2026-08-09_62859bc4251b4256938ba0960d864cdb_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_62859bc4251b4256938ba0960d864cdb_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat
Size 3.4MB
Sample260809-jnypgahd98
SHA256 7f1eb461fb157aad6fd00b5f09db47bb51057728aa1da3d98d4325831b03f2b2
MD5 62859bc4251b4256938ba0960d864cdb
SHA1 42036c4c58a270fe7272e5676cf18c04597bb55d
SHA512 970987c6e21b6cd3ab20f82b1c356ced1f5b5be3f41d569cbeded548ef9d5fb2acc432e5650c8aa143b0f1a26a86a148acd08cb99c5a30a94235045725900085
SSDEEP 49152:B4UoUNixh7wmjhlXzVVESKccruXDvSl6sD7YT/BMT0+M2CGac5dPaofrU5uwTLp5:wAixxjjPMrruXDaDA/ufM2ZPr455
TLSH
T105F5E0217E458136D5A202B1993DAFBF815CBF3407A888FBA3C80E6F59705C3BA35657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-09_62859bc4251b4256938ba0960d864cdb_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

.exe 3.4MB

2026-08-09_62859bc4251b4256938ba0960d864cdb_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

IMPHASH 6c3cb204179150dca41cc355f3e9da9d
SHA256 7f1eb461fb157aad6fd00b5f09db47bb51057728aa1da3d98d4325831b03f2b2
MD5 62859bc4251b4256938ba0960d864cdb
SHA1 42036c4c58a270fe7272e5676cf18c04597bb55d
SHA512 970987c6e21b6cd3ab20f82b1c356ced1f5b5be3f41d569cbeded548ef9d5fb2acc432e5650c8aa143b0f1a26a86a148acd08cb99c5a30a94235045725900085
SSDEEP 49152:B4UoUNixh7wmjhlXzVVESKccruXDvSl6sD7YT/BMT0+M2CGac5dPaofrU5uwTLp5:wAixxjjPMrruXDaDA/ufM2ZPr455
TLSH
T105F5E0217E458136D5A202B1993DAFBF815CBF3407A888FBA3C80E6F59705C3BA35657
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

ef:31:bf:75:c4:86:49:89:e8:68:b4:25:5a:26:d6:d0:10:6d:4a:ae:f4:1c:0e:36:95:c9:09:be:a2:c8:1d:10

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91510100MAC13UF2XR,CN=成都霁悦科技有限公司,O=成都霁悦科技有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jun 12, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

07:f6:2f:c4:75:14:15:80:d1:17:c2:44:48:43:66:d5

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 28, 2023 - Nov 27, 2026

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

787422

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ProgramData\Jenkins\.jenkins\workspace\MGame\AiMiClaw\AiMiClaw_inst_uninst\bin\Uninst\Release\uninst.pdb

kernel32

GetPrivateProfileSectionW RemoveDirectoryW MoveFileExW DeleteFileW SetFileAttributesW GetFileAttributesW WideCharToMultiByte FindClose FindNextFileW SetLastError GetFullPathNameW FindFirstFileW lstrlenW CreateEventW WaitForSingleObject SetEvent CloseHandle MultiByteToWideChar SetCurrentDirectoryW GetSystemDirectoryW GetCurrentDirectoryW InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetModuleFileNameW GetCurrentProcess GetModuleHandleW DeleteCriticalSection DecodePointer RaiseException GetLastError InitializeCriticalSectionEx lstrcmpiW OutputDebugStringW FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapFree HeapReAlloc HeapSize HeapDestroy FreeLibrary LoadLibraryW GetProcAddress SetStdHandle SetFilePointerEx GetConsoleOutputCP GetFileType GetTimeZoneInformation IsDebuggerPresent FormatMessageW GetStringTypeW EncodePointer TryEnterCriticalSection GetCurrentThreadId QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo CreateFileW MulDiv ExitProcess FreeResource GetACP GetCurrentProcessId OpenProcess GetFileSize ReadFile lstrcmpW SetEndOfFile SetFilePointer WriteFile CreateFileMappingW MapViewOfFile UnmapViewOfFile GetVersion GlobalAlloc GlobalUnlock GlobalLock GlobalFree GetTempFileNameW GetTempPathW Sleep ResumeThread ResetEvent GetLocalTime IsBadReadPtr lstrcpynW lstrcpyW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW K32GetProcessImageFileNameW GetLogicalDriveStringsW QueryDosDeviceW CreateMutexW LocalFree K32EnumProcesses TerminateProcess GetLongPathNameW GetWindowsDirectoryW MoveFileW GetTempPathA GetTempFileNameA DeleteFileA CreateFileA WaitForSingleObjectEx IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead FlushFileBuffers SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree DuplicateHandle ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateTimerQueue FindFirstFileA FindNextFileA CreateFileMappingA GetSystemWindowsDirectoryW DeviceIoControl lstrcmpA GetStdHandle GetConsoleMode WriteConsoleW RtlUnwind ExitThread GetModuleHandleExW

user32

IntersectRect UnionRect IsRectEmpty PtInRect GetWindowLongW SetWindowLongW GetParent GetClassNameW GetWindow MonitorFromWindow IsIconic SetWindowRgn MessageBoxW GetMonitorInfoW wsprintfW DefWindowProcW CallWindowProcW RegisterClassW RegisterClassExW GetClassInfoExW EnableWindow SetPropW GetPropW LoadCursorW LoadImageW SystemParametersInfoW wvsprintfW SetCursor InflateRect OffsetRect MonitorFromPoint CharPrevW DrawTextW SetRect DestroyIcon DrawIconEx GetIconInfo GetMessagePos MoveWindow GetDlgCtrlID DrawFocusRect FillRect HideCaret ShowCaret ClientToScreen GetSysColor GetWindowDC GetWindowTextW GetWindowTextLengthW CreateAcceleratorTableW InvalidateRgn RemovePropW FindWindowExW IsWindowEnabled TranslateMessage DispatchMessageW SendMessageW CreateWindowExW IsWindow IsChild ScreenToClient DestroyWindow UpdateLayeredWindow IsZoomed CharNextW SetFocus GetFocus GetKeyState SetCapture ReleaseCapture SetTimer KillTimer GetDC ReleaseDC BeginPaint EndPaint GetMessageW ShowWindow SetForegroundWindow SendMessageTimeoutW PostMessageW RegisterWindowMessageW GetUpdateRect InvalidateRect GetClientRect GetWindowRect IsWindowVisible SetWindowPos PostQuitMessage SetWindowTextW GetCursorPos CreateCaret GetCaretBlinkTime SetCaretPos MapWindowPoints

advapi32

OpenSCManagerW RegCreateKeyW OpenServiceW ControlService DeleteService CloseServiceHandle OpenProcessToken LookupPrivilegeValueW RegDeleteKeyExW RegDeleteTreeW RegCreateKeyExW RegDeleteValueW RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW AdjustTokenPrivileges GetTokenInformation RegEnumKeyExW

shell32

SHGetSpecialFolderPathW SHChangeNotify ShellExecuteW ord165 SHGetKnownFolderPath SHFileOperationW SHCreateItemFromParsingName

ole32

StringFromGUID2 CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoTaskMemFree OleLockRunning CLSIDFromString CoCreateGuid CreateStreamOnHGlobal CoInitialize CoCreateInstance CoUninitialize CLSIDFromProgID

oleaut32

SysStringLen SysAllocStringLen SafeArrayCreate SysAllocString SysFreeString VariantInit VariantClear SafeArrayPutElement

shlwapi

StrCmpNIW PathRenameExtensionA StrStrIA StrCmpIW SHSetValueA PathFindFileNameA SHDeleteKeyW SHSetValueW StrStrIW PathFindFileNameW SHAutoComplete StrTrimA SHGetValueW PathCombineW PathRemoveFileSpecW PathAppendW PathFileExistsW wnsprintfW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

comctl32

ImageList_DrawEx ImageList_GetIconSize _TrackMouseEvent ord17 InitCommonControlsEx

msimg32

AlphaBlend GradientFill

gdiplus

GdipDeletePath GdipAddPathLineI GdipAddPathArcI GdipCloneBrush GdipDrawImageRectI GdipLoadImageFromStreamICM GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipCreatePath GdipSetPenDashStyle GdipCreateFromHDC GdipDeleteGraphics GdipGetImagePixelFormat GdipDrawLineI GdipDrawRectangleI GdipDrawPath GdipFillEllipseI GdipClosePathFigure GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipLoadImageFromFile GdipAlloc GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipCreateHBITMAPFromBitmap GdipCloneBitmapAreaI GdipBitmapLockBits GdipGetPropertyItemSize GdipGetPropertyItem GdiplusStartup GdiplusShutdown GdipBitmapUnlockBits GdipSetSmoothingMode GdipFree GdipGraphicsClear GdipFillPath GdipDrawImagePointsI GdipDrawImageRectRectI GdipGetImageEncodersSize GdipGetImageEncoders GdipCreateTexture GdipDrawEllipseI GdipAddPathArc GdipSetInterpolationMode

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

gdi32

SetTextColor SetStretchBltMode StretchBlt SetBkMode SetBkColor ExtSelectClipRgn SelectClipRgn GetTextExtentPoint32W GetClipBox GetCharABCWidthsW CreateRectRgnIndirect CreateSolidBrush CombineRgn GetTextColor CreateDIBSection SetWindowOrgEx GetObjectW GetTextMetricsW SelectObject SaveDC RestoreDC Rectangle GetStockObject DeleteObject DeleteDC CreatePen CreateFontIndirectW CreateCompatibleDC CreateDCW CreateCompatibleBitmap BitBlt SetDIBColorTable TextOutW ExtTextOutW CreateRoundRectRgn GetDIBits SetDIBitsToDevice GetDeviceCaps

generic

count=38, id=259, version=30795,

count=212, id=261, version=30795,

count=11, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=2, id=260, version=27034,

count=11, id=260, version=27054,

count=1, id=260, version=27050,

count=6, id=261, version=27050,

count=3, id=199, version=41118,

count=26, id=259, version=26706,

count=1, id=262, version=30795,

count=83, id=261, version=27054,

count=40, id=260, version=26706,

count=138, id=261, version=26706,

count=50, id=260, version=30795,

count=37, id=257, version=30795,

count=566, id=1, productName=Unmarked objects,

count=47, id=265, version=27054,

count=1, id=256, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,