2026-08-08_9c978c428135ac8a0b6fefcc8e6bd85a_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_9c978c428135ac8a0b6fefcc8e6bd85a_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat
Size 3.8MB
Sample260808-dkakksgn3t
SHA256 478ff6e3660558108b23cc3242b2e2054ccd00307934661e9a302263c0558010
MD5 9c978c428135ac8a0b6fefcc8e6bd85a
SHA1 695279fb01843385bc828ce8f06c20ef1f05ad83
SHA512 a9223d05466a6891047137e9794fa9f90e9a339f5fda4da417c9114c4a6157f2eb490b0d6d2c2d843c8f8623d04c61ede3ec904d3227d6beb61ca4150a47d1d1
SSDEEP 49152:zJaEqq3s/WkCmQZCiUu05ZthlY4C1PlA3S93Z14gvDEqez7bGp9pn4i04+kaX9Hp:z58/WkZ0Aa/9pnmX3
TLSH
T1A406BF03B5038074E6A140B3562EFFB1A5AEC915576194E3F2CCBD6970F52D2263BB2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-08_9c978c428135ac8a0b6fefcc8e6bd85a_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

.exe 3.8MB

2026-08-08_9c978c428135ac8a0b6fefcc8e6bd85a_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

IMPHASH c26ac76c5a6504b2a2835b193f7ab40b
SHA256 478ff6e3660558108b23cc3242b2e2054ccd00307934661e9a302263c0558010
MD5 9c978c428135ac8a0b6fefcc8e6bd85a
SHA1 695279fb01843385bc828ce8f06c20ef1f05ad83
SHA512 a9223d05466a6891047137e9794fa9f90e9a339f5fda4da417c9114c4a6157f2eb490b0d6d2c2d843c8f8623d04c61ede3ec904d3227d6beb61ca4150a47d1d1
SSDEEP 49152:zJaEqq3s/WkCmQZCiUu05ZthlY4C1PlA3S93Z14gvDEqez7bGp9pn4i04+kaX9Hp:z58/WkZ0Aa/9pnmX3
TLSH
T1A406BF03B5038074E6A140B3562EFFB1A5AEC915576194E3F2CCBD6970F52D2263BB2E
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

bb:81:b0:20:85:4a:82:b1:56:07:c0:70:24:e1:80:d1:5b:78:45:1a:22:ce:63:0d:1f:3d:05:6a:8a:07:9e:fb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Chains

Jul 9, 2026

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Serial Number

24:bb:11:9c:e7:e7:1d:59:89:e0:c6:f6

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 21, 2025 - Oct 9, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2319088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Webhost\10-07-2026\WindowsBuilds\UEMS_CONFIGURATIONS\13942762\uems_config\Native_Src\native\ONPR_Win32\selfserviceexe.pdb

advapi32

RegDeleteValueA RegOpenKeyExA LookupAccountSidA RevertToSelf ConvertSidToStringSidA RegQueryValueExA IsValidSid ImpersonateLoggedOnUser RegCloseKey StartServiceW QueryServiceConfigW ChangeServiceConfigW OpenServiceW ChangeServiceConfigA ChangeServiceConfig2A CloseServiceHandle ControlService EnumDependentServicesA OpenSCManagerA OpenServiceA QueryServiceConfigA QueryServiceStatus StartServiceA OpenSCManagerW RegUnLoadKeyW RegLoadKeyA RegEnumKeyExA GetUserNameA RegCreateKeyExA RegEnumKeyExW ConvertSidToStringSidW GetLengthSid RegOpenKeyA RegEnumValueA RegEnumKeyA LogonUserA RegSetValueExW RegDeleteKeyW RegOpenKeyExW RegQueryInfoKeyA RegQueryValueExW LogonUserW CreateProcessAsUserW ReportEventA OpenProcessToken RegisterEventSourceA DeregisterEventSource AbortSystemShutdownA InitiateSystemShutdownW GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority AdjustTokenPrivileges LookupPrivilegeNameA LookupPrivilegeValueA LookupAccountSidW RegDeleteKeyA CryptGetHashParam CryptGetUserKey CryptGenKey RegDeleteValueW GetTokenInformation CryptDestroyHash CryptHashData CryptCreateHash CryptDestroyKey CryptReleaseContext CryptAcquireContextA RegSetValueExA RegEnumKeyW RegOpenCurrentUser CreateProcessAsUserA FreeSid LookupAccountNameW QueryServiceStatusEx

shlwapi

PathRemoveExtensionA PathIsDirectoryEmptyA PathFileExistsA StrStrA StrStrIW PathFindFileNameA PathIsNetworkPathW PathIsDirectoryW StrStrW StrTrimA PathFileExistsW PathFindExtensionA SHDeleteKeyA PathIsRelativeA PathIsDirectoryA StrStrIA

userenv

UnloadUserProfile GetUserProfileDirectoryA CreateEnvironmentBlock LoadUserProfileA ExpandEnvironmentStringsForUserW DestroyEnvironmentBlock

wtsapi32

WTSEnumerateSessionsA WTSFreeMemory WTSQueryUserToken WTSQuerySessionInformationA WTSQuerySessionInformationW

mpr

WNetCancelConnection2A WNetCancelConnection2W WNetAddConnection2W

netapi32

DsGetDcNameW NetWkstaUserGetInfo NetApiBufferFree NetGetJoinInformation DsGetDcNameA NetServerGetInfo

wsock32

WSAGetLastError inet_addr WSAStartup WSACleanup ioctlsocket gethostbyname

crypt32

CryptGetMessageCertificates CryptMsgUpdate CryptMsgOpenToDecode CryptEncodeObjectEx PFXVerifyPassword PFXImportCertStore CertGetNameStringA CertNameToStrW CertVerifyTimeValidity CertDeleteCertificateFromStore CertEnumCertificatesInStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertAddStoreToCollection CertAddCertificateContextToStore CertOpenStore CryptStringToBinaryA CertCreateCertificateContext CertFindCertificateInStore CertFreeCertificateContext CertNameToStrA CryptQueryObject CertGetNameStringW CertCloseStore CryptMsgGetParam CryptMsgClose

winhttp

WinHttpConnect WinHttpReadData WinHttpCrackUrl WinHttpWriteData WinHttpSetCredentials WinHttpQueryDataAvailable WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpOpen WinHttpSetStatusCallback WinHttpQueryOption WinHttpCloseHandle

iphlpapi

SendARP GetAdaptersInfo

imagehlp

ImageGetCertificateHeader ImageGetCertificateData

psapi

GetModuleFileNameExA

dcagentlibxml2

xmlCleanupParser xmlDocGetRootElement xmlFreeDoc xmlTextReaderDepth xmlTextReaderValue xmlTextReaderGetAttribute xmlFree xmlNodeListGetString xmlParseMemory xmlTextReaderRead xmlParseFile xmlStrcmp xmlTextReaderAttributeCount xmlFreeTextReader xmlTextReaderName xmlNewTextReaderFilename

secur32

GetUserNameExA

ws2_32

inet_pton getnameinfo

wintrust

WinVerifyTrust

msi

ord141 ord169 ord175 ord246 ord244 ord224 ord78 ord150 ord178 ord238

version

VerQueryValueW GetFileVersionInfoA GetFileVersionInfoSizeA GetFileVersionInfoW VerQueryValueA GetFileVersionInfoSizeW

activeds

ord9 ord13 ord3

kernel32

GetFullPathNameW TlsSetValue TlsFree GetFileAttributesExW AreFileApisANSI LoadLibraryExW GetDriveTypeW GetFileType MoveFileExW PeekNamedPipe FindFirstFileExW GetLocaleInfoEx LCMapStringEx CompareStringEx GetCPInfo ExitProcess TlsAlloc VirtualQuery GetModuleHandleExW InterlockedPushEntrySList GetStringTypeW GetFileInformationByHandleEx TlsGetValue VirtualFree ReleaseSRWLockExclusive AcquireSRWLockExclusive ReadConsoleW GetCommandLineA GetCommandLineW SetFilePointerEx GetConsoleOutputCP GetDateFormatW GetThreadTimes GetTimeFormatW GetCurrentThread CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetEndOfFile IsValidCodePage LeaveCriticalSection EnterCriticalSection RtlUnwind RaiseException OutputDebugStringW InitializeCriticalSection GetStartupInfoW IsDebuggerPresent SetUnhandledExceptionFilter lstrcmpW LoadLibraryExA SetErrorMode UnmapViewOfFile MapViewOfFile OpenFileMappingW TryAcquireSRWLockExclusive QueryPerformanceFrequency GetModuleFileNameW QueryPerformanceCounter UnhandledExceptionFilter IsProcessorFeaturePresent EncodePointer DeleteTimerQueue WakeAllConditionVariable SleepConditionVariableSRW CreateTimerQueueTimer CreateTimerQueue GetConsoleMode InitializeSListHead Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection SetLastError GetACP GetFileInformationByHandle GetSystemTimeAsFileTime GetSystemFirmwareTable SetDllDirectoryA FlushFileBuffers GetLocaleInfoA GetFileAttributesA FormatMessageW GlobalFree GetComputerNameExW GetLocalTime GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW DecodePointer GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection TerminateProcess FindResourceExW LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar WideCharToMultiByte DeleteFileA FindClose FindFirstFileA FindNextFileA GetFileAttributesExA RemoveDirectoryA Sleep GetSystemTime GetVersion GetSystemWindowsDirectoryA GetNativeSystemInfo FreeLibrary GetProcAddress LoadLibraryA SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetTimeZoneInformation GetEnvironmentVariableA GetVersionExA lstrcmpiA CreateDirectoryW CreateFileW DeleteFileW FindFirstFileW FindNextFileW GetFileAttributesW GetFileTime RemoveDirectoryW SetFileAttributesW CopyFileW MoveFileW ReadFile WriteFile CloseHandle ConnectNamedPipe DisconnectNamedPipe CreateThread LocalAlloc CreateNamedPipeA InitializeCriticalSectionAndSpinCount GetTickCount GlobalAlloc LocalFree FormatMessageA CreateFileA GetModuleHandleA GetFirmwareEnvironmentVariableA WTSGetActiveConsoleSessionId ReleaseMutex WaitForSingleObject CreateMutexA GetCurrentProcessId GetExitCodeProcess OpenProcess SetCurrentDirectoryA CreateProcessA HeapValidate GetSystemDirectoryA GetWindowsDirectoryA CopyFileA CreateToolhelp32Snapshot Process32First Process32Next CreateDirectoryA GetSystemDirectoryW MoveFileA SetCurrentDirectoryW GetCurrentDirectoryW DuplicateHandle CreateMutexW GetCurrentProcess GetCurrentThreadId GetModuleFileNameA GetModuleHandleW LoadLibraryW CompareFileTime GetDiskFreeSpaceExW SetFilePointer CreateProcessW SystemTimeToFileTime Process32FirstW Process32NextW GetSystemWindowsDirectoryW GetFileSizeEx lstrlenA GetDiskFreeSpaceExA GetFileSize GetSystemInfo GetStdHandle SetStdHandle GetCurrentDirectoryA CreatePipe ProcessIdToSessionId WriteConsoleW

user32

CharLowerW wsprintfW MessageBoxA GetSystemMetrics wsprintfA

shell32

SHCreateDirectoryExW SHFileOperationA SHGetSpecialFolderLocation SHCreateDirectoryExA SHGetFolderPathA SHGetMalloc SHGetPathFromIDListA

ole32

CoSetProxyBlanket CoUninitialize StringFromGUID2 CoInitialize CoInitializeEx CoCreateInstance CoInitializeSecurity

oleaut32

SafeArrayAccessData SafeArrayGetLBound SafeArrayGetUBound SysAllocStringByteLen SysStringLen VariantInit VariantClear SysFreeString SysAllocString

odbc32

ord18 ord39 ord43 ord16 ord31 ord13 ord12 ord11 ord48 ord9 ord8 ord19 ord41 ord26 ord4 ord3 ord2 ord1 ord72 ord49 ord29 ord20 ord36

cryptnet

CryptGetObjectUrl

wevtapi

EvtRender EvtQuery EvtClose EvtNext

gdiplus

GdipCloneImage GdipLoadImageFromFile GdiplusShutdown GdipDisposeImage GdipFree GdipAlloc GdipGetImageEncoders GdipGetImageEncodersSize GdiplusStartup GdipSaveImageToFile

generic

count=241, id=261, version=28900,

count=13, id=253, version=33731,

count=28, id=259, version=33731,

count=22, id=260, version=33731,

count=20, id=260, version=34123,

count=3, id=261, version=35222,

count=7, id=261, version=33143,

count=2, id=257, version=35209,

count=38, id=260, version=33818,

count=13, id=260, version=33811,

count=4, id=261, version=33030,

count=32, id=260, version=28900,

count=25, id=259, version=28900,

count=4, id=262, version=28900,

count=103, id=261, version=33731,

count=599, id=1, productName=Unmarked objects,

count=57, id=257, version=28900,

count=117, id=261, version=33811,

count=1, id=255, version=33811,

count=1, id=151,

count=1, id=258, version=33811,