2026-09-04_4ad0a268a7c79b33264a1681bb33ef1c_amadey_darkgate_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_4ad0a268a7c79b33264a1681bb33ef1c_amadey_darkgate_elex_luca-stealer_lynx_njrat
Size 2.5MB
Sample260905-nvbkqsde82
SHA256 f47722ceeba6cc96ac660f06054ba92b7f910c888cf4b2e2a3221582a46aa82d
MD5 4ad0a268a7c79b33264a1681bb33ef1c
SHA1 85ce47353fcb99538393eb0b61250a7c7386e333
SHA512 2e956e9bf9e441cb071a7a2aaab4e3b633678d37d0554c9e026d3cc7a049bc6ef110a698964bd1bd1218c14e4db6557802c5fa92432ecd86babeb825b7ec2782
SSDEEP 24576:zkFGf7uZ8anAtmDs5i/41Oop2FrkAwkxUzzAkkcpmh6KXsTz2c2REIHpFFD4bFij:LUkkcvDbO5BD/T2mwkfJ4klKXnq
TLSH
T1F3C5AD25F6C6C0F5D8D321B2CDAA77F698283E058B254CDF9E803D59B9311C23639A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_4ad0a268a7c79b33264a1681bb33ef1c_amadey_darkgate_elex_luca-stealer_lynx_njrat

File Explorer

2026-09-04_4ad0a268a7c79b33264a1681bb33ef1c_amadey_darkgate_elex_luca-stealer_lynx_njrat

.exe 2.5MB

2026-09-04_4ad0a268a7c79b33264a1681bb33ef1c_amadey_darkgate_elex_luca-stealer_lynx_njrat

IMPHASH c8ba733f9f36213fbcdaba921c1dc309
SHA256 f47722ceeba6cc96ac660f06054ba92b7f910c888cf4b2e2a3221582a46aa82d
MD5 4ad0a268a7c79b33264a1681bb33ef1c
SHA1 85ce47353fcb99538393eb0b61250a7c7386e333
SHA512 2e956e9bf9e441cb071a7a2aaab4e3b633678d37d0554c9e026d3cc7a049bc6ef110a698964bd1bd1218c14e4db6557802c5fa92432ecd86babeb825b7ec2782
SSDEEP 24576:zkFGf7uZ8anAtmDs5i/41Oop2FrkAwkxUzzAkkcpmh6KXsTz2c2REIHpFFD4bFij:LUkkcvDbO5BD/T2mwkfJ4klKXnq
TLSH
T1F3C5AD25F6C6C0F5D8D321B2CDAA77F698283E058B254CDF9E803D59B9311C23639A5E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

979040

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\ccd-hyperdrive\nightly\build\win32\build\msvs_win32_x86\Release\x86\sym\UpdateURIHandler\UpdateURIHandler\Adobe Update Helper.pdb

kernel32

GetCurrentProcess WaitForSingleObject GetProcAddress GetModuleHandleW GetVersionExW lstrcmpW MoveFileExW LocalFree CloseHandle DeleteFileW FormatMessageW ReadFile SetFileAttributesW GetFileAttributesW CreateFileW FindClose GetTempPathW GetModuleFileNameW RemoveDirectoryW FindNextFileW SetLastError FindFirstFileW DeleteCriticalSection DecodePointer GetLastError CreateProcessW InitializeCriticalSectionEx WriteConsoleW GetConsoleOutputCP SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetFilePointerEx ReadConsoleW GetConsoleMode SetStdHandle EnumSystemLocalesW IsValidLocale GetLocaleInfoW CompareStringW GetCommandLineW GetCommandLineA ExitProcess GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread GetTimeZoneInformation GetFileType LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind GetStartupInfoW InitializeSListHead FreeLibrary LoadLibraryA LCMapStringW GetUserDefaultLCID Sleep SizeofResource GetFullPathNameW WriteFile LockResource LoadResource FindResourceW GetFileSize FlushFileBuffers GetUserDefaultLangID GetUserDefaultUILanguage MultiByteToWideChar WideCharToMultiByte GetCurrentProcessId SetFilePointer GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetFileInformationByHandle HeapFree TerminateProcess OpenProcess HeapSize CreateEventW SetEvent GlobalAlloc GlobalFree HeapReAlloc CreateThread ResetEvent HeapAlloc HeapDestroy GetProcessHeap VerSetConditionMask VerifyVersionInfoW LoadLibraryW GetFileSizeEx FileTimeToSystemTime GetLocalTime GetTimeFormatW SystemTimeToFileTime GetDateFormatW CreateMutexW ReleaseMutex OpenMutexW AreFileApisANSI TryEnterCriticalSection HeapCreate GetDiskFreeSpaceW OutputDebugStringA LockFile GetFullPathNameA SetEndOfFile UnlockFileEx UnmapViewOfFile HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA WaitForSingleObjectEx DeleteFileA GetSystemInfo HeapCompact UnlockFile LockFileEx GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount GetStringTypeW EncodePointer LCMapStringEx GetCPInfo IsDebuggerPresent RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount

user32

EnumWindows MessageBoxW AllowSetForegroundWindow GetWindowThreadProcessId GetShellWindow

advapi32

EqualSid RegQueryValueExW RegOpenKeyExW RegCloseKey DuplicateTokenEx FreeSid AllocateAndInitializeSid AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken GetTokenInformation

shell32

SHGetPathFromIDListW SHGetFolderPathW SHCreateDirectoryExW SHGetFolderLocation SHGetSpecialFolderPathW

ole32

CoCreateInstance StringFromGUID2 CLSIDFromProgID OleRun CoCreateGuid CoTaskMemFree CoInitialize CLSIDFromString CoUninitialize

oleaut32

SysStringLen SysFreeString SysAllocString GetErrorInfo VariantClear

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

wininet

InternetCanonicalizeUrlW

shlwapi

PathIsDirectoryW PathFindFileNameW PathFileExistsW PathIsRootW PathAppendW PathRenameExtensionW PathRemoveFileSpecW PathFileExistsA PathRemoveExtensionW PathAddExtensionW PathIsFileSpecW PathIsSystemFolderW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_4ad0a268a7c79b33264a1681bb33ef1c_amadey_darkgate_elex_luca-stealer_lynx_njrat

kernel32

user32

advapi32

shell32

ole32

oleaut32

version

wininet

shlwapi

generic