2026-08-08_ca576df7cb2ee414612d96ace3294dfa_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_ca576df7cb2ee414612d96ace3294dfa_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader
Size 2.8MB
Sample260808-c779pabc58
SHA256 853bfda00e05cfdb6ba886df365a924f060a84d2233ca08ac83f368468cea12c
MD5 ca576df7cb2ee414612d96ace3294dfa
SHA1 c55504e2d7dd58726d8a8c3392b8824eba78429f
SHA512 6a68991cdcd4151bd8d4994d18bd24b68f727a54558741e640a538a5460e475d079c3b271b24e9b0022c5b50eb782c70d689c932901f3ffe28959c31a1c9e874
SSDEEP 49152:28VNdlvh5pdZFVc2fOLZmEmFJQAImMXFEZ4GI19O55+v5VfDLo8tu2:3lv5bDc+Eh9O55+xVfDb
TLSH
T16BD5BF12BA41C031D6B241B2462CFB72ABADD5291F7280D3B3D45EBD25A05D2673EB1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-08_ca576df7cb2ee414612d96ace3294dfa_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader

.exe 2.8MB

2026-08-08_ca576df7cb2ee414612d96ace3294dfa_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader

IMPHASH 55bd293de64c7b1b0675559a58d44f91
SHA256 853bfda00e05cfdb6ba886df365a924f060a84d2233ca08ac83f368468cea12c
MD5 ca576df7cb2ee414612d96ace3294dfa
SHA1 c55504e2d7dd58726d8a8c3392b8824eba78429f
SHA512 6a68991cdcd4151bd8d4994d18bd24b68f727a54558741e640a538a5460e475d079c3b271b24e9b0022c5b50eb782c70d689c932901f3ffe28959c31a1c9e874
SSDEEP 49152:28VNdlvh5pdZFVc2fOLZmEmFJQAImMXFEZ4GI19O55+v5VfDLo8tu2:3lv5bDc+Eh9O55+xVfDb
TLSH
T16BD5BF12BA41C031D6B241B2462CFB72ABADD5291F7280D3B3D45EBD25A05D2673EB1F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

eb:58:bb:a6:39:39:f4:ba:fe:47:0c:e4:c4:93:57:40:7b:f0:d3:49:63:e7:e2:8f:cf:ee:aa:e0:a3:79:c1:af

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Chains

Jul 9, 2026

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Serial Number

24:bb:11:9c:e7:e7:1d:59:89:e0:c6:f6

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 21, 2025 - Oct 9, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1686832

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Webhost\10-07-2026\WindowsBuilds\UEMS_AGENT_FRAMEWORK\13942691\uems_agent_fw\Native_Src\native\ONPR_x86\UEMS_Agent_TSToolUtil.pdb

wsock32

WSAGetLastError bind inet_ntoa getsockopt connect socket ioctlsocket WSAStartup select closesocket WSACleanup gethostbyname inet_addr htons

winhttp

WinHttpAddRequestHeaders WinHttpQueryDataAvailable WinHttpWriteData WinHttpQueryHeaders WinHttpReadData WinHttpSendRequest WinHttpCrackUrl WinHttpQueryOption WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpSetCredentials WinHttpOpen WinHttpReceiveResponse WinHttpConnect WinHttpSetStatusCallback

iphlpapi

IcmpCloseHandle IcmpCreateFile GetAdaptersInfo IcmpSendEcho SendARP GetIfEntry2 GetIfTable2 FreeMibTable

advapi32

RegOpenCurrentUser RegEnumKeyW CryptDeriveKey CryptEncrypt CryptCreateHash CryptHashData RegOpenKeyExA ConvertSidToStringSidW LookupAccountNameW GetLengthSid FreeSid StartServiceW QueryServiceConfigW CreateServiceA ChangeServiceConfig2A ChangeServiceConfigW RegCopyTreeW RegRenameKey RegQueryValueExA RegCloseKey RegQueryInfoKeyW RegEnumKeyExW RegDeleteKeyExW CryptDestroyHash DeleteService RegEnumKeyExA RegEnumValueA RegQueryInfoKeyA RegSetValueExA CryptAcquireContextA CryptReleaseContext CryptGenKey CryptDestroyKey CryptGetUserKey CloseServiceHandle ControlService OpenSCManagerA OpenServiceA QueryServiceStatusEx StartServiceA CryptGetHashParam CreateProcessAsUserW OpenProcessToken CreateProcessAsUserA GetTokenInformation ImpersonateLoggedOnUser RevertToSelf LookupAccountSidA LookupAccountSidW LookupPrivilegeValueA LookupPrivilegeNameA LogonUserA RegEnumValueW AbortSystemShutdownA InitiateSystemShutdownW LookupAccountNameA IsValidSid GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority RegCreateKeyExA RegCreateKeyExW RegDeleteKeyA RegDeleteValueA RegDeleteValueW RegEnumKeyA RegOpenKeyA RegOpenKeyExW RegQueryValueExW RegSetValueExW QueryServiceStatus OpenServiceW AdjustTokenPrivileges OpenSCManagerW

shlwapi

PathRenameExtensionA PathFileExistsA SHDeleteKeyA StrTrimA StrStrA StrStrIA StrTrimW PathFileExistsW PathFindExtensionA SHDeleteKeyW

wtsapi32

WTSEnumerateSessionsW WTSQuerySessionInformationW WTSEnumerateSessionsA WTSQuerySessionInformationA WTSFreeMemory

userenv

LoadUserProfileA CreateEnvironmentBlock UnloadUserProfile DestroyEnvironmentBlock

crypt32

CertFindCertificateInStore CertCreateCertificateContext CertFreeCertificateContext CertAddCertificateContextToStore CertDeleteCertificateFromStore CertVerifyTimeValidity CertNameToStrW CertGetNameStringA CryptStringToBinaryA PFXImportCertStore PFXVerifyPassword CertCloseStore CertOpenStore CertEnumCertificatesInStore CryptMsgClose CryptMsgGetParam CertGetNameStringW CryptQueryObject CertAddStoreToCollection CertCreateCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CryptEncodeObjectEx CryptDecodeObject CryptMsgOpenToDecode CryptMsgUpdate CryptGetMessageCertificates CertFreeCertificateChainEngine CryptVerifyMessageSignature CryptVerifyDetachedMessageSignature

psapi

GetModuleFileNameExA

secur32

GetUserNameExA GetUserNameExW

dcagentlibxml2

xmlTextReaderGetAttribute xmlFreeDoc xmlFree xmlParseMemory xmlNodeListGetString xmlNewTextReaderFilename xmlFreeTextReader xmlTextReaderRead xmlTextReaderAttributeCount xmlTextReaderDepth xmlTextReaderName xmlTextReaderValue xmlCtxtUseOptions xmlDocGetRootElement xmlCleanupParser xmlParseFile xmlNewParserCtxt xmlFreeParserCtxt xmlStrcmp

netapi32

NetWkstaUserGetInfo DsGetDcNameA DsGetDcNameW NetWkstaGetInfo NetApiBufferFree NetGetJoinInformation NetServerGetInfo

mpr

WNetCancelConnection2W WNetAddConnection2W WNetCancelConnection2A

wintrust

WinVerifyTrust

imagehlp

ImageGetCertificateData ImageGetCertificateHeader

ws2_32

getnameinfo getaddrinfo inet_pton freeaddrinfo

kernel32

TlsSetValue SetUnhandledExceptionFilter UnhandledExceptionFilter TlsFree IsProcessorFeaturePresent GetDriveTypeW GetFileType PeekNamedPipe GetConsoleMode SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive RaiseException OutputDebugStringW IsDebuggerPresent CloseThreadpoolWait SetThreadpoolWait ReadConsoleW ExitThread FreeLibraryAndExitThread GetModuleHandleExW CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer FreeLibraryWhenCallbackReturns GetTickCount64 GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW InitOnceExecuteOnce GetStartupInfoW InitializeSListHead DuplicateHandle ExitProcess GetStdHandle GetCommandLineA GetCPInfo CompareStringEx GetCommandLineW GetCurrentThread GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW LCMapStringEx GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle EncodePointer LeaveCriticalSection EnterCriticalSection CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW MoveFileExW CreateDirectoryExW DeviceIoControl AreFileApisANSI GetTempPathW SetFileTime SetFilePointerEx GetConsoleOutputCP SetEndOfFile CreatePipe RtlUnwind SetConsoleCtrlHandler IsValidCodePage InterlockedPushEntrySList GetACP SetFileInformationByHandle SetFileAttributesW TlsAlloc GetFullPathNameW GetFinalPathNameByHandleW GetFileAttributesExW GetDiskFreeSpaceExW FindFirstFileExW GetLocaleInfoEx InterlockedFlushSList GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW GetModuleFileNameW TlsGetValue GetTickCount MoveFileW lstrcmpiA GetVersion LocalAlloc GetModuleHandleW ResumeThread SuspendThread QueryPerformanceFrequency SizeofResource HeapFree WriteFile TerminateProcess InitializeCriticalSectionEx WaitForSingleObject CreateFileW HeapSize MultiByteToWideChar Sleep GetLastError LockResource HeapReAlloc CloseHandle FindResourceExW LoadResource FindResourceW HeapAlloc DecodePointer HeapDestroy LocalFree DeleteCriticalSection GetProcessHeap WideCharToMultiByte CreateProcessA FormatMessageA FlushFileBuffers GetExitCodeProcess CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetFileSize ReadFile RemoveDirectoryA SetEvent ReleaseMutex CreateMutexA OpenEventW GetCurrentProcess OpenProcess WriteConsoleW GetComputerNameExW GetVersionExA FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA SetDllDirectoryA SystemTimeToFileTime CreateToolhelp32Snapshot Process32First Process32Next FindFirstFileW SetCurrentDirectoryA SetCurrentDirectoryW GetCurrentDirectoryA SetFilePointer GetCurrentProcessId ProcessIdToSessionId GetSystemFirmwareTable LoadLibraryW GlobalAlloc GlobalFree GetFileAttributesExA GetFullPathNameA ExpandEnvironmentStringsA GetCurrentDirectoryW DeleteFileW FileTimeToLocalFileTime FindNextFileW GetFileAttributesA GetFileAttributesW GetFileInformationByHandle SetLastError ConnectNamedPipe GetProcessTimes CreateProcessW GetSystemDirectoryA GetSystemDirectoryW Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetModuleFileNameA lstrlenA CopyFileA CreateNamedPipeA SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetCurrentThreadId GetLocalTime GetEnvironmentVariableA CreateDirectoryA CreateDirectoryW CopyFileW GetFileSizeEx InitializeCriticalSectionAndSpinCount CreateTimerQueue CreateTimerQueueTimer DeleteTimerQueue GetEnvironmentVariableW LoadLibraryExW SetDllDirectoryW GetNativeSystemInfo OpenMutexW CreateThread SetPriorityClass GetPriorityClass GetSystemInfo GetSystemTime QueryDosDeviceA MoveFileA GetTimeZoneInformation GetLocaleInfoA K32GetProcessMemoryInfo GetSystemTimeAsFileTime DisconnectNamedPipe lstrcmpW FormatMessageW CompareFileTime LoadLibraryExA QueryPerformanceCounter

user32

MessageBoxW UnregisterClassW wsprintfA GetLastInputInfo UnregisterClassA wsprintfW

shell32

SHGetSpecialFolderPathA SHCreateDirectoryExW SHGetFolderPathA SHCreateDirectoryExA SHFileOperationA

ole32

CoInitializeEx CoInitialize CoSetProxyBlanket CoCreateInstance CoUninitialize CoCreateGuid CoInitializeSecurity StringFromGUID2 OleRun

oleaut32

SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData VariantClear VariantInit SystemTimeToVariantTime VariantTimeToSystemTime VariantChangeType GetErrorInfo SetErrorInfo CreateErrorInfo SysAllocStringByteLen SysStringLen SysFreeString SysAllocString

odbc32

ord43 ord72 ord41 ord39 ord20 ord49 ord19 ord48 ord18 ord36 ord9 ord16 ord31 ord13 ord12 ord11 ord29 ord8 ord26 ord4 ord3 ord2 ord1

gdiplus

GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipLoadImageFromFile GdipLoadImageFromFileICM GdipCloneImage GdipGetImageEncoders GdipDisposeImage GdipGetImageEncodersSize GdipSaveImageToFile

msi

ord224

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_ca576df7cb2ee414612d96ace3294dfa_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader

wsock32

winhttp

iphlpapi

advapi32

shlwapi

wtsapi32

userenv

crypt32

psapi

secur32

dcagentlibxml2

netapi32

mpr

wintrust

imagehlp

ws2_32

kernel32

user32

shell32

ole32

oleaut32

odbc32

gdiplus

msi

generic