2026-08-03_fe582287b05e28654f06de30cb5169dc_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_fe582287b05e28654f06de30cb5169dc_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader
Size 1.3MB
Sample260804-kpcn3abm7x
SHA256 cefc8ebb216a2681afc82109a6a92a2c2b9db48a227af8b32ddcf37ae420cae3
MD5 fe582287b05e28654f06de30cb5169dc
SHA1 514488bc9aadba7b120d0f0657bfd8ae6310afc7
SHA512 2b63009bc80ce563d3a3a3e2c29252e7e48c7fc920da42e76c5bd373d83704b514c9e7878f7de4fbe78739eb4d933a72f3b0441df823df5da30435d1a857ab96
SSDEEP 24576:Hw//LhT0U+G0rziLcsKEK96xh6ok0WmTXwT9eTK0B:Q1T03zA4Ah610/TAT9eW4
TLSH
T15755AE21B552C172D9F1417099FDEFAB943EA9344B7904C7A3C44F2D5B212C26F3AA2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-03_fe582287b05e28654f06de30cb5169dc_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader

.exe 1.3MB

2026-08-03_fe582287b05e28654f06de30cb5169dc_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader

IMPHASH 5d3248092f4864635a2e527e5aaa002e
SHA256 cefc8ebb216a2681afc82109a6a92a2c2b9db48a227af8b32ddcf37ae420cae3
MD5 fe582287b05e28654f06de30cb5169dc
SHA1 514488bc9aadba7b120d0f0657bfd8ae6310afc7
SHA512 2b63009bc80ce563d3a3a3e2c29252e7e48c7fc920da42e76c5bd373d83704b514c9e7878f7de4fbe78739eb4d933a72f3b0441df823df5da30435d1a857ab96
SSDEEP 24576:Hw//LhT0U+G0rziLcsKEK96xh6ok0WmTXwT9eTK0B:Q1T03zA4Ah610/TAT9eW4
TLSH
T15755AE21B552C172D9F1417099FDEFAB943EA9344B7904C7A3C44F2D5B212C26F3AA2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

8a:0b:8d:62:72:e5:32:a1:63:6d:d2:3a:83:92:12:f7:7d:82:02:44:42:ff:ee:2f:d3:ec:4d:51:ae:d1:15:a3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074245494a494e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 27, 2023

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

44:8a:bf:29:b0:45:82:3e:5d:6d:cc:0b

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 5, 2022 - Jan 6, 2024

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

684278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\740604\out\Release\Uninst.pdb

kernel32

GetLogicalDriveStringsW GetLongPathNameW RemoveDirectoryW SetEndOfFile SetFileAttributesW OpenProcess GlobalAlloc GlobalFree GetCurrentProcess OpenThread ResumeThread GetModuleHandleExW lstrcmpiW GetThreadLocale SetThreadLocale GetTempPathW GetVersionExW SystemTimeToFileTime GetExitCodeProcess CreateJobObjectW AssignProcessToJobObject QueryInformationJobObject GetCommandLineW CopyFileW GetDiskFreeSpaceExW FindNextFileW FindFirstFileW GetCurrentProcessId FindClose LocalFree GetModuleHandleA Process32NextW Process32FirstW CreateToolhelp32Snapshot MapViewOfFile DeleteCriticalSection GetCurrentThreadId lstrlenA LoadLibraryW UnmapViewOfFile CreateFileMappingW GetFileSize GetTimeZoneInformation GetPrivateProfileStringW GetPrivateProfileIntW FindResourceW WriteConsoleW SetStdHandle DeleteFileW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetConsoleOutputCP FlushFileBuffers ReadConsoleW GetConsoleMode SizeofResource EnumSystemLocalesW IsValidLocale LCMapStringW CompareStringW GetFileType GetStdHandle ExitProcess FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind InitializeCriticalSection GetUserDefaultLCID CreateFileW GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetTimeFormatW GetDateFormatW LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo TerminateProcess Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection DeviceIoControl HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError GetLastError RaiseException CloseHandle SetFilePointerEx lstrcmpA SetEnvironmentVariableW IsDebuggerPresent GetStringTypeW TryEnterCriticalSection GetCPInfo LCMapStringEx QueryPerformanceCounter QueryPerformanceFrequency lstrcmpiA InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW FormatMessageW GetACP MulDiv GlobalSize LocalFileTimeToFileTime CreateFileA HeapLock HeapUnlock HeapWalk ReleaseMutex LockResource LoadResource FindResourceExW GetProcessHeap HeapSize HeapDestroy OutputDebugStringW WriteFile SetFilePointer ReadFile GetFileSizeEx ExpandEnvironmentStringsW GetModuleFileNameW CreateProcessW TlsAlloc TlsGetValue GetFileAttributesW GetCurrentDirectoryW VerSetConditionMask VerifyVersionInfoW GlobalUnlock GlobalLock TlsFree TlsSetValue

user32

FindWindowW PostMessageW DefWindowProcW RegisterClassExW CreateWindowExW IsWindow DestroyWindow ShowWindow GetWindowLongW SetWindowLongW CharLowerW GetSystemMetrics IntersectRect OffsetRect EqualRect PtInRect GetMonitorInfoW EnumDisplayMonitors AttachThreadInput IsIconic BringWindowToTop SetActiveWindow GetForegroundWindow SetForegroundWindow GetDesktopWindow DrawTextW SetClipboardData EmptyClipboard CloseClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard GetAsyncKeyState GetSysColor ClientToScreen SetCursor UnionRect MonitorFromPoint IsZoomed GetCursorPos GetKeyState ScreenToClient SendMessageTimeoutW UpdateLayeredWindow IsRectEmpty GetUpdateRect MoveWindow EndPaint BeginPaint InvalidateRect ReleaseCapture SetCapture GetFocus GetDC CallWindowProcW RegisterClassW LoadCursorW ReleaseDC GetWindowThreadProcessId SetWindowPos IsWindowVisible CharNextW GetMessageW TranslateMessage DispatchMessageW PeekMessageW SendMessageW PostQuitMessage KillTimer GetClientRect GetWindowRect MapWindowPoints GetParent GetWindow LoadImageW MonitorFromWindow SetFocus EnableWindow SetWindowTextW SetWindowRgn

advapi32

RegCloseKey RegQueryInfoKeyW RegEnumKeyExW StartServiceW SetServiceObjectSecurity QueryServiceStatus QueryServiceObjectSecurity OpenServiceW ChangeServiceConfigW SetSecurityDescriptorDacl InitializeSecurityDescriptor OpenSCManagerW CloseServiceHandle RegSetValueExW RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegEnumKeyExA

shell32

SHGetFolderPathW ord165 SHGetSpecialFolderPathW CommandLineToArgvW ShellExecuteW SHFileOperationW

ole32

CoUninitialize CoInitializeEx CoCreateInstance CoTaskMemFree CoTaskMemAlloc CoInitialize CoTaskMemRealloc CreateStreamOnHGlobal OleInitialize OleUninitialize

oleaut32

VarUI4FromStr

shlwapi

PathIsPrefixW PathIsRootW SHDeleteKeyW SHSetValueW PathIsRelativeW PathFileExistsW StrStrIW PathFindFileNameW SHDeleteValueW PathRemoveFileSpecW SHGetValueW PathCanonicalizeW PathRemoveBackslashW SHGetValueA SHSetValueA PathAppendW PathCombineW

version

VerQueryValueW

psapi

GetModuleFileNameExW

comctl32

InitCommonControlsEx ord17 _TrackMouseEvent

crypt32

CryptBinaryToStringA

winmm

timeKillEvent timeSetEvent

gdiplus

GdipDrawImageRect GdipImageRotateFlip GdipLoadImageFromFile GdipGetPropertyItemSize GdipGetPropertyItem GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipRotateMatrix GdipCreatePath GdipDeletePath GdipAddPathPath GdipCreatePathGradientFromPath GdipDeleteBrush GdipCloneBrush GdipSetPathGradientPresetBlend GdipSetPathGradientWrapMode GdipGetWorldTransform GdipTranslateWorldTransform GdipCreateRegionPath GdipDeleteRegion GdipTranslateMatrix GdipDeleteMatrix GdipCreateMatrix GdipCreatePen2 GdipSetLineBlend GdipCreateLineBrushFromRect GdipDrawArc GdipImageSelectActiveFrame GdipDisposeImage GdipCloneImage GdipAlloc GdipSetWorldTransform GdipFree GdipCreateBitmapFromStream GdipSetPathGradientFocusScales GdipFillRegion GdipBitmapLockBits GdiplusStartup GdiplusShutdown GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipGetImageWidth GdipGetImageHeight GdipSetPixelOffsetMode GdipBitmapUnlockBits GdipCreateBitmapFromScan0 GdipMeasureString GdipFillEllipse GdipDrawEllipse GdipDrawString GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipSetStringFormatTrimming GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipCloneStringFormat GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawPath GdipDrawRectangleI GdipDrawLineI GdipCreateLineBrushFromRectI GdipFillPath GdipCreateSolidFill GdipDrawImageRectRectI GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipCreatePen1 GdipClosePathFigure GdipAddPathArc GdipAddPathLine GdipAddPathEllipse GdipAddPathRectangle GdipRotateWorldTransform GdipDeletePen

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext

msimg32

AlphaBlend

wininet

HttpQueryInfoW HttpSendRequestW HttpOpenRequestW InternetSetOptionW InternetConnectW InternetCloseHandle InternetOpenW InternetCrackUrlW

gdi32

DeleteDC BitBlt CreateRoundRectRgn DeleteObject GetObjectW GetStockObject CreateFontIndirectW GetDeviceCaps GetWindowOrgEx CreateRectRgnIndirect SaveDC ExtSelectClipRgn RestoreDC CreateDIBSection CreateCompatibleDC SelectObject SetWindowOrgEx SetStretchBltMode StretchBlt SetTextColor SetBkColor SetBkMode GetObjectA

generic

count=36, id=259, version=29395,

count=200, id=261, version=29395,

count=1, productName=Unmarked objects (old),

count=6, id=261, version=27034,

count=4, id=261, version=27024,

count=3, id=253, version=28518,

count=19, id=260, version=30034,

count=25, id=259, version=30034,

count=1, id=263, version=29395,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=12, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=2, id=253, version=23601,

count=93, id=261, version=30034,

count=34, id=260, version=29395,

count=2, id=262, version=29395,

count=47, id=257, version=29395,

count=640, id=1, productName=Unmarked objects,

count=43, id=264, version=30147,

count=1, id=261, version=28106,

count=1, id=260, version=30147,

count=36, id=261, version=30147,

count=1, id=255, version=30147,

count=1, id=151,

count=1, id=258, version=30147,