2026-09-06_0ca43116bd5b5f697da60fef2fe398e0_amadey_darkgate_elex_luca-stealer_lynx_njrat_qakbot_redline-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-06_0ca43116bd5b5f697da60fef2fe398e0_amadey_darkgate_elex_luca-stealer_lynx_njrat_qakbot_redline-stealer
Size 10.5MB
Sample260907-j11dtsff95
SHA256 3109a6fc5886fa51b98dc8e49db25f16c806b1e0cd3e11e15a7bb6ff60e4c2a1
MD5 0ca43116bd5b5f697da60fef2fe398e0
SHA1 2a76c494105ab2d77bd793e93813c48e584a0343
SHA512 74bfa9791de7b044e9b20ad5e99d5b985ac642e6776e3ba333f0913526455242d4c715356839b9899f760b50863763c7402543e4cd197cb75b3cc4070e0d1a1b
SSDEEP 196608:D8aG43mq3m+f9JzkEwITVd2SXVJJSoXzKeEMwpf7Auv6CsgvczNiTEM:D8aG43t3P9J4JwzFlJXKeEJ7gCsgmNi7
TLSH
T10BB6F120B181F321C12E1176085FBFB051677EE25AB85BB7A6E07FDD2A3199149332F6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-06_0ca43116bd5b5f697da60fef2fe398e0_amadey_darkgate_elex_luca-stealer_lynx_njrat_qakbot_redline-stealer

File Explorer

2026-09-06_0ca43116bd5b5f697da60fef2fe398e0_amadey_darkgate_elex_luca-stealer_lynx_njrat_qakbot_redline-stealer

.exe 10.5MB

2026-09-06_0ca43116bd5b5f697da60fef2fe398e0_amadey_darkgate_elex_luca-stealer_lynx_njrat_qakbot_redline-stealer

IMPHASH 465a436d5c4fb66c19e5a31aef40cde7
SHA256 3109a6fc5886fa51b98dc8e49db25f16c806b1e0cd3e11e15a7bb6ff60e4c2a1
MD5 0ca43116bd5b5f697da60fef2fe398e0
SHA1 2a76c494105ab2d77bd793e93813c48e584a0343
SHA512 74bfa9791de7b044e9b20ad5e99d5b985ac642e6776e3ba333f0913526455242d4c715356839b9899f760b50863763c7402543e4cd197cb75b3cc4070e0d1a1b
SSDEEP 196608:D8aG43mq3m+f9JzkEwITVd2SXVJJSoXzKeEMwpf7Auv6CsgvczNiTEM:D8aG43t3P9J4JwzFlJXKeEJ7gCsgmNi7
TLSH
T10BB6F120B181F321C12E1176085FBFB051677EE25AB85BB7A6E07FDD2A3199149332F6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

706379

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\work\kv_svn\Presenter-Windows\branches\PresenterC\Bin\Release\NorwiiPresenter.pdb

hiddevice

SetPathKeyword UsbDeviceChange GetConnectDevices CloseDevicePath hid_close InitHidDevice GetDeviceInfoEx SendHidCommand OpenDevicePath EnumeratePaths hid_read_timeout hid_open_path hid_write GetSpecialInfo

libcurl

curl_formadd curl_slist_free_all curl_easy_init curl_easy_setopt curl_formfree curl_global_init curl_easy_cleanup curl_slist_append curl_easy_strerror curl_easy_perform curl_global_cleanup

kernel32

FindClose GetFileAttributesW DeleteFileW CreateEventW SetEvent ResetEvent WriteConsoleW HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW FlushFileBuffers ReadConsoleW HeapReAlloc SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapFree HeapAlloc FindNextFileW GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW RaiseException RtlUnwind InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent WaitForSingleObjectEx IsProcessorFeaturePresent UnhandledExceptionFilter GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError GetCPInfo DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection FindFirstFileW RemoveDirectoryW TerminateThread InitializeCriticalSectionAndSpinCount GetStdHandle InterlockedDecrement CreateMutexW WaitForSingleObject ReleaseMutex CloseHandle lstrlenW Sleep WriteFile CreateFileW GlobalAlloc GlobalFree GlobalLock GlobalUnlock OutputDebugStringA OutputDebugStringW GetLocalTime GetLastError SizeofResource GetCurrentProcess TerminateProcess GetModuleFileNameW GetUserDefaultUILanguage GetEnvironmentVariableW OpenProcess CreateToolhelp32Snapshot Process32NextW FileTimeToSystemTime Process32FirstW LoadResource FindResourceW SystemTimeToFileTime GetTickCount64 CreateProcessW GetModuleHandleW lstrcpyW LoadLibraryW GetProcAddress FreeLibrary CreateFileA CancelIoEx GetCurrentThreadId GetCurrentProcessId SetUnhandledExceptionFilter GetTickCount GetCurrentDirectoryW GetACP MultiByteToWideChar FreeResource LockResource ExitProcess GetFileSize InterlockedIncrement WideCharToMultiByte CreateDirectoryW DosDateTimeToFileTime DuplicateHandle SetFileTime SetFilePointer GetFileType GetVersionExW MulDiv ReadFile SetEndOfFile

user32

SetPropW GetMenu EnableWindow GetClassInfoExW OffsetRect SetCursor wvsprintfW GetWindow PtInRect IsRectEmpty UnionRect IntersectRect MapWindowPoints GetUpdateRect ReleaseCapture GetPropW GetActiveWindow SetFocus IsZoomed IsIconic IsWindowVisible DispatchMessageW TranslateMessage GetMessageW SetWindowTextW CallNextHookEx GetAsyncKeyState UnhookWindowsHookEx SetWindowsHookExW CreatePopupMenu GetSysColor SystemParametersInfoW GetClientRect AdjustWindowRectEx MonitorFromWindow CharPrevW SetRect MonitorFromPoint SetCapture SetWindowLongW wsprintfW SendMessageW SetWindowPos PostMessageW GetWindowLongW UpdateWindow LoadCursorW GetForegroundWindow CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo MsgWaitForMultipleObjects GetCaretBlinkTime RegisterClassW ShowWindow CreateWindowExW GetDC DestroyWindow DefWindowProcW GetWindowTextW EndPaint BeginPaint InvalidateRect DrawTextW TrackMouseEvent GetSystemMetrics FillRect CallWindowProcW CharNextW GetCursorPos SetCursorPos mouse_event keybd_event GetKeyState KillTimer SetTimer ReleaseDC GetDesktopWindow SetClipboardData EmptyClipboard CloseClipboard OpenClipboard EnumDisplaySettingsW EnumDisplayDevicesW GetMonitorInfoW EnumDisplayMonitors SetForegroundWindow FindWindowW IsWindow GetWindowRect FindWindowExW ClientToScreen GetParent GetFocus ShowCaret MessageBoxW UpdateLayeredWindow MoveWindow CreateDialogParamW SetClassLongW DestroyCursor GetDlgItem ScreenToClient SetWindowRgn SetLayeredWindowAttributes RegisterClassExW AttachThreadInput AllowSetForegroundWindow GetWindowThreadProcessId PostQuitMessage AppendMenuW LoadIconW RegisterDeviceNotificationW TrackPopupMenu GetWindowTextLengthW GetCaretPos CreateCaret HideCaret SetCaretPos

gdi32

CreateDCW CreateDIBSection GetPixel Ellipse GetDIBits GetDeviceCaps GetObjectW DeleteObject CreateFontW SetBkMode SetBkColor CreateSolidBrush BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC GetStockObject GetTextExtentPoint32W CreateFontIndirectW CreatePatternBrush GetObjectA GdiFlush ExtTextOutW TextOutW MoveToEx SetStretchBltMode StretchBlt ExtSelectClipRgn SelectClipRgn RoundRect LineTo GetClipBox GetCharABCWidthsW CreateRectRgnIndirect CreatePenIndirect CombineRgn CreateRoundRectRgn SetWindowOrgEx GetTextMetricsW SaveDC RestoreDC Rectangle CreatePen SetTextColor DeleteDC

comdlg32

GetOpenFileNameW

advapi32

RegCreateKeyExW RegQueryValueExW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegCloseKey

shell32

ShellExecuteExW Shell_NotifyIconW SHGetSpecialFolderPathW SHCreateDirectoryExW ShellExecuteW CommandLineToArgvW

ole32

CreateStreamOnHGlobal CoUninitialize CoCreateGuid CoInitialize CLSIDFromProgID CoCreateInstance CLSIDFromString OleLockRunning

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

gdiplus

GdipDrawImageRectI GdipSetCompositingQuality GdipSetPixelOffsetMode GdipCreateFromHDC GdipDeleteGraphics GdipSetCompositingMode GdipSetSmoothingMode GdipSetInterpolationMode GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipDeleteStringFormat GdipDrawImageRectRectI GdipGetImageWidth GdipCreateStringFormat GdipDrawString GdipGetFamily GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDeleteFontFamily GdipDrawImage GdipGraphicsClear GdipSetTextRenderingHint GdipCreateLineBrushI GdiplusShutdown GdiplusStartup GdipBitmapUnlockBits GdipLoadImageFromFile GdipImageGetFrameDimensionsCount GdipGetPropertyItem GdipImageSelectActiveFrame GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipGetPropertyItemSize GdipSetClipPath GdipCreateSolidFill GdipFillEllipseI GdipCreateBitmapFromHBITMAP GdipDrawLineI GdipCloneImage GdipAddPathEllipseI GdipDeleteBrush GdipDrawEllipseI GdipAlloc GdipDeletePath GdipDisposeImage GdipCreatePath GdipFillPath GdipGetSmoothingMode GdipFree GdipCreateTexture GdipCloneBrush GdipGetImageGraphicsContext GdipDeletePen GdipCreateBitmapFromScan0 GdipCreatePen1 GdipGetImageHeight GdipBitmapLockBits

winmm

mciSendStringW

setupapi

SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInfo SetupDiGetClassDevsA

hid

HidD_FreePreparsedData HidD_GetPreparsedData HidP_GetCaps HidD_SetOutputReport HidD_GetInputReport

imm32

ImmSetCompositionWindow ImmSetCompositionFontW ImmGetContext ImmReleaseContext

comctl32

_TrackMouseEvent ord17

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-06_0ca43116bd5b5f697da60fef2fe398e0_amadey_darkgate_elex_luca-stealer_lynx_njrat_qakbot_redline-stealer

hiddevice

libcurl

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

gdiplus

winmm

setupapi

hid

imm32

comctl32

generic