2026-08-19_5c77a321307d81935b1d509d14566bf5_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_5c77a321307d81935b1d509d14566bf5_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat
Size 2.3MB
Sample260820-am2kascl31
SHA256 78affd6a92acc70cc4e57a8557a3d632a6999dd1acd4bc1a4e22ead972793775
MD5 5c77a321307d81935b1d509d14566bf5
SHA1 35a2404cbb98d255f45db5a464254ce03dc0e3f6
SHA512 beedf3b1b9288b7e12a4729b95efe296b7d81ef64271283e9924bb2b33a261a056c863c98f22b8648d4d82e586b5fee069dfdb3841a072237124b9f9ad0eb0a5
SSDEEP 49152:bj4zOzEBeP+YX3uWnVynR154gg4A+5jusAqhq:34wSYOuIR15zSs/q
TLSH
T12EB5BF22B971C23BD4A101B2567DBBBF559E7E38476815C3A3C82E7E59324C36B3211B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-19_5c77a321307d81935b1d509d14566bf5_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

.exe 2.3MB

2026-08-19_5c77a321307d81935b1d509d14566bf5_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

IMPHASH c3c8dfe4e2402af8f3ef275cd03790e2
SHA256 78affd6a92acc70cc4e57a8557a3d632a6999dd1acd4bc1a4e22ead972793775
MD5 5c77a321307d81935b1d509d14566bf5
SHA1 35a2404cbb98d255f45db5a464254ce03dc0e3f6
SHA512 beedf3b1b9288b7e12a4729b95efe296b7d81ef64271283e9924bb2b33a261a056c863c98f22b8648d4d82e586b5fee069dfdb3841a072237124b9f9ad0eb0a5
SSDEEP 49152:bj4zOzEBeP+YX3uWnVynR154gg4A+5jusAqhq:34wSYOuIR15zSs/q
TLSH
T12EB5BF22B971C23BD4A101B2567DBBBF559E7E38476815C3A3C82E7E59324C36B3211B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

23:91:f1:3f:8b:3e:cd:b2:14:c1:d0:90:c0:64:48:af:cc:b0:52:f3:3b:dc:79:ca:da:90:2d:3f:fa:3c:93:0b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=成都星汉云科科技有限公司,O=成都星汉云科科技有限公司,L=成都市,ST=四川省,C=CN

Chains

Jun 25, 2026

CN=成都星汉云科科技有限公司,O=成都星汉云科科技有限公司,L=成都市,ST=四川省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=成都星汉云科科技有限公司,O=成都星汉云科科技有限公司,L=成都市,ST=四川省,C=CN

Serial Number

01:cd:71:67:23:ee:3c:14:c3:36:fe:fa:6f:5a:b8:cb

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 28, 2025 - Apr 26, 2028

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

715002

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ProgramData\Jenkins\.jenkins\workspace\PCStore\PCStore_NewInstAndUnist\out\Uninst\uninst.pdb

kernel32

MoveFileExW GetLocalTime SystemTimeToFileTime FindClose FindNextFileW SetLastError GetFullPathNameW FindFirstFileW lstrlenW SetCurrentDirectoryW GetSystemDirectoryW GetCurrentDirectoryW GetModuleFileNameW GetCurrentProcess GetModuleHandleW InitializeCriticalSection MultiByteToWideChar WideCharToMultiByte LeaveCriticalSection EnterCriticalSection DeleteCriticalSection DecodePointer RaiseException GetLastError InitializeCriticalSectionEx lstrcmpiW OutputDebugStringW FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW HeapFree HeapReAlloc HeapSize HeapDestroy FreeLibrary EnumSystemLocalesW GetUserDefaultLCID LoadLibraryW GetProcAddress IsValidLocale ReadConsoleW IsDebuggerPresent FormatMessageW GetStringTypeW EncodePointer TryEnterCriticalSection GetCurrentThreadId InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo CreateFileW CloseHandle MulDiv ExitProcess FreeResource GetACP GetCurrentProcessId OpenProcess GetFileSize ReadFile lstrcmpW DeleteFileW SetEndOfFile SetFilePointer WriteFile CreateFileMappingW MapViewOfFile UnmapViewOfFile GetVersion GlobalAlloc GlobalUnlock GlobalLock GlobalFree GetTempFileNameW GetTempPathW WaitForSingleObject Sleep ResumeThread SetEvent ResetEvent IsBadReadPtr lstrcpynW lstrcpyW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW K32GetProcessImageFileNameW GetLogicalDriveStringsW QueryDosDeviceW CreateMutexW ExpandEnvironmentStringsW GetLongPathNameW GetEnvironmentVariableW LocalFree K32EnumProcesses TerminateProcess GetFileAttributesW SetFileAttributesW RemoveDirectoryW GetWindowsDirectoryW MoveFileW GetTempPathA GetTempFileNameA DeleteFileA CreateFileA WaitForSingleObjectEx IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead GetFileSizeEx FlushFileBuffers SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree DuplicateHandle ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateTimerQueue FindFirstFileA FindNextFileA CreateFileMappingA GetSystemWindowsDirectoryW DeviceIoControl lstrcmpA GetStdHandle GetConsoleMode WriteConsoleW RtlUnwind ExitThread GetModuleHandleExW GetTimeZoneInformation GetFileType GetConsoleOutputCP SetFilePointerEx SetStdHandle

user32

GetParent GetClassNameW GetWindow MonitorFromWindow IsIconic SetWindowRgn MessageBoxW GetMonitorInfoW wsprintfW DefWindowProcW CallWindowProcW RegisterClassW RegisterClassExW GetClassInfoExW EnableWindow SetPropW GetPropW LoadCursorW LoadImageW SystemParametersInfoW wvsprintfW SetCursor InflateRect OffsetRect MonitorFromPoint CharPrevW DrawTextW SetRect DestroyIcon SetWindowLongW GetIconInfo GetMessagePos MoveWindow GetDlgCtrlID DrawFocusRect FillRect HideCaret ShowCaret ClientToScreen GetSysColor GetWindowDC GetWindowTextW GetWindowTextLengthW CreateAcceleratorTableW InvalidateRgn RemovePropW FindWindowExW IsWindowEnabled GetWindowLongW PtInRect IsRectEmpty UnionRect IntersectRect MapWindowPoints ScreenToClient SetCaretPos GetCaretBlinkTime CreateCaret GetCursorPos GetWindowRect IsWindow IsChild GetClientRect InvalidateRect GetUpdateRect EndPaint BeginPaint RegisterWindowMessageW PostMessageW SetForegroundWindow ShowWindow ReleaseDC GetDC KillTimer SetTimer ReleaseCapture SetCapture GetKeyState GetFocus SetFocus IsWindowVisible SetWindowPos PostQuitMessage SetWindowTextW GetMessageW TranslateMessage CharNextW IsZoomed UpdateLayeredWindow DestroyWindow DrawIconEx DispatchMessageW SendMessageW CreateWindowExW

advapi32

OpenSCManagerW RegCreateKeyW RegCreateKeyExW OpenServiceW ControlService DeleteService CloseServiceHandle OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges GetTokenInformation RegEnumKeyExW RegDeleteValueW RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

SHGetSpecialFolderPathW SHFileOperationW SHGetKnownFolderPath ShellExecuteW SHChangeNotify ord165

ole32

CLSIDFromProgID CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoTaskMemFree OleLockRunning CLSIDFromString CoCreateGuid CreateStreamOnHGlobal CoInitialize CoCreateInstance CoUninitialize

oleaut32

SysStringLen SysAllocStringLen SafeArrayCreate SysAllocString SysFreeString VariantInit VariantClear SafeArrayPutElement

shlwapi

PathFileExistsW PathRemoveFileSpecW PathAppendW PathCombineW StrCmpIW StrStrIA StrTrimA StrCmpNIW StrStrIW PathFindFileNameW SHAutoComplete wnsprintfW SHGetValueW SHSetValueW SHDeleteKeyW PathFindFileNameA SHSetValueA PathRenameExtensionA

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

comctl32

_TrackMouseEvent ord17 InitCommonControlsEx ImageList_GetIconSize ImageList_DrawEx

msimg32

AlphaBlend GradientFill

gdiplus

GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipSetPenDashStyle GdipCreateFromHDC GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipDeleteGraphics GdipSetSmoothingMode GdipDrawLineI GdipDrawRectangleI GdipAddPathArcI GdipFillEllipseI GdipClosePathFigure GdipCreateTexture GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipAddPathLineI GdipCreateBitmapFromScan0 GdipAlloc GdipFree GdipCreatePath GdipCreateHBITMAPFromBitmap GdipGetPropertyItemSize GdipGetPropertyItem GdiplusStartup GdiplusShutdown GdipCloneBitmapAreaI GdipDrawPath GdipDeletePath GdipBitmapLockBits GdipBitmapUnlockBits GdipFillPath GdipDrawImagePointsI GdipDrawImageRectRectI GdipGetImageEncodersSize GdipGetImageEncoders GdipAddPathArc GdipDrawEllipseI GdipLoadImageFromFile GdipGetImagePixelFormat GdipDrawImageRectI GdipLoadImageFromStreamICM GdipSetInterpolationMode GdipGraphicsClear

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

gdi32

StretchBlt SetTextColor SetBkMode SetBkColor ExtSelectClipRgn SelectClipRgn GetTextExtentPoint32W GetClipBox GetCharABCWidthsW CreateRectRgnIndirect CombineRgn GetDeviceCaps CreateDIBSection SetWindowOrgEx GetObjectW GetTextMetricsW SelectObject SaveDC RestoreDC Rectangle GetStockObject DeleteObject DeleteDC CreatePen CreateFontIndirectW SetDIBColorTable CreateCompatibleDC CreateCompatibleBitmap TextOutW ExtTextOutW CreateSolidBrush GetTextColor SetStretchBltMode BitBlt SetDIBitsToDevice GetDIBits CreateRoundRectRgn CreateDCW

generic

count=37, id=259, version=30795,

count=211, id=261, version=30795,

count=11, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=2, id=260, version=27034,

count=11, id=260, version=27054,

count=1, id=260, version=27050,

count=5, id=261, version=27050,

count=3, id=199, version=41118,

count=25, id=259, version=26706,

count=1, id=262, version=30795,

count=83, id=261, version=27054,

count=40, id=260, version=26706,

count=137, id=261, version=26706,

count=49, id=260, version=30795,

count=37, id=257, version=30795,

count=562, id=1, productName=Unmarked objects,

count=48, id=265, version=27054,

count=1, id=256, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,