2026-08-11_bbcd5f76312017594a62e29a778afd87_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_bbcd5f76312017594a62e29a778afd87_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat
Size 4.2MB
Sample260811-qq5dcstfmd
SHA256 37471dac1124560cc3b2831d4258c1861e915dc48a601cb711c04be938ba3032
MD5 bbcd5f76312017594a62e29a778afd87
SHA1 3ddad7b3b616d5c1cc8dbdc4684efa8e0dbe6711
SHA512 5e16acb82556acda9a3378a84ed5537dbd6e81abb201d45b9882075453deaed9033ba4b201eac3685b246b9798b2e1191f2fe281415f286316e6a85c02046cd6
SSDEEP 98304:K8OMeY5tYYszAVALvleGurBtXwZwn6Jix8EVy:KjMeUtYYszAVALv4L
TLSH
T113268E603686C135D662117A4EBDBFBB8C1DA8251BB051CB92D58F6E28311D32F36F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-11_bbcd5f76312017594a62e29a778afd87_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

File Explorer

2026-08-11_bbcd5f76312017594a62e29a778afd87_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

.exe 4.2MB

2026-08-11_bbcd5f76312017594a62e29a778afd87_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

IMPHASH 8976d8d03da8a522c6b40328f9ee2d0f
SHA256 37471dac1124560cc3b2831d4258c1861e915dc48a601cb711c04be938ba3032
MD5 bbcd5f76312017594a62e29a778afd87
SHA1 3ddad7b3b616d5c1cc8dbdc4684efa8e0dbe6711
SHA512 5e16acb82556acda9a3378a84ed5537dbd6e81abb201d45b9882075453deaed9033ba4b201eac3685b246b9798b2e1191f2fe281415f286316e6a85c02046cd6
SSDEEP 98304:K8OMeY5tYYszAVALvleGurBtXwZwn6Jix8EVy:KjMeUtYYszAVALv4L
TLSH
T113268E603686C135D662117A4EBDBFBB8C1DA8251BB051CB92D58F6E28311D32F36F1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2040176

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\buildagent-cd_8818\p4\989747040\services\AMTSW\Release\UNS\Release\lms.pdb

kernel32

GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW MultiByteToWideChar GetFileSizeEx SetEnvironmentVariableW SetStdHandle FindFirstFileExW IsValidCodePage LocalAlloc LocalFree FormatMessageW GetOEMCP GetFullPathNameW FreeLibraryAndExitThread ExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW VirtualQuery VirtualProtect GetCommandLineA VirtualAlloc GetModuleHandleExW FreeEnvironmentStringsW RtlUnwind GetCurrentDirectoryW SetConsoleCtrlHandler GetConsoleMode ReadConsoleW GetConsoleOutputCP HeapSize HeapReAlloc LCMapStringW lstrcmpiW FindResourceW GetDateFormatW WriteConsoleW LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary GetCurrentThreadId GetCurrentThread GetTimeFormatW OutputDebugStringW GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo CompareStringEx GetLocaleInfoEx LCMapStringEx EncodePointer GetStringTypeW WaitForSingleObjectEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock GetFileInformationByHandle WaitForMultipleObjects WaitForMultipleObjectsEx QueryPerformanceFrequency SizeofResource CompareStringW GetTimeZoneInformation ExpandEnvironmentStringsW GetComputerNameExW WideCharToMultiByte CreateFileW GetFinalPathNameByHandleW LoadLibraryW CreateThread GetCurrentProcess CreateEventW lstrlenW WaitForSingleObject SetEvent DeleteCriticalSection IsWow64Process VerSetConditionMask OutputDebugStringA VerifyVersionInfoW GetSystemPowerStatus QueryPerformanceCounter GetComputerNameA GetSystemInfo GetACP GetCurrentProcessId InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection HeapAlloc HeapFree GetProcessHeap GetSystemDefaultLCID GetSystemTime SetFilePointer SetEndOfFile CreateFileA CancelIo ReadFile WriteFile DeviceIoControl GetOverlappedResult InitializeCriticalSectionAndSpinCount FlushFileBuffers GlobalFree GlobalAlloc SetLastError InitializeCriticalSection TryEnterCriticalSection SetThreadPriority ResumeThread GetLastError RaiseException CloseHandle DuplicateHandle TlsAlloc TlsGetValue TlsSetValue TlsFree RegisterWaitForSingleObject UnregisterWait GetModuleHandleA GetModuleFileNameA GetSystemDirectoryA LoadLibraryA TerminateProcess GetStdHandle DecodePointer GetCommandLineW SetDllDirectoryW Sleep ResetEvent ReleaseSemaphore ReleaseMutex CreateMutexW CreateEventA CreateSemaphoreW GetExitCodeThread SuspendThread GetThreadId GetSystemTimeAsFileTime FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetEnvironmentStringsW ExitProcess GetVersionExW LockFileEx SetFilePointerEx UnlockFileEx LoadLibraryExA

advapi32

RegCreateKeyW InitiateSystemShutdownExW LookupPrivilegeValueW AdjustTokenPrivileges SetEntriesInAclW RegSetKeySecurity RegDeleteKeyExW SetSecurityDescriptorDacl FreeSid AllocateAndInitializeSid ChangeServiceConfig2W CloseServiceHandle OpenProcessToken OpenThreadToken ControlService CreateServiceW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW CopySid GetLengthSid GetTokenInformation InitializeSecurityDescriptor IsValidSid SetSecurityDescriptorGroup SetSecurityDescriptorOwner RegCreateKeyExW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey ConvertSidToStringSidW LookupAccountSidW EqualSid CreateWellKnownSid StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW OpenServiceW OpenSCManagerW DeleteService ChangeServiceConfigW

user32

GetMessageW CharUpperW CharNextW PostThreadMessageW UnregisterDeviceNotification TranslateMessage LoadStringW DispatchMessageW RegisterDeviceNotificationW MessageBoxW

ole32

CoUninitialize CoCreateInstance StringFromGUID2 CoInitializeEx CoResumeClassObjects CoTaskMemFree CoAddRefServerProcess CoRegisterClassObject CoTaskMemAlloc PropVariantClear CoImpersonateClient CoRevertToSelf CoReleaseServerProcess CoRevokeClassObject CoTaskMemRealloc CoSetProxyBlanket CoInitializeSecurity

oleaut32

SysAllocStringByteLen SysStringByteLen VariantClear VariantChangeType VariantInit SysAllocString SysFreeString SysStringLen VarUI4FromStr LoadTypeLi RegisterTypeLi UnRegisterTypeLi VarBstrCat LoadRegTypeLi SafeArrayCreate SafeArrayGetUBound SafeArrayGetLBound SafeArrayLock SafeArrayUnlock SafeArrayPutElement SafeArrayCreateVector SysAllocStringLen

iphlpapi

IpRenewAddress GetInterfaceInfo GetPerAdapterInfo GetAdaptersInfo GetIpAddrTable CancelIPChangeNotify NotifyRouteChange CancelMibChangeNotify2 NotifyIpInterfaceChange GetAdaptersAddresses SetTcpEntry GetExtendedTcpTable

cfgmgr32

CM_Get_Device_Interface_ListA CM_Get_Device_Interface_List_SizeA

crypt32

CertCloseStore CryptMsgGetParam CryptMsgClose CertFreeCertificateContext CertGetNameStringW CryptQueryObject CertOpenStore CertGetNameStringA CertFindCertificateInStore

ws2_32

WSAAddressToStringA freeaddrinfo getaddrinfo WSAAccept WSAGetLastError getsockopt shutdown setsockopt send inet_addr recv ntohs listen htons getsockname getpeername ioctlsocket connect closesocket bind __WSAFDIsSet inet_ntoa htonl gethostbyaddr gethostbyname getservbyport WSASend getservbyname WSAStartup accept WSACloseEvent WSACleanup gethostname WSASetLastError ntohl WSACreateEvent getnameinfo WSAEventSelect WSAEnumNetworkEvents select socket

wintrust

WinVerifyTrust

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winhttp

WinHttpQueryAuthSchemes WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpOpen WinHttpSetCredentials WinHttpQueryHeaders WinHttpSendRequest WinHttpReceiveResponse

shell32

SHGetSpecialFolderPathW

api-ms-win-power-setting-l1-1-0

PowerReadDCValue PowerReadACValue

api-ms-win-power-base-l1-1-0

GetPwrCapabilities

powrprof

SetSuspendState

rpcrt4

UuidCreate UuidToStringA RpcStringFreeA

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

758KB

Virtual Size

757KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

173KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

828KB

Virtual Size

832KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=22, id=259, version=29395,

count=252, id=261, version=29395,

count=5, id=253, version=28518,

count=19, id=260, version=29804,

count=26, id=259, version=29804,

count=116, id=261, version=30152,

count=35, id=260, version=30152,

count=2, id=260, productName=VS2019 v16.8.4 build 29336, version=29336,

count=16, id=257, version=29395,

count=101, id=261, version=29804,

count=438, id=1, productName=Unmarked objects,

count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=31, id=260, version=29395,

count=385, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,

count=29, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,

count=1, id=256, productName=VS2019 v16.9.2 build 29913, version=29913,

count=1, id=255, productName=VS2019 v16.9.2 build 29913, version=29913,

count=2, id=151,

count=1, id=258, productName=VS2019 v16.9.2 build 29913, version=29913,