:75:4d:8c:9b:17:e9:ed:78:00:ef:28:9c:61:b4:71:84:c2:89:ef:d2:fc:be:5b:82:45:6a:1d:47:c2:6a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91510100394487762T,CN=成都奇鲁科技有限公司,O=成都奇鲁科技有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jul 15, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:07:8e:70:ea:ee:48:ff:eb:95:76:bd:d4:00:be:98

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 21, 2024 - May 20, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1268736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\jenkins\.jenkins\workspace\group_clean\winopt_assistant_group\client\winopt_assistant\Release\winopt_assistant_ui.pdb

powrprof

PowerReadFriendlyName PowerSetActiveScheme PowerEnumerate PowerGetActiveScheme

kernel32

WritePrivateProfileStringW OpenProcess K32EnumProcesses K32EmptyWorkingSet GetDiskFreeSpaceExW GetSystemDirectoryW GetEnvironmentVariableW GetProcessTimes TerminateProcess GetWindowsDirectoryW QueryFullProcessImageNameW K32GetProcessMemoryInfo CreateToolhelp32Snapshot Process32FirstW Process32NextW GetModuleFileNameA LocalFree HeapSetInformation SetErrorMode SetUnhandledExceptionFilter ReleaseSemaphore CreateEventW RegisterWaitForSingleObject UnregisterWaitEx RemoveDirectoryW GetFileAttributesW GetSystemInfo ExpandEnvironmentStringsW UnmapViewOfFile FlushViewOfFile MapViewOfFile OpenFileMappingW CreateFileMappingW GetTickCount64 GetCurrentProcessId CloseHandle WideCharToMultiByte CopyFileW GetCurrentProcess GetModuleHandleW GlobalMemoryStatusEx FindNextFileW FindFirstFileW FindClose DeleteFileA CreateDirectoryW LoadLibraryW GetProcAddress FreeLibrary Sleep DeleteFileW FindResourceW SizeofResource LockResource LoadResource GetPrivateProfileStringW FindResourceExW LeaveCriticalSection EnterCriticalSection InitializeCriticalSection MultiByteToWideChar DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap SetEvent HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale ExitProcess GetTimeZoneInformation GetConsoleMode GetConsoleOutputCP GetFileType ExitThread RtlUnwind QueryDepthSList InterlockedFlushSList FreeLibraryAndExitThread GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SignalObjectAndWait SetLastError GetCommandLineW IsBadReadPtr VirtualProtect SetPriorityClass GetCurrentThreadId CreateTimerQueue FindAtomW GetModuleFileNameW WaitForSingleObject AddAtomW DeleteAtom VerifyVersionInfoW VerSetConditionMask lstrcmpiA lstrcmpA GetSystemWindowsDirectoryW FreeResource CreateSemaphoreW WaitForMultipleObjectsEx WaitNamedPipeW GetStringTypeW FormatMessageW TryEnterCriticalSection EncodePointer CreateFileW FindFirstFileExW GetFileAttributesExW GetFullPathNameW GetTempPathW AreFileApisANSI DeviceIoControl QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount DuplicateHandle WaitForSingleObjectEx GetCurrentThread GetNativeSystemInfo CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo FlushFileBuffers FormatMessageA GetSystemTime SystemTimeToFileTime GetFileSize LockFileEx CreateFileMappingA UnlockFile HeapCompact GetVersionExA LoadLibraryA CreateFileA OutputDebugStringW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate GetVersionExW CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW InterlockedCompareExchange WriteFile HeapCreate ReadFile IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA ReleaseMutex UnhandledExceptionFilter GetStartupInfoW InterlockedExchange CreateThread SetThreadPriority CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus WaitForMultipleObjects GetFileSizeEx GetStdHandle SetFilePointerEx FileTimeToSystemTime GetModuleHandleA GetModuleHandleExA GetModuleHandleExW CreateProcessW lstrlenW MapViewOfFileEx LoadLibraryExW lstrcmpiW K32GetModuleFileNameExW

user32

SendMessageW GetMessageW PostThreadMessageW DefWindowProcW PostQuitMessage GetCursorPos RegisterClassExW TranslateMessage DispatchMessageW PeekMessageW WaitMessage CallMsgFilterW GetQueueStatus MsgWaitForMultipleObjectsEx WaitForInputIdle GetShellWindow GetWindowThreadProcessId SendMessageTimeoutW CharNextW GetForegroundWindow GetWindowRect WindowFromPoint GetDesktopWindow GetWindow GetWindowInfo GetAncestor LoadStringW GetSystemMetrics FindWindowW IsWindow PostMessageW RegisterWindowMessageW UnregisterClassW CallWindowProcW GetClassInfoExW SetWindowPos LoadIconW GetParent GetMonitorInfoW MonitorFromPoint SetForegroundWindow TrackPopupMenu GetSubMenu DestroyMenu LoadMenuW wsprintfW LoadCursorW SetWindowLongW GetWindowLongW KillTimer SetTimer ShowWindow DestroyWindow CreateWindowExW

advapi32

GetUserNameW RegQueryValueExA RegOpenKeyExA RegEnumKeyExA SetSecurityDescriptorDacl OpenProcessToken GetTokenInformation RegDeleteKeyW RegGetValueW RegSetValueExW RegDeleteValueW RegDeleteKeyExW RegCreateKeyExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey InitializeSecurityDescriptor

shell32

Shell_NotifyIconW ShellExecuteExW SHChangeNotify SHGetFolderPathW SHGetSpecialFolderPathW ShellExecuteW SHCreateDirectoryExW

ole32

CoTaskMemAlloc CoTaskMemFree CoUninitialize CoCreateInstance CoInitialize CoInitializeEx CoTaskMemRealloc CoInitializeSecurity CoCreateGuid

oleaut32

SysAllocString SysFreeString VariantInit VariantClear VarUI4FromStr

shlwapi

StrStrIA StrTrimA SHGetValueA StrCmpNIW StrStrIW PathIsRelativeW PathIsRootW StrCmpIW SHSetValueA PathAppendW PathRenameExtensionW PathFindFileNameW SHSetValueW SHGetValueW PathIsDirectoryW PathCombineW PathFileExistsW PathRemoveFileSpecW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

pdh

PdhGetFormattedCounterValue PdhCollectQueryData PdhAddCounterW PdhCloseQuery PdhOpenQueryW

winmm

timeBeginPeriod timeGetTime timeEndPeriod

crypt32

CertGetNameStringW CryptBinaryToStringW CryptStringToBinaryW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

wintrust

WinVerifyTrust WTHelperProvDataFromStateData

gdiplus

GdiplusStartup GdiplusShutdown

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

secur32

GetUserNameExW

generic

count=3, id=261, version=27031,

count=26, id=259, version=30795,

count=205, id=261, version=30795,

count=2, id=264, version=27051,

count=1, productName=Unmarked objects (old),

count=12, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=7, id=261, version=27032,

count=25, id=259, version=26706,

count=1, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,

count=2, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=138, id=261, version=26706,

count=38, id=260, version=26706,

count=30, id=260, version=30795,

count=2, id=262, version=30795,

count=41, id=257, version=30795,

count=475, id=1, productName=Unmarked objects,

count=123, id=261, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,