2026-08-09_9908fc0715d1743c596e617188b0bbc5_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_metamorfo_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_9908fc0715d1743c596e617188b0bbc5_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_metamorfo_njrat
Size 2.5MB
Sample260809-hdmnsaar2z
SHA256 2b769b23974c0dac1702f36d9ab47182f0c3d9849e7c0ddc5f922424f5ae1c62
MD5 9908fc0715d1743c596e617188b0bbc5
SHA1 1b612e861e5d3a15d7dcaeb4fe8a70d6d4a60235
SHA512 904dd0cfd4c81a6ee23c146773e20c91bc1f7ac62877bc53ada7623a83a952bf8e1c9fb42691673783151bd1601d394c00487d780c6915a6a9a97518d6c8597a
SSDEEP 49152:DDcJq/iKOqezDi3vG2lpbg+8AyEazSnzdtro7YT/3YTuItt:8F7d0e8ugXazSAA/3
TLSH
T127C57E2176058135E9A101F28D3CAFBFD42DAF5807E859DFE2880E292D789D37A3751B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-09_9908fc0715d1743c596e617188b0bbc5_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_metamorfo_njrat

.exe 2.5MB

2026-08-09_9908fc0715d1743c596e617188b0bbc5_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_metamorfo_njrat

IMPHASH ac4f8365c80f3676ca50fc063ba5e72d
SHA256 2b769b23974c0dac1702f36d9ab47182f0c3d9849e7c0ddc5f922424f5ae1c62
MD5 9908fc0715d1743c596e617188b0bbc5
SHA1 1b612e861e5d3a15d7dcaeb4fe8a70d6d4a60235
SHA512 904dd0cfd4c81a6ee23c146773e20c91bc1f7ac62877bc53ada7623a83a952bf8e1c9fb42691673783151bd1601d394c00487d780c6915a6a9a97518d6c8597a
SSDEEP 49152:DDcJq/iKOqezDi3vG2lpbg+8AyEazSnzdtro7YT/3YTuItt:8F7d0e8ugXazSAA/3
TLSH
T127C57E2176058135E9A101F28D3CAFBFD42DAF5807E859DFE2880E292D789D37A3751B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

dd:4e:40:57:a0:60:57:db:23:05:33:07:c0:82:16:e0:ca:92:5b:6a:e6:69:15:1e:50:fa:81:d6:1a:c3:88:dc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91510100MAC13UF2XR,CN=成都霁悦科技有限公司,O=成都霁悦科技有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jun 12, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

07:f6:2f:c4:75:14:15:80:d1:17:c2:44:48:43:66:d5

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 28, 2023 - Nov 27, 2026

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

1204079

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ProgramData\Jenkins\.jenkins\workspace\MGame\AiMiClaw\AiMiClawTray\bin\Release\AiMiClawTray.pdb

kernel32

ResumeThread WaitForSingleObjectEx SystemTimeToFileTime CreateToolhelp32Snapshot GetTickCount64 Process32NextW Process32FirstW GetProcessTimes TerminateThread CopyFileW DeleteAtom FindAtomW AddAtomW lstrcpynW GetExitCodeProcess GetCurrentProcessId GetProcAddress LoadLibraryW OpenProcess K32GetModuleFileNameExW TerminateProcess lstrlenW GetCurrentProcess GetTickCount WideCharToMultiByte FreeLibrary SetEvent MultiByteToWideChar CreateEventW InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DisconnectNamedPipe ReadFile ResetEvent GetCommandLineW lstrcmpiW OutputDebugStringW CreateProcessW DeleteFileW FindResourceW LoadResource FindResourceExW LockResource GetPrivateProfileStringW ReleaseMutex WaitForSingleObject GetModuleFileNameW GetPrivateProfileIntW WritePrivateProfileStringW SizeofResource GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException CloseHandle HeapReAlloc CreateFileA GetLastError GetCurrentThread Sleep GetVersionExW GetFileAttributesW CreateFileW FindClose GetTempPathW GetProcessId FindNextFileW GetFullPathNameW SetLastError FindFirstFileW GetStartupInfoW SetUnhandledExceptionFilter IsBadReadPtr GetModuleHandleW GetCurrentThreadId VirtualProtect WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetStdHandle GetModuleHandleExW ExitThread SetFilePointerEx GetFileType GetConsoleMode GetConsoleOutputCP GetTimeZoneInformation GetFileAttributesExW RtlUnwind CreateMutexW CreateFileMappingA FindNextFileA FindFirstFileA HeapSize InitializeCriticalSectionEx WriteFile HeapFree IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA FormatMessageW GetStringTypeW TryEnterCriticalSection DuplicateHandle SwitchToThread InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime QueryPerformanceCounter QueryPerformanceFrequency CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile lstrcpyW MulDiv GetACP ExitProcess FreeResource GetFileSize lstrcmpW SetEndOfFile SetFilePointer GetVersion GlobalAlloc GlobalUnlock GlobalLock GlobalFree GetTempFileNameW GetLocalTime UnhandledExceptionFilter FlushFileBuffers GetEnvironmentVariableW LocalFree CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW ReleaseSemaphore InterlockedFlushSList QueryDepthSList UnregisterWaitEx GetSystemWindowsDirectoryW DeviceIoControl lstrcmpA

user32

SetCapture ReleaseCapture BeginPaint EndPaint GetUpdateRect InvalidateRect CreateCaret GetCaretBlinkTime SetCaretPos MapWindowPoints IntersectRect UnionRect IsRectEmpty GetParent GetClassNameW GetWindow MonitorFromWindow wvsprintfW SetCursor InflateRect OffsetRect RegisterClassW LoadImageW IsIconic SetWindowRgn MessageBoxW CharPrevW DrawTextW GetKeyState DrawIconEx GetIconInfo GetMessagePos GetDlgCtrlID DrawFocusRect FillRect GetFocus ShowCaret ClientToScreen GetSysColor SetLayeredWindowAttributes RedrawWindow GetWindowDC GetWindowTextW GetWindowTextLengthW CreateAcceleratorTableW InvalidateRgn FindWindowExW IsWindowEnabled CharNextW IsWindowVisible IsChild SendMessageW DispatchMessageW SetForegroundWindow PostMessageW TranslateMessage GetMessageW MonitorFromPoint DestroyIcon UnregisterClassW RegisterWindowMessageW ScreenToClient GetClientRect RemovePropW GetPropW SetPropW ReleaseDC GetDC EnableWindow IsZoomed UpdateLayeredWindow ShowWindow MoveWindow SetFocus ChangeWindowMessageFilter LoadIconW PostQuitMessage GetCursorPos DefWindowProcW CallWindowProcW DestroyWindow CreateWindowExW RegisterClassExW SetTimer LoadCursorW SetWindowLongW KillTimer GetClassInfoExW SetProcessDpiAwarenessContext SendMessageTimeoutW IsWindow FindWindowW SetWindowTextW wsprintfW GetWindowLongW GetWindowThreadProcessId GetWindowRect SetWindowPos EnumDisplayMonitors GetShellWindow GetMonitorInfoW CopyRect SystemParametersInfoW PtInRect HideCaret SetRect

advapi32

RegCreateKeyExW RegEnumKeyExW RegSetKeyValueW RegDeleteKeyValueW RegCloseKey QueryServiceStatus EqualSid CloseServiceHandle OpenSCManagerW AllocateAndInitializeSid FreeSid RegOpenKeyExW OpenServiceW DuplicateTokenEx OpenThreadToken RegQueryValueExW GetTokenInformation LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegGetValueW RegCreateKeyW RegSetValueExW

shell32

SHCreateDirectoryExW ord680 SHFileOperationW ShellExecuteExW SHGetSpecialFolderPathW ord165 Shell_NotifyIconW

ole32

CoCreateGuid CoCreateInstance CoInitialize CoUninitialize CreateStreamOnHGlobal CoSetProxyBlanket CoInitializeSecurity CoTaskMemAlloc PropVariantClear CoInitializeEx OleLockRunning CLSIDFromProgID CLSIDFromString

oleaut32

SafeArrayPutElement SysStringLen SysFreeString VariantClear VariantChangeType SysAllocStringLen SysAllocString VariantInit SafeArrayCreate

shlwapi

PathCombineW PathRemoveFileSpecW PathFileExistsW StrCpyW PathAppendW PathFindFileNameW StrStrIW wnsprintfW SHAutoComplete StrCmpIW StrStrIA StrTrimA StrCmpNIW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

secur32

GetUserNameExW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

gdi32

SetDIBColorTable CreateCompatibleDC DeleteDC DeleteObject SelectObject CreateDIBSection GetDeviceCaps BitBlt CreateCompatibleBitmap CreateFontIndirectW CreatePen GetStockObject Rectangle RestoreDC SaveDC GetTextMetricsW GetObjectW SetWindowOrgEx CreateRoundRectRgn CombineRgn CreateRectRgnIndirect GetCharABCWidthsW GetClipBox GetTextExtentPoint32W SelectClipRgn ExtSelectClipRgn SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor TextOutW ExtTextOutW CreateSolidBrush GetTextColor CreateDCW GetDIBits SetDIBitsToDevice

comctl32

InitCommonControlsEx ImageList_GetIconSize ImageList_DrawEx _TrackMouseEvent ord17

msimg32

AlphaBlend GradientFill

gdiplus

GdipGetImageEncoders GdipGetImageEncodersSize GdipGetImagePixelFormat GdipDrawImagePointsI GdipFillPath GdipGraphicsClear GdipAddPathArc GdipDrawEllipseI GdipLoadImageFromFile GdipDrawImageRectI GdipLoadImageFromStreamICM GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipDrawImageRectRectI GdipDeleteGraphics GdipGetPropertyItem GdipGetPropertyItemSize GdipAlloc GdipFree GdipCreatePath GdipDeletePath GdipAddPathLineI GdipAddPathArcI GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipSetPenDashStyle GdipCreateFromHDC GdipSetInterpolationMode GdipSetSmoothingMode GdipDrawLineI GdipDrawRectangleI GdipDrawPath GdipFillEllipseI GdipClosePathFigure GdipCreateTexture GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipCreateHBITMAPFromBitmap GdipCloneBitmapAreaI GdipBitmapLockBits GdipBitmapUnlockBits GdipImageSelectActiveFrame

generic

count=38, id=259, version=30795,

count=202, id=261, version=30795,

count=11, id=260, version=27054,

count=2, id=260, version=27034,

count=1, id=262, version=30795,

count=2, id=261, version=27051,

count=2, id=199, version=41118,

count=25, id=259, version=26706,

count=87, id=261, version=27054,

count=1, id=260, version=27050,

count=9, id=261, version=27050,

count=40, id=260, version=26706,

count=1, id=263, version=30795,

count=137, id=261, version=26706,

count=52, id=260, version=30795,

count=37, id=257, version=30795,

count=564, id=1, productName=Unmarked objects,

count=36, id=265, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,