2026-08-02_3bc748c98815464a1bc667172a112a25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_3bc748c98815464a1bc667172a112a25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat
Size 4.2MB
Sample260802-ry481a1whs
SHA256 1c3cb8fd8b79acda144689b11ef84917ccda004270945bcca7a5ecccd6d62d0d
MD5 3bc748c98815464a1bc667172a112a25
SHA1 480a0b575626e4dcd485be583affb010fd87c28e
SHA512 81bf20346e95606b3a89111489736d64c7c86da2336105edcf34680417fa5bb7c3c9925d29945f102ec7ca96177b486bdc5eb2e218c07e9520a6223973b0c5e3
SSDEEP 98304:L8OMeY5tYYszAVALvpeGurBtXwZwn61D527BWG:LjMeUtYYszAVALvcCVQBWG
TLSH
T1C5268E603686C135D672117A4EBDBFBB8C1DA8251BB051CB92C58F6E29211D32F36F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_3bc748c98815464a1bc667172a112a25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

File Explorer

2026-08-02_3bc748c98815464a1bc667172a112a25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

.exe 4.2MB

2026-08-02_3bc748c98815464a1bc667172a112a25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

IMPHASH 8976d8d03da8a522c6b40328f9ee2d0f
SHA256 1c3cb8fd8b79acda144689b11ef84917ccda004270945bcca7a5ecccd6d62d0d
MD5 3bc748c98815464a1bc667172a112a25
SHA1 480a0b575626e4dcd485be583affb010fd87c28e
SHA512 81bf20346e95606b3a89111489736d64c7c86da2336105edcf34680417fa5bb7c3c9925d29945f102ec7ca96177b486bdc5eb2e218c07e9520a6223973b0c5e3
SSDEEP 98304:L8OMeY5tYYszAVALvpeGurBtXwZwn61D527BWG:LjMeUtYYszAVALvcCVQBWG
TLSH
T1C5268E603686C135D672117A4EBDBFBB8C1DA8251BB051CB92C58F6E29211D32F36F1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2040176

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\buildagent-cd_8818\p4\989747040\services\AMTSW\Release\UNS\Release\lms.pdb

kernel32

GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW MultiByteToWideChar GetFileSizeEx SetEnvironmentVariableW SetStdHandle FindFirstFileExW IsValidCodePage LocalAlloc LocalFree FormatMessageW GetOEMCP GetFullPathNameW FreeLibraryAndExitThread ExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW VirtualQuery VirtualProtect GetCommandLineA VirtualAlloc GetModuleHandleExW FreeEnvironmentStringsW RtlUnwind GetCurrentDirectoryW SetConsoleCtrlHandler GetConsoleMode ReadConsoleW GetConsoleOutputCP HeapSize HeapReAlloc LCMapStringW lstrcmpiW FindResourceW GetDateFormatW WriteConsoleW LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary GetCurrentThreadId GetCurrentThread GetTimeFormatW OutputDebugStringW GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo CompareStringEx GetLocaleInfoEx LCMapStringEx EncodePointer GetStringTypeW WaitForSingleObjectEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock GetFileInformationByHandle WaitForMultipleObjects WaitForMultipleObjectsEx QueryPerformanceFrequency SizeofResource CompareStringW GetTimeZoneInformation ExpandEnvironmentStringsW GetComputerNameExW WideCharToMultiByte CreateFileW GetFinalPathNameByHandleW LoadLibraryW CreateThread GetCurrentProcess CreateEventW lstrlenW WaitForSingleObject SetEvent DeleteCriticalSection IsWow64Process VerSetConditionMask OutputDebugStringA VerifyVersionInfoW GetSystemPowerStatus QueryPerformanceCounter GetComputerNameA GetSystemInfo GetACP GetCurrentProcessId InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection HeapAlloc HeapFree GetProcessHeap GetSystemDefaultLCID GetSystemTime SetFilePointer SetEndOfFile CreateFileA CancelIo ReadFile WriteFile DeviceIoControl GetOverlappedResult InitializeCriticalSectionAndSpinCount FlushFileBuffers GlobalFree GlobalAlloc SetLastError InitializeCriticalSection TryEnterCriticalSection SetThreadPriority ResumeThread GetLastError RaiseException CloseHandle DuplicateHandle TlsAlloc TlsGetValue TlsSetValue TlsFree RegisterWaitForSingleObject UnregisterWait GetModuleHandleA GetModuleFileNameA GetSystemDirectoryA LoadLibraryA TerminateProcess GetStdHandle DecodePointer GetCommandLineW SetDllDirectoryW Sleep ResetEvent ReleaseSemaphore ReleaseMutex CreateMutexW CreateEventA CreateSemaphoreW GetExitCodeThread SuspendThread GetThreadId GetSystemTimeAsFileTime FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetEnvironmentStringsW ExitProcess GetVersionExW LockFileEx SetFilePointerEx UnlockFileEx LoadLibraryExA

advapi32

RegCreateKeyW InitiateSystemShutdownExW LookupPrivilegeValueW AdjustTokenPrivileges SetEntriesInAclW RegSetKeySecurity RegDeleteKeyExW SetSecurityDescriptorDacl FreeSid AllocateAndInitializeSid ChangeServiceConfig2W CloseServiceHandle OpenProcessToken OpenThreadToken ControlService CreateServiceW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW CopySid GetLengthSid GetTokenInformation InitializeSecurityDescriptor IsValidSid SetSecurityDescriptorGroup SetSecurityDescriptorOwner RegCreateKeyExW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey ConvertSidToStringSidW LookupAccountSidW EqualSid CreateWellKnownSid StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW OpenServiceW OpenSCManagerW DeleteService ChangeServiceConfigW

user32

GetMessageW CharUpperW CharNextW PostThreadMessageW UnregisterDeviceNotification TranslateMessage LoadStringW DispatchMessageW RegisterDeviceNotificationW MessageBoxW

ole32

CoUninitialize CoCreateInstance StringFromGUID2 CoInitializeEx CoResumeClassObjects CoTaskMemFree CoAddRefServerProcess CoRegisterClassObject CoTaskMemAlloc PropVariantClear CoImpersonateClient CoRevertToSelf CoReleaseServerProcess CoRevokeClassObject CoTaskMemRealloc CoSetProxyBlanket CoInitializeSecurity

oleaut32

SysAllocStringByteLen SysStringByteLen VariantClear VariantChangeType VariantInit SysAllocString SysFreeString SysStringLen VarUI4FromStr LoadTypeLi RegisterTypeLi UnRegisterTypeLi VarBstrCat LoadRegTypeLi SafeArrayCreate SafeArrayGetUBound SafeArrayGetLBound SafeArrayLock SafeArrayUnlock SafeArrayPutElement SafeArrayCreateVector SysAllocStringLen

iphlpapi

IpRenewAddress GetInterfaceInfo GetPerAdapterInfo GetAdaptersInfo GetIpAddrTable CancelIPChangeNotify NotifyRouteChange CancelMibChangeNotify2 NotifyIpInterfaceChange GetAdaptersAddresses SetTcpEntry GetExtendedTcpTable

cfgmgr32

CM_Get_Device_Interface_ListA CM_Get_Device_Interface_List_SizeA

crypt32

CertCloseStore CryptMsgGetParam CryptMsgClose CertFreeCertificateContext CertGetNameStringW CryptQueryObject CertOpenStore CertGetNameStringA CertFindCertificateInStore

ws2_32

WSAAddressToStringA freeaddrinfo getaddrinfo WSAAccept WSAGetLastError getsockopt shutdown setsockopt send inet_addr recv ntohs listen htons getsockname getpeername ioctlsocket connect closesocket bind __WSAFDIsSet inet_ntoa htonl gethostbyaddr gethostbyname getservbyport WSASend getservbyname WSAStartup accept WSACloseEvent WSACleanup gethostname WSASetLastError ntohl WSACreateEvent getnameinfo WSAEventSelect WSAEnumNetworkEvents select socket

wintrust

WinVerifyTrust

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winhttp

WinHttpQueryAuthSchemes WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpOpen WinHttpSetCredentials WinHttpQueryHeaders WinHttpSendRequest WinHttpReceiveResponse

shell32

SHGetSpecialFolderPathW

api-ms-win-power-setting-l1-1-0

PowerReadDCValue PowerReadACValue

api-ms-win-power-base-l1-1-0

GetPwrCapabilities

powrprof

SetSuspendState

rpcrt4

UuidCreate UuidToStringA RpcStringFreeA

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

758KB

Virtual Size

757KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

173KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

828KB

Virtual Size

832KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=22, id=259, version=29395,

count=252, id=261, version=29395,

count=5, id=253, version=28518,

count=19, id=260, version=29804,

count=26, id=259, version=29804,

count=116, id=261, version=30152,

count=35, id=260, version=30152,

count=2, id=260, productName=VS2019 v16.8.4 build 29336, version=29336,

count=16, id=257, version=29395,

count=101, id=261, version=29804,

count=438, id=1, productName=Unmarked objects,

count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=31, id=260, version=29395,

count=385, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,

count=29, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,

count=1, id=256, productName=VS2019 v16.9.2 build 29913, version=29913,

count=1, id=255, productName=VS2019 v16.9.2 build 29913, version=29913,

count=2, id=151,

count=1, id=258, productName=VS2019 v16.9.2 build 29913, version=29913,