2026-08-20_ccbe569177ea46a52d9cefd9c0176e3d_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_ccbe569177ea46a52d9cefd9c0176e3d_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_medusalocker_njrat
Size 4.8MB
Sample260820-klghvawsgx
SHA256 de9d38621325149e19f5ccb54b5397d6ee36f4addc9dcc0118df5f9ee0670327
MD5 ccbe569177ea46a52d9cefd9c0176e3d
SHA1 387292294a39637c86be387b08eb3dfb1e39138c
SHA512 f1cb62947d5b5993c496acf744cf7c939a8c39c5fabd1427b280c9e453f7f2d8cd32379d62b2d0a2cc8c18606dc03415fbf63caa551b6a46370b84df78e60b2e
SSDEEP 98304:4LvRp0uW/PUl2JsAqILzdn/8ddexmRZKaFSwZCAbK:SvRQ/PUYJsAqILVMLlbK
TLSH
T1593608127389CE2BE19141B1352CE6AA0059B9320B7688CBF3C10F6F65B1ADF5676F17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-20_ccbe569177ea46a52d9cefd9c0176e3d_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_medusalocker_njrat

File Explorer

2026-08-20_ccbe569177ea46a52d9cefd9c0176e3d_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_medusalocker_njrat

.exe 4.8MB

2026-08-20_ccbe569177ea46a52d9cefd9c0176e3d_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_medusalocker_njrat

IMPHASH 07f86eeaa63806629cfe6686313ed415
SHA256 de9d38621325149e19f5ccb54b5397d6ee36f4addc9dcc0118df5f9ee0670327
MD5 ccbe569177ea46a52d9cefd9c0176e3d
SHA1 387292294a39637c86be387b08eb3dfb1e39138c
SHA512 f1cb62947d5b5993c496acf744cf7c939a8c39c5fabd1427b280c9e453f7f2d8cd32379d62b2d0a2cc8c18606dc03415fbf63caa551b6a46370b84df78e60b2e
SSDEEP 98304:4LvRp0uW/PUl2JsAqILzdn/8ddexmRZKaFSwZCAbK:SvRQ/PUYJsAqILVMLlbK
TLSH
T1593608127389CE2BE19141B1352CE6AA0059B9320B7688CBF3C10F6F65B1ADF5676F17
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

98:07:b2:2d:4e:36:b1:1c:18:db:6d:90:2b:05:25:ab:d3:16:10:1a:5a:f7:63:11:a3:fb:c1:dc:7c:d2:83:07

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 8, 2024

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

0b:be:02:c8:83:8f:bf:02:ab:56:ed:ab:b1:e3:4c:19

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2021 - Oct 22, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

3200429

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\AURAServiceSetup\Release\LightingService.pdb

powrprof

CallNtPowerInformation

avrt

AvSetMmThreadCharacteristicsW AvRevertMmThreadCharacteristics

winmm

timeKillEvent timeGetDevCaps timeSetEvent timeEndPeriod timeBeginPeriod

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

kernel32

FlushFileBuffers ReadFile WriteFile PeekNamedPipe DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection GetCurrentDirectoryW CreateThread SetThreadPriority TerminateThread GetExitCodeThread ResumeThread GetCurrentProcessId GetCurrentThreadId GetCommandLineW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleHandleW LoadLibraryExW LoadResource SizeofResource FindResourceW SetDllDirectoryW GetEnvironmentVariableW HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap LocalFree FormatMessageW GetPrivateProfileStringW GetPrivateProfileSectionNamesW CreateDirectoryW GetFileAttributesW GetFileSize LocalAlloc lstrcmpW GetSystemTimes FormatMessageA GetWindowsDirectoryW FindResourceExW LockResource SetThreadExecutionState GetFileAttributesExW WritePrivateProfileStringW SetWaitableTimer CancelWaitableTimer WaitForMultipleObjects CreateWaitableTimerW DeleteFileW RemoveDirectoryW SetEnvironmentVariableW GetFullPathNameW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileType GetDriveTypeW VirtualQuery GetModuleHandleExW ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualProtect VirtualAlloc GetVersionExW OutputDebugStringW GetTickCount64 QueryPerformanceFrequency QueryPerformanceCounter GetModuleFileNameA CreateEventW ResetEvent SetEvent lstrcmpiW SetThreadAffinityMask GetCurrentThread TerminateProcess GetLastError DuplicateHandle WaitForSingleObject CloseHandle GetModuleFileNameW FreeLibrary WideCharToMultiByte MultiByteToWideChar GetModuleHandleA GetTickCount GetSystemInfo GetCurrentProcess OutputDebugStringA LoadLibraryW GetProcAddress Sleep ExitProcess GetStdHandle GetFileSizeEx GetConsoleMode ReadConsoleW GetDateFormatW FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SignalObjectAndWait CreateTimerQueue InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError EncodePointer AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive SwitchToThread WaitForSingleObjectEx GetStringTypeW AreFileApisANSI SetFilePointerEx SetEndOfFile GetFileInformationByHandle FindNextFileW FindFirstFileExW FindClose TryEnterCriticalSection CreateFileW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP SetStdHandle GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW

user32

DestroyWindow DispatchMessageW RegisterPowerSettingNotification PostThreadMessageW DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW ShowWindow CharUpperW CharNextW UpdateWindow MessageBoxW LoadCursorW LoadIconW RegisterDeviceNotificationW UnregisterDeviceNotification GetMessageW wsprintfW LoadStringW MessageBoxA TranslateMessage

gdi32

DeleteObject GetObjectW

advapi32

RegisterServiceCtrlHandlerW InitializeSecurityDescriptor SetSecurityDescriptorDacl SetNamedSecurityInfoW RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryInfoKeyA RegQueryInfoKeyW RegQueryValueExA RegQueryValueExW RegSetValueExW BuildTrusteeWithSidW GetNamedSecurityInfoW GetAce FreeSid EqualSid DeleteAce AllocateAndInitializeSid CreateProcessAsUserW RegEnumValueW StartServiceW StartServiceCtrlDispatcherW SetServiceStatus OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfigW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW ReportEventW RegisterEventSourceW DeregisterEventSource RegCreateKeyExW RegOpenKeyExW

ole32

CoRevokeClassObject CoResumeClassObjects CoReleaseServerProcess CoRegisterClassObject CoUninitialize CoInitializeEx CLSIDFromProgID CoInitializeSecurity StringFromGUID2 CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoSetProxyBlanket StringFromCLSID CLSIDFromString CoCreateInstance PropVariantClear CoAddRefServerProcess

oleaut32

SysAllocString VarUI4FromStr LoadTypeLi LoadRegTypeLi RegisterTypeLi GetErrorInfo UnRegisterTypeLi VariantInit SysStringByteLen SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetElement SysFreeString SysAllocStringLen VariantClear SysStringLen

ws2_32

WSAStartup WSACleanup inet_pton setsockopt htonl inet_addr socket send recv htons connect closesocket WSAGetLastError

crypt32

CryptMsgClose CryptMsgGetParam CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CryptQueryObject CertGetNameStringW

shlwapi

PathFileExistsW StrCpyNW PathFileExistsA

pdh

PdhCloseQuery PdhGetFormattedCounterValue PdhOpenQueryW PdhAddEnglishCounterW PdhCollectQueryData

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_ccbe569177ea46a52d9cefd9c0176e3d_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_medusalocker_njrat

PE Signature issue

powrprof

avrt

winmm

wtsapi32

userenv

kernel32

user32

gdi32

advapi32

ole32

oleaut32

ws2_32

crypt32

shlwapi

pdh

wintrust

generic