2026-08-10_10d5cdaab8488accb504229015ec9f36_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_10d5cdaab8488accb504229015ec9f36_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat
Size 7.6MB
Sample260810-kr4wbsfa89
SHA256 2bc1fbba6671d6aea28e0a882193b185383184964098e0b6a086fbbaa736ad88
MD5 10d5cdaab8488accb504229015ec9f36
SHA1 819d33f4cea4fbea5d39f9c507d999f86da99568
SHA512 ff58b953c2b7d2f85f2f3e415c68395eb9e9aab40902c0c00bdf1d11cc50c9e5e9f74ff791d1b2ca4e1a2b4313c76e1b8f0f06f1de290d7ea42a3d4cfd689c51
SSDEEP 196608:QFhsCT/mHB2UHVo8Uz6JBTSn7o46cO/zM77wfA3NJH+0f9gc8:+hnuja8Uz6JB+7p6B/zALJe0f2R
TLSH
T18E8602117781C035E5D92872492AABFA41E9BF341B6141EFE3A43A3E5E741C37E3352A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_10d5cdaab8488accb504229015ec9f36_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat

File Explorer

2026-08-10_10d5cdaab8488accb504229015ec9f36_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat

.exe 7.6MB

2026-08-10_10d5cdaab8488accb504229015ec9f36_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat

IMPHASH 9974353c2e1d0952f2b7856af0c17047
SHA256 2bc1fbba6671d6aea28e0a882193b185383184964098e0b6a086fbbaa736ad88
MD5 10d5cdaab8488accb504229015ec9f36
SHA1 819d33f4cea4fbea5d39f9c507d999f86da99568
SHA512 ff58b953c2b7d2f85f2f3e415c68395eb9e9aab40902c0c00bdf1d11cc50c9e5e9f74ff791d1b2ca4e1a2b4313c76e1b8f0f06f1de290d7ea42a3d4cfd689c51
SSDEEP 196608:QFhsCT/mHB2UHVo8Uz6JBTSn7o46cO/zM77wfA3NJH+0f9gc8:+hnuja8Uz6JB+7p6B/zALJe0f2R
TLSH
T18E8602117781C035E5D92872492AABFA41E9BF341B6141EFE3A43A3E5E741C37E3352A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

463618

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\jenkins\.jenkins\workspace\group_clean\adblock_master_group\install_uninstall\install_uninstall\Release\Install.pdb

kernel32

GetCurrentProcess WaitForSingleObjectEx SwitchToThread WaitForSingleObject UnlockFile ReadFile LockFile GetFileSize CreateFileW GetModuleFileNameW CreateMutexW LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetLastError MoveFileExW MoveFileW lstrlenW FindResourceW SizeofResource LockResource LoadResource FindResourceExW GetWindowsDirectoryW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetProcAddress SetLastError WideCharToMultiByte VerSetConditionMask WriteConsoleW ReadConsoleW GetStringTypeW SetStdHandle SetConsoleCtrlHandler SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW RaiseException GetTickCount64 InitializeCriticalSectionEx GetDriveTypeW CreateEventW SetEvent MultiByteToWideChar lstrcmpiW LoadLibraryW LoadLibraryExW FreeLibrary Sleep CreateProcessW VerifyVersionInfoW GetCurrentThreadId DeleteCriticalSection GetStartupInfoW GetTempPathW SetFileAttributesW RemoveDirectoryW GetFullPathNameW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CloseHandle LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlushFileBuffers GetCurrentThread GetTimeZoneInformation GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileType ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InterlockedFlushSList RtlUnwind ReleaseMutex lstrcmpiA lstrcmpA DeviceIoControl GetVersionExW GetSystemWindowsDirectoryW FreeResource InterlockedCompareExchange GetStdHandle GetTempFileNameA GetTempPathA WriteFile SetEndOfFile GetFileInformationByHandle CompareFileTime FindFirstChangeNotificationW FindCloseChangeNotification SetFileTime SearchPathW GetCurrentDirectoryW OpenFileMappingW GetSystemTimeAsFileTime QueryPerformanceCounter SetUnhandledExceptionFilter UnhandledExceptionFilter FindNextFileA FindFirstFileA GlobalFree GlobalUnlock DecodePointer GetModuleHandleW DeleteFileA InitializeCriticalSectionAndSpinCount GlobalLock GlobalAlloc LoadLibraryExA GetFileSizeEx GetLocalTime ResetEvent GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile CreateDirectoryW GetTempFileNameW GetCurrentProcessId LocalFree FormatMessageW CopyFileW GetLogicalDriveStringsW GetLongPathNameW QueryDosDeviceW TerminateProcess GetExitCodeProcess OpenProcess GetDiskFreeSpaceExW GetSystemDirectoryW OutputDebugStringA OutputDebugStringW GetFileAttributesExW SetFilePointer WaitForMultipleObjects GetTickCount LocalAlloc GetPrivateProfileStringW WritePrivateProfileStringW GetShortPathNameW IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree CreateFileA

user32

GetMonitorInfoW MonitorFromWindow LoadImageW GetWindow MapWindowPoints SetForegroundWindow GetSystemMetrics IsIconic DefWindowProcW PostQuitMessage CharNextW BringWindowToTop PeekMessageW DialogBoxParamW MessageBoxW wsprintfW RegisterWindowMessageW SendMessageTimeoutW SendNotifyMessageW FindWindowW CopyRect OffsetRect UnionRect EqualRect PtInRect SetCursor DrawFocusRect DestroyCursor MoveWindow UnregisterClassA TranslateMessage GetMessageW LoadCursorW GetParent SetWindowLongW GetWindowLongW FillRect ScreenToClient GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW InvalidateRect EndPaint BeginPaint ReleaseDC GetDC DrawTextW KillTimer SetTimer ReleaseCapture SetCapture GetAsyncKeyState GetFocus SetWindowPos UpdateLayeredWindow EndDialog GetActiveWindow IsDialogMessageW ShowWindow DestroyWindow IsWindow CallWindowProcW UnregisterClassW SendMessageW CreateWindowExW GetClassInfoExW RegisterClassExW DispatchMessageW GetWindowThreadProcessId FindWindowExW PostMessageW IsWindowVisible

gdi32

CreateRectRgnIndirect SetViewportOrgEx GetObjectW CreateDIBSection SetTextColor SetBkMode SelectObject SelectClipRgn SaveDC RestoreDC GetStockObject DeleteObject DeleteDC RectVisible CreateCompatibleDC CreateCompatibleBitmap BitBlt CreateFontW EnumFontFamiliesW OffsetViewportOrgEx

advapi32

CryptContextAddRef CryptEncrypt CryptImportKey CryptGenRandom CryptSetKeyParam CryptDestroyKey RegSetValueExW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey CryptReleaseContext GetUserNameW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW AllocateAndInitializeSid CheckTokenMembership FreeSid DeleteAce EqualSid LookupAccountSidW LookupAccountNameW SetEntriesInAclW GetExplicitEntriesFromAclW GetNamedSecurityInfoW SetNamedSecurityInfoW BuildExplicitAccessWithNameW GetTrusteeNameW RegGetValueW GetTokenInformation RegEnumValueW RegEnumKeyExA RegOpenKeyExA RegQueryValueExA CryptAcquireContextW CryptDecrypt

shell32

SHCreateDirectoryExW ord165 ShellExecuteW SHGetPathFromIDListW SHBrowseForFolderW SHChangeNotify ShellExecuteExW SHGetSpecialFolderPathW

ole32

CoTaskMemFree CoInitialize CreateStreamOnHGlobal CoInitializeSecurity CoTaskMemRealloc CoInitializeEx CoTaskMemAlloc CoSetProxyBlanket CoCreateInstance CoUninitialize CoCreateGuid OleRun

oleaut32

CreateErrorInfo SetErrorInfo VariantChangeType GetErrorInfo VariantClear VariantInit SysAllocString VariantCopy SysAllocStringByteLen VarUI4FromStr SysFreeString

shlwapi

PathFindFileNameW PathFindExtensionW PathFileExistsW PathCombineW PathAppendW PathIsDirectoryW PathFindFileNameA PathIsRelativeW PathAppendA PathIsRootW StrStrIA StrCmpNIW SHSetValueW SHSetValueA SHGetValueA StrToIntExW StrCmpIW StrStrIW SHGetValueW PathRemoveFileSpecW PathIsPrefixW wnsprintfW SHDeleteValueW StrTrimA PathRenameExtensionA

comctl32

InitCommonControlsEx _TrackMouseEvent

gdiplus

GdiplusShutdown GdipAlloc GdipFree GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipGetImageWidth GdipGetImageHeight GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipCreateFromHDC GdipDeleteGraphics GdipSetTextRenderingHint GdipDrawRectangleI GdipFillRectangleI GdipDrawImagePointRectI GdipDrawImageRectRect GdipDrawImageRectRectI GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString GdipMeasureString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipCloneImage GdipDisposeImage GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFileICM GdiplusStartup

psapi

GetModuleFileNameExW EnumProcesses GetProcessImageFileNameW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

setupapi

SetupIterateCabinetW

secur32

GetUserNameExW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

crypt32

CryptBinaryToStringW CryptBinaryToStringA CertGetNameStringW CryptStringToBinaryA CryptStringToBinaryW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

generic

count=17, id=259, version=30795,

count=188, id=261, version=30795,

count=3, id=261, version=27031,

count=1, id=262, version=30795,

count=2, id=264, version=27051,

count=1, productName=Unmarked objects (old),

count=10, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=3, id=199, version=41118,

count=23, id=259, version=26706,

count=16, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=6, id=261, version=27032,

count=35, id=260, version=26706,

count=78, id=261, version=26706,

count=27, id=260, version=30795,

count=39, id=257, version=30795,

count=432, id=1, productName=Unmarked objects,

count=74, id=261, version=27051,

count=1, id=256, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,