2026-08-11_10a132627d67d2c3f763ee80daba9e4b_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_10a132627d67d2c3f763ee80daba9e4b_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat
Size 2.5MB
Sample260811-vth2rafe59
SHA256 5d3e7cb601507bb505729b998f7980fe4e4dce5c3eb618b7cb2fefd3c5f9ae1b
MD5 10a132627d67d2c3f763ee80daba9e4b
SHA1 6b0d8c33712ad425e907551bc9ea9670b8a943ba
SHA512 d82fec206f3f0e6158c2bb872fc70132c38d97ce1acc3a531007ba3d04035b2cae4c9821a82b34fd223da70737fc60c7c9d0925a89bd7355e31a714ca618cf68
SSDEEP 49152:h8cOORKNPbgGHv1T2VJX9P1tNhyn/vFNtOebpkbiAqkDD356PI:WcmDgI2tLO/dNtOeCxFDD5
TLSH
T1F3C59D11BA41C237D49100B2997EABBF816DBE380B6555C7B3C81F7EA9325C36E32617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-11_10a132627d67d2c3f763ee80daba9e4b_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat

.exe 2.5MB

2026-08-11_10a132627d67d2c3f763ee80daba9e4b_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat

IMPHASH 36a3496108527b558698a2e71cc20bfc
SHA256 5d3e7cb601507bb505729b998f7980fe4e4dce5c3eb618b7cb2fefd3c5f9ae1b
MD5 10a132627d67d2c3f763ee80daba9e4b
SHA1 6b0d8c33712ad425e907551bc9ea9670b8a943ba
SHA512 d82fec206f3f0e6158c2bb872fc70132c38d97ce1acc3a531007ba3d04035b2cae4c9821a82b34fd223da70737fc60c7c9d0925a89bd7355e31a714ca618cf68
SSDEEP 49152:h8cOORKNPbgGHv1T2VJX9P1tNhyn/vFNtOebpkbiAqkDD356PI:WcmDgI2tLO/dNtOeCxFDD5
TLSH
T1F3C59D11BA41C237D49100B2997EABBF816DBE380B6555C7B3C81F7EA9325C36E32617
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

70:99:59:31:e0:09:55:8a:90:ae:96:61:4c:f2:0b:be:1c:b7:65:b2:2d:e9:c3:04:af:5e:fb:ff:a8:09:13:ad

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=成都星汉云科科技有限公司,O=成都星汉云科科技有限公司,L=成都市,ST=四川省,C=CN

Chains

Jul 6, 2026

CN=成都星汉云科科技有限公司,O=成都星汉云科科技有限公司,L=成都市,ST=四川省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=成都星汉云科科技有限公司,O=成都星汉云科科技有限公司,L=成都市,ST=四川省,C=CN

Serial Number

01:cd:71:67:23:ee:3c:14:c3:36:fe:fa:6f:5a:b8:cb

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 28, 2025 - Apr 26, 2028

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

1088921

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ProgramData\Jenkins\.jenkins\workspace\PCStore\PCStoreMain\bin\Release\ZXStore.pdb

kernel32

FindFirstFileA FindNextFileW FileTimeToSystemTime GetCommandLineW AcquireSRWLockShared ReleaseSRWLockShared LoadLibraryExA FlushInstructionCache SetNamedPipeHandleState DisconnectNamedPipe ConnectNamedPipe CreateFileW CreateMutexW ReleaseMutex lstrcmpiA GetSystemDirectoryW WritePrivateProfileStringW GetPrivateProfileIntW Process32NextW Process32FirstW CreateToolhelp32Snapshot MoveFileExW MoveFileW GetPrivateProfileStringW lstrcpyW GlobalFree GlobalLock GlobalUnlock GlobalAlloc UnmapViewOfFile MapViewOfFile CreateFileMappingW GetWindowsDirectoryW GetTickCount GetProcessId GetStartupInfoW CreateProcessW GetCurrentThread OutputDebugStringW GetTempPathW WriteFile SetFileAttributesW SetFileAttributesA SetEndOfFile RemoveDirectoryW ReadFile GetFileSize GetFileAttributesW FindClose GetFileAttributesA CreateFileA lstrlenW lstrcpynW MultiByteToWideChar WaitForMultipleObjects IsBadReadPtr VirtualProtect GetCurrentThreadId GetCurrentProcessId WaitForSingleObject SetUnhandledExceptionFilter WideCharToMultiByte CopyFileW LoadLibraryW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary FindResourceExW GetOverlappedResult Sleep CreateEventW ResetEvent SetEvent LeaveCriticalSection WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeZoneInformation GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileType GetModuleHandleExW ExitThread GetFileAttributesExW RtlUnwind CreateFileMappingA FindNextFileA lstrcmpA DeviceIoControl GetSystemWindowsDirectoryW UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualAlloc GetVersionExW GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue EnterCriticalSection InitializeCriticalSection CloseHandle DeleteFileW GetShortPathNameW DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc GetStdHandle LoadLibraryExW InitializeSListHead GetCurrentProcess CreateNamedPipeW HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer IsDebuggerPresent EncodePointer GetStringTypeW FormatMessageW TryEnterCriticalSection DuplicateHandle WaitForSingleObjectEx SwitchToThread GetExitCodeThread SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime QueryPerformanceCounter QueryPerformanceFrequency GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW LocalFree GetFileSizeEx FlushFileBuffers CreateDirectoryW ResumeThread MulDiv FreeResource lstrcmpW GetACP ExitProcess FindFirstFileW SetFilePointer SetFileTime GetVersion GetTempFileNameW GetLocalTime UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent

user32

BringWindowToTop DefWindowProcW CallWindowProcW RegisterClassExW GetClassInfoExW CreateWindowExW DestroyWindow SetWindowLongW LoadCursorW MonitorFromPoint GetMessageW TranslateMessage DispatchMessageW IsChild UpdateLayeredWindow IsWindowVisible IsZoomed CharNextW GetKeyState SetCapture ReleaseCapture BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect MoveWindow GetCaretBlinkTime SetCaretPos ScreenToClient MapWindowPoints IntersectRect UnionRect IsRectEmpty GetParent GetClassNameW GetWindow MonitorFromWindow CharPrevW DrawTextW SetRect DrawIconEx RegisterClassW SetPropW GetPropW wvsprintfW SetCursor InflateRect OffsetRect RemovePropW IsIconic SetWindowRgn MessageBoxW GetMessagePos GetDlgCtrlID DrawFocusRect FillRect HideCaret ShowCaret ClientToScreen GetSysColor GetWindowDC GetWindowTextW GetWindowTextLengthW CreateAcceleratorTableW InvalidateRgn IsWindowEnabled ShowWindow AttachThreadInput PostMessageW UnregisterClassW CreateCaret GetForegroundWindow GetFocus FindWindowW SetActiveWindow EnableWindow KillTimer SetTimer PostQuitMessage BroadcastSystemMessageW RegisterWindowMessageW LoadIconW SendMessageW LoadImageW SystemParametersInfoW GetWindowLongW SetFocus SetWindowPos wsprintfW IsWindow EnumDisplayMonitors GetMonitorInfoW GetIconInfo DestroyIcon GetWindowThreadProcessId FindWindowExW PtInRect CopyRect GetCursorPos GetWindowRect SetWindowTextW ReleaseDC GetDC SetForegroundWindow

gdi32

GetTextMetricsW SetWindowOrgEx CombineRgn CreateRectRgnIndirect CreateRoundRectRgn GetCharABCWidthsW GetClipBox SelectClipRgn ExtSelectClipRgn SetBkColor SetBkMode SelectObject SetStretchBltMode SetTextColor CreateDIBSection SetDIBColorTable TextOutW ExtTextOutW CreateSolidBrush GetTextColor CreateDCW SetDIBitsToDevice DeleteObject GetDIBits GetObjectW GetTextExtentPoint32W GetDeviceCaps BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW CreatePen DeleteDC GetStockObject Rectangle RestoreDC SaveDC StretchBlt

advapi32

RegCloseKey RegSetValueExW RegCreateKeyW RegCreateKeyExW RegOpenKeyExW RegQueryValueExW OpenProcessToken OpenThreadToken AllocateAndInitializeSid EqualSid FreeSid GetTokenInformation RegGetValueW CloseServiceHandle OpenSCManagerW RegNotifyChangeKeyValue RegEnumKeyExW SetSecurityDescriptorDacl InitializeSecurityDescriptor QueryServiceStatus OpenServiceW

shell32

ShellExecuteExW ShellExecuteW SHFileOperationW SHGetFileInfoW SHCreateItemFromParsingName ord165 ord727 ord680 SHGetSpecialFolderPathW SHChangeNotify

ole32

OleUninitialize OleInitialize CoCreateInstance CoCreateGuid CoSetProxyBlanket CoInitializeSecurity OleLockRunning CLSIDFromProgID CLSIDFromString CoTaskMemFree CoUninitialize CoInitializeEx CoInitialize CreateStreamOnHGlobal

oleaut32

SysAllocString SysFreeString SysStringLen VariantClear VariantInit SafeArrayPutElement SafeArrayCreate SysAllocStringLen

shlwapi

PathFileExistsW PathCombineW PathAppendW StrFormatByteSizeA SHAutoComplete StrCmpNIW StrTrimA StrStrIW SHDeleteKeyW ord487 StrCmpIW StrStrIA PathRemoveFileSpecW wnsprintfW PathAddBackslashW PathFindExtensionW PathFindFileNameW PathIsDirectoryW SHCreateStreamOnFileEx StrFormatByteSizeW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

gdiplus

GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipGetImageEncodersSize GdipImageSelectActiveFrame GdiplusStartup GdiplusShutdown GdipImageGetFrameDimensionsCount GdipGetPropertyItemSize GdipGetPropertyItem GdipCreateBitmapFromScan0 GdipGetImageEncoders GdipDrawPath GdipLoadImageFromStreamICM GdipDrawImageRectI GdipGetImagePixelFormat GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipLoadImageFromFile GdipDrawEllipseI GdipCreatePath GdipDeletePath GdipAddPathLineI GdipAddPathArcI GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipSetPenDashStyle GdipCreateFromHDC GdipSaveImageToStream GdipSetSmoothingMode GdipDrawLineI GdipDrawRectangleI GdipDeleteGraphics GdipFillEllipseI GdipClosePathFigure GdipCreateTexture GdipSaveImageToFile GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateHBITMAPFromBitmap GdipCloneBitmapAreaI GdipBitmapLockBits GdipBitmapUnlockBits GdipSetInterpolationMode GdipGraphicsClear GdipFillPath GdipDrawImagePointsI GdipDrawImageRectRectI GdipAddPathArc

comctl32

ord17 InitCommonControlsEx ImageList_GetIconSize ImageList_DrawEx _TrackMouseEvent

msimg32

GradientFill AlphaBlend

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

generic

count=38, id=259, version=30795,

count=203, id=261, version=30795,

count=11, id=260, version=27054,

count=2, id=260, version=27034,

count=11, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=2, id=199, version=41118,

count=25, id=259, version=26706,

count=1, id=263, version=30795,

count=6, id=265, version=27054,

count=1, id=260, version=27050,

count=8, id=261, version=27050,

count=1, id=261, version=27051,

count=40, id=260, version=26706,

count=138, id=261, version=26706,

count=50, id=260, version=30795,

count=1, id=262, version=30795,

count=37, id=257, version=30795,

count=579, id=1, productName=Unmarked objects,

count=115, id=261, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,