2026-08-08_6b342850b17d2c63a06d6bdaea068de0_amadey_darkgate_elex_glassworm_luca-stealer_lynx_metamorfo_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_6b342850b17d2c63a06d6bdaea068de0_amadey_darkgate_elex_glassworm_luca-stealer_lynx_metamorfo_njrat
Size 2.6MB
Sample260808-dzatwsbe28
SHA256 6e13244c8770c4baefebab357c41596c79491ca5087872f670dd1e94f4ecfda8
MD5 6b342850b17d2c63a06d6bdaea068de0
SHA1 27a06d59d6b24577204b7623160ffbffca12b366
SHA512 5fc09f679435f71e2d0ec6fd17bc446aa86aea9a218a0ce6003a2b11964c3cccb7574814e6b26dc8a221acc23d2d5545f8aeac72df56680272ffd6b207c024e4
SSDEEP 49152:0QmtzPP/088TmHDNgEvHk4g0YXToP/DxvIyy4oN7bX+wK3o0vguKSzJ6i45P7XeH:QmPKlSSzJ6i4xuF
TLSH
T1B3C58D11E3928624F1B349B6597C477AA92CBE100B50DCD7E3C46C6E41F99C2A636E3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-08_6b342850b17d2c63a06d6bdaea068de0_amadey_darkgate_elex_glassworm_luca-stealer_lynx_metamorfo_njrat

.exe 2.6MB

2026-08-08_6b342850b17d2c63a06d6bdaea068de0_amadey_darkgate_elex_glassworm_luca-stealer_lynx_metamorfo_njrat

IMPHASH 580bdd812b0751f5c872b83baa4300a4
SHA256 6e13244c8770c4baefebab357c41596c79491ca5087872f670dd1e94f4ecfda8
MD5 6b342850b17d2c63a06d6bdaea068de0
SHA1 27a06d59d6b24577204b7623160ffbffca12b366
SHA512 5fc09f679435f71e2d0ec6fd17bc446aa86aea9a218a0ce6003a2b11964c3cccb7574814e6b26dc8a221acc23d2d5545f8aeac72df56680272ffd6b207c024e4
SSDEEP 49152:0QmtzPP/088TmHDNgEvHk4g0YXToP/DxvIyy4oN7bX+wK3o0vguKSzJ6i45P7XeH:QmPKlSSzJ6i4xuF
TLSH
T1B3C58D11E3928624F1B349B6597C477AA92CBE100B50DCD7E3C46C6E41F99C2A636E3F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

c8:14:df:02:b3:ca:f8:8b:d2:8d:fd:f3:cd:cc:3c:33:eb:c7:62:a6:17:bf:bd:a2:db:9a:d5:a6:e4:c3:e3:28

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Chains

Jul 9, 2026

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Serial Number

44:85:59:e8:d5:9f:e0:56:29:9e:6e:8f

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 11, 2023 - Oct 9, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1503888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Webhost\10-07-2026\WindowsBuilds\INVENTORY_MGMT\13942668\inv_mgmt\Native_Src\native\ONPR_Win32\dcinventory.pdb

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiBuildDriverInfoList SetupDiEnumDriverInfoW SetupDiGetDriverInfoDetailW SetupDiDestroyDriverInfoList SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDescriptionW CM_Get_DevNode_Status SetupDiClassGuidsFromNameW SetupDiGetClassDevsW SetupDiGetDeviceInstanceIdW

shlwapi

PathFindExtensionA StrTrimA SHDeleteKeyA StrStrIW PathFileExistsW PathFileExistsA PathIsDirectoryW StrStrIA

userenv

CreateEnvironmentBlock ExpandEnvironmentStringsForUserW LoadUserProfileA DestroyEnvironmentBlock UnloadUserProfile

crypt32

CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptStringToBinaryA CertOpenSystemStoreW CertGetNameStringW CertNameToStrW CertNameToStrA CertVerifyTimeValidity CertGetPublicKeyLength CertGetCertificateContextProperty CryptFindOIDInfo CertFindCertificateInStore CertAddCertificateContextToStore CertAddStoreToCollection CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertDeleteCertificateFromStore CertGetNameStringA PFXImportCertStore PFXVerifyPassword CertCreateCertificateContext

advapi32

GetTokenInformation LookupAccountSidA LookupPrivilegeNameA DeregisterEventSource LogonUserA LookupPrivilegeValueA LookupAccountNameA GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority CreateProcessAsUserA CreateProcessAsUserW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam RegisterEventSourceA RegEnumKeyA RegDeleteValueW GetLengthSid IsValidSecurityDescriptor IsValidSid LookupAccountSidW GetExplicitEntriesFromAclW GetNamedSecurityInfoW OpenProcessToken AdjustTokenPrivileges AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl LookupPrivilegeValueW RegCloseKey RegCreateKeyExW RegDeleteKeyW RegEnumKeyW RegEnumKeyExW RegLoadKeyW RegNotifyChangeKeyValue RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW RegUnLoadKeyW SetEntriesInAclW RegDeleteValueA LogonUserW RegEnumValueW RegOpenKeyExA RegQueryValueExA CloseServiceHandle EnumServicesStatusExW OpenSCManagerW RegDeleteKeyA RegCreateKeyExA ReportEventA ImpersonateLoggedOnUser RevertToSelf RegOpenKeyA ControlService CryptGetUserKey CryptDestroyKey ConvertSidToStringSidW OpenServiceW QueryServiceStatus RegSetValueExA RegEnumKeyExA RegEnumValueA RegQueryInfoKeyA CryptAcquireContextA CryptReleaseContext CryptGenKey

wsock32

WSACleanup WSAStartup WSAGetLastError

netapi32

DsGetDcNameA NetGetJoinInformation NetWkstaUserGetInfo DsRoleFreeMemory DsRoleGetPrimaryDomainInformation NetLocalGroupGetMembers DsGetDcNameW NetApiBufferFree NetShareEnum NetUserModalsGet NetUserGetInfo

psapi

GetModuleBaseNameW EnumProcessModules EnumProcesses

wtsapi32

WTSEnumerateSessionsA WTSQuerySessionInformationW WTSQuerySessionInformationA WTSFreeMemory

iphlpapi

GetAdaptersInfo

secur32

GetUserNameExA

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpWriteData WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpSetCredentials WinHttpSetStatusCallback WinHttpReceiveResponse WinHttpQueryHeaders WinHttpQueryOption WinHttpReadData

dcagentlibxml2

xmlNewTextReaderFilename xmlParseFile xmlTextReaderDepth xmlTextReaderName xmlStrcmp xmlTextReaderValue xmlTextReaderGetAttribute xmlFreeDoc xmlDocGetRootElement xmlFree xmlParseMemory xmlNodeListGetString xmlTextReaderAttributeCount xmlFreeTextReader xmlTextReaderRead xmlCleanupParser

winspool.drv

EnumPrintersW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

msi

ord70

ole32

CoInitialize CLSIDFromString CoUninitialize CoInitializeEx OleRun CoInitializeSecurity CoCreateInstance CoSetProxyBlanket

shell32

CommandLineToArgvW SHGetFolderPathW SHCreateDirectoryExA SHCreateDirectoryExW

kernel32

UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeSListHead RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW DuplicateHandle GetCPInfo CompareStringEx LCMapStringEx EncodePointer GetFileInformationByHandleEx MoveFileExW IsDebuggerPresent OutputDebugStringW RaiseException WakeAllConditionVariable GetStdHandle GetFileType FindFirstFileExW GetLocaleInfoEx GetStringTypeW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive InitOnceComplete InitOnceBeginInitialize GetModuleHandleExW WriteConsoleW ExitProcess GetConsoleMode GetModuleFileNameW lstrcmpiA GetVersion QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryExA lstrcmpW DisconnectNamedPipe ReadConsoleW GetCommandLineA GetDateFormatW GetTimeFormatW FormatMessageA GlobalFree GlobalAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW DeleteTimerQueue CreateTimerQueueTimer SleepConditionVariableSRW CreateTimerQueue GetConsoleOutputCP SetStdHandle SetFilePointerEx SetEndOfFile GetFileSizeEx CopyFileW FlushFileBuffers IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW GetSystemFirmwareTable FreeEnvironmentStringsW GetStartupInfoW GetLocaleInfoA GetSystemInfo GetPriorityClass SetPriorityClass GetEnvironmentVariableA CreateNamedPipeA CopyFileA GetModuleFileNameA GetProcessHeap ProcessIdToSessionId ConnectNamedPipe SetLastError SetFilePointer GetFileAttributesExA GetFileAttributesA GetCurrentDirectoryA SetCurrentDirectoryW SetCurrentDirectoryA lstrlenA GetTimeZoneInformation SystemTimeToTzSpecificLocalTime GetSystemTimeAsFileTime Process32Next ReadFile DecodePointer CloseHandle GetLastError CreatePipe HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize SetEnvironmentVariableW InitializeCriticalSectionAndSpinCount DeleteCriticalSection WaitForSingleObject TerminateProcess CreateThread CreateProcessA GetWindowsDirectoryW FindResourceExW FreeLibrary GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryW MultiByteToWideChar WideCharToMultiByte CreateFileW FileTimeToLocalFileTime GetFileTime GetBinaryTypeW FileTimeToSystemTime InitializeCriticalSectionEx LocalAlloc LocalFree FormatMessageW SetEvent ReleaseMutex CreateMutexW CreateEventW Sleep WaitForMultipleObjects GetCurrentProcess TerminateThread OpenProcess GetLocalTime GetTickCount CreateFileMappingW OpenFileMappingW MapViewOfFile UnmapViewOfFile GetModuleHandleW GetCommandLineW CreateDirectoryA CreateDirectoryW DeleteFileW FindFirstFileW FindNextFileW GetFileAttributesExW WriteFile GetSystemTime SystemTimeToFileTime GetFileAttributesW SetHandleInformation GetCurrentProcessId GetExitCodeProcess CreateProcessW GetFirmwareEnvironmentVariableA DeleteFileA ExpandEnvironmentStringsW FindClose IsProcessorFeaturePresent GetNativeSystemInfo InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId lstrcpyW lstrlenW CreateFileA FindFirstFileA FindNextFileA GetFileSize RemoveDirectoryA CreateMutexA OpenEventW GetComputerNameExW GetVersionExA GetModuleHandleA LoadLibraryA SetDllDirectoryA CreateToolhelp32Snapshot Process32First

user32

wsprintfW wsprintfA GetSystemMetrics

oleaut32

VariantInit VariantClear GetErrorInfo VariantChangeType SafeArrayGetElement SafeArrayAccessData SafeArrayGetLBound SafeArrayGetUBound SysAllocStringByteLen SysStringLen SysAllocString SysFreeString

odbc32

ord13 ord12 ord11 ord29 ord9 ord8 ord1 ord26 ord4 ord3 ord31 ord72 ord41 ord2 ord39 ord20 ord49 ord19 ord48 ord18 ord36 ord43 ord16

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_6b342850b17d2c63a06d6bdaea068de0_amadey_darkgate_elex_glassworm_luca-stealer_lynx_metamorfo_njrat

setupapi

shlwapi

userenv

crypt32

advapi32

wsock32

netapi32

psapi

wtsapi32

iphlpapi

secur32

winhttp

dcagentlibxml2

winspool.drv

version

msi

ole32

shell32

kernel32

user32

oleaut32

odbc32

generic