2026-08-06_61b60817ff6a6011b3118101af049c8f_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-06_61b60817ff6a6011b3118101af049c8f_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat
Size 1.8MB
Sample260807-a2562avanh
SHA256 937e029701405976c6fdb158d478b94ce95e9816cea2cb53e11b2e53d1bfd3b0
MD5 61b60817ff6a6011b3118101af049c8f
SHA1 0ac87657e97c80f597dae1cca7f9743e117c277d
SHA512 332626bb1086225f9f7d4f0a25dda1dbbd5055836fa3dc0ca09fb8cbf1de8d4e33c0f7824148d5cc42d205cfb7dc0d3f09d745fb89b97176d45bb5a6d4d58177
SSDEEP 49152:oDiVY8xUBF9kycyYtQoPWuLQ495Ib9q2W:qe2NNStQoP95II
TLSH
T15C95AE227A758137D65102B1AD3DBFAF956DFF3407A845C7A3C80E3E89205C36A3166B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-06_61b60817ff6a6011b3118101af049c8f_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

.exe 1.8MB

2026-08-06_61b60817ff6a6011b3118101af049c8f_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

IMPHASH e27fbabfa2ad3057d0bebdcc966c7332
SHA256 937e029701405976c6fdb158d478b94ce95e9816cea2cb53e11b2e53d1bfd3b0
MD5 61b60817ff6a6011b3118101af049c8f
SHA1 0ac87657e97c80f597dae1cca7f9743e117c277d
SHA512 332626bb1086225f9f7d4f0a25dda1dbbd5055836fa3dc0ca09fb8cbf1de8d4e33c0f7824148d5cc42d205cfb7dc0d3f09d745fb89b97176d45bb5a6d4d58177
SSDEEP 49152:oDiVY8xUBF9kycyYtQoPWuLQ495Ib9q2W:qe2NNStQoP95II
TLSH
T15C95AE227A758137D65102B1AD3DBFAF956DFF3407A845C7A3C80E3E89205C36A3166B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

f4:f4:27:fd:32:d7:17:8a:87:81:b7:b4:19:c9:63:3e:c8:c5:f6:2b:c7:31:a0:02:66:27:21:b4:e8:79:0d:29

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=成都星汉云科科技有限公司,O=成都星汉云科科技有限公司,L=成都市,ST=四川省,C=CN

Chains

Jul 23, 2026

CN=成都星汉云科科技有限公司,O=成都星汉云科科技有限公司,L=成都市,ST=四川省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=成都星汉云科科技有限公司,O=成都星汉云科科技有限公司,L=成都市,ST=四川省,C=CN

Serial Number

01:cd:71:67:23:ee:3c:14:c3:36:fe:fa:6f:5a:b8:cb

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 28, 2025 - Apr 26, 2028

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

742794

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ProgramData\Jenkins\.jenkins\workspace\MGame\general_user\alone_tray_server\Bin\x86\Release\AloneTrayServer.pdb

kernel32

lstrlenW GetStartupInfoW SetDllDirectoryW FindClose FindNextFileW GetCommandLineW FreeLibrary SetEvent MultiByteToWideChar CreateEventW WaitForMultipleObjects SetUnhandledExceptionFilter IsBadReadPtr GetModuleHandleW GetCurrentProcessId VirtualProtect MapViewOfFile CreateFileMappingW WideCharToMultiByte GetProcessHeap DeleteCriticalSection GetProcAddress HeapDestroy DecodePointer HeapAlloc FindResourceW LoadResource FindResourceExW LoadLibraryW RaiseException CloseHandle HeapReAlloc LockResource GetLastError Sleep HeapSize UnmapViewOfFile ReleaseMutex GetCurrentThreadId WaitForSingleObject InitializeCriticalSectionEx CreateMutexW InitializeCriticalSection LeaveCriticalSection WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetStdHandle GetTimeZoneInformation GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileType GetModuleHandleExW ExitThread GetFileAttributesExW RtlUnwind GetFileSizeEx lstrcmpA DeviceIoControl GetSystemWindowsDirectoryW CreateFileMappingA FindNextFileA FindFirstFileA CreateFileA LocalFree UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore GetVersionExW LoadLibraryExW GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue TerminateProcess UnhandledExceptionFilter GetModuleFileNameW GetCurrentProcess EnterCriticalSection SetLastError HeapFree lstrcpyW lstrcpynW WritePrivateProfileStringW SizeofResource EncodePointer TryEnterCriticalSection QueryPerformanceCounter QueryPerformanceFrequency FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread GetExitCodeThread GetStringTypeW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo CreateFileW MulDiv GetACP ExitProcess FreeResource GetFileSize ReadFile lstrcmpW DeleteFileW SetEndOfFile SetFilePointer WriteFile GetVersion GlobalAlloc GlobalUnlock GlobalLock GlobalFree GetTempFileNameW GetTempPathW ResumeThread ResetEvent GetLocalTime InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA IsDebuggerPresent OutputDebugStringW FlushFileBuffers

user32

GetMonitorInfoW SetWindowPos GetWindowRect PtInRect PostMessageW GetWindowLongW DefWindowProcW CallWindowProcW DestroyWindow CreateWindowExW UnregisterClassW RegisterClassExW IsWindow SetTimer ChangeWindowMessageFilter ChangeWindowMessageFilterEx GetMessageW TranslateMessage DispatchMessageW SendMessageW IsChild UpdateLayeredWindow IsWindowVisible IsZoomed CharNextW LoadCursorW GetFocus GetKeyState SetCapture ReleaseCapture GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect GetCursorPos CreateCaret GetCaretBlinkTime SetCaretPos ScreenToClient MapWindowPoints IntersectRect UnionRect IsRectEmpty GetParent GetClassNameW GetWindow MonitorFromWindow wvsprintfW SetCursor InflateRect OffsetRect wsprintfW RegisterClassW ShowWindow EnableWindow SetPropW GetPropW LoadImageW IsIconic SetWindowRgn MessageBoxW CharPrevW DrawTextW SetRect DestroyIcon DrawIconEx GetIconInfo GetMessagePos MoveWindow GetDlgCtrlID DrawFocusRect FillRect HideCaret ShowCaret ClientToScreen GetSysColor GetWindowDC SetWindowTextW GetWindowTextW GetWindowTextLengthW CreateAcceleratorTableW InvalidateRgn RemovePropW FindWindowExW IsWindowEnabled SetWindowLongW KillTimer PostQuitMessage GetClassInfoExW RegisterWindowMessageW SetFocus

advapi32

RegCloseKey RegCreateKeyW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegCreateKeyExW RegEnumKeyExW GetTokenInformation InitializeSecurityDescriptor OpenProcessToken AdjustTokenPrivileges SetSecurityDescriptorDacl LookupPrivilegeValueW

shell32

ShellExecuteExW SHGetSpecialFolderPathW ord165

ole32

CoSetProxyBlanket OleLockRunning CLSIDFromProgID CLSIDFromString CoInitializeSecurity CoCreateGuid CoUninitialize CoCreateInstance CreateStreamOnHGlobal CoInitialize CoInitializeEx

oleaut32

SysAllocStringLen SysStringLen SafeArrayPutElement VariantInit VariantClear SafeArrayCreate SysAllocString SysFreeString

imm32

ImmDisableIME

shlwapi

StrStrIW PathFileExistsW PathCombineW PathAppendW PathFindFileNameW SHAutoComplete PathRemoveFileSpecW StrCmpNIW StrTrimA StrStrIA StrCmpIW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

comctl32

ord17 _TrackMouseEvent ImageList_DrawEx ImageList_GetIconSize InitCommonControlsEx

msimg32

AlphaBlend GradientFill

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

gdiplus

GdipAlloc GdipFree GdipCreatePath GdipDeletePath GdipAddPathLineI GdipAddPathArcI GdipGetPropertyItem GdipGetPropertyItemSize GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipImageSelectActiveFrame GdipSetPenDashStyle GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipDrawLineI GdipDrawRectangleI GdipDrawPath GdipFillEllipseI GdipClosePathFigure GdipCreateTexture GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipImageGetFrameCount GdipCreateBitmapFromScan0 GdipCreateHBITMAPFromBitmap GdipCloneBitmapAreaI GdipBitmapLockBits GdipBitmapUnlockBits GdipSetInterpolationMode GdipGraphicsClear GdipFillPath GdipDrawImagePointsI GdipDrawImageRectRectI GdipGetImageEncodersSize GdipGetImageEncoders GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipLoadImageFromStreamICM GdipDrawImageRectI GdipGetImagePixelFormat GdipLoadImageFromFile GdipDrawEllipseI GdipAddPathArc

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

gdi32

SetBkColor SetBkMode StretchBlt ExtSelectClipRgn GetTextMetricsW SelectObject SaveDC RestoreDC Rectangle GetStockObject GetObjectW SetStretchBltMode SetTextColor CreateDIBSection SetDIBColorTable TextOutW DeleteDC CreatePen CreateFontIndirectW CreateCompatibleDC CreateCompatibleBitmap CreateDCW GetClipBox GetCharABCWidthsW CreateRectRgnIndirect CombineRgn GetTextColor BitBlt CreateSolidBrush GetDeviceCaps CreateRoundRectRgn DeleteObject SetWindowOrgEx SelectClipRgn GetTextExtentPoint32W GetDIBits SetDIBitsToDevice ExtTextOutW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_61b60817ff6a6011b3118101af049c8f_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

kernel32

user32

advapi32

shell32

ole32

oleaut32

imm32

shlwapi

version

comctl32

msimg32

urlmon

gdiplus

wininet

iphlpapi

gdi32

generic