2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat

General

Target
2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat
Size 1.8MB
Sample260910-fdhzgsgl3s
SHA256 876291307db72e7cc73acab3208ccf5b9edec8ac21f600ff6d177506fecd0e83
MD5 78dd3049fa7e4a7e4e039828076a6e1c
SHA1 230511f1742a209e09113aee8353b00e335f6ec9
SHA512 4730c52f36afd85a9e65616448abebc7b115fb523e621832f7e4c43063d9b81fc790bb76bf0ce0b2378bc654657be4fef0b31440be098b4a271b5a31e625cdbf
SSDEEP 24576:t8/7eWQerJ2PHog66Tyxknw4FYnshx8OfVe247:i/7eWQerQPH16Jx4x8EVep
TLSH
T12595F12075B1C072E56151720E79EB65927EF8344F3201DBB3E86B3EAA305D26736E27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat

File Explorer

2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat

.exe 1.8MB

2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat

IMPHASH f764bdfe32c5ac5f089f3f6eab4d01ab
SHA256 876291307db72e7cc73acab3208ccf5b9edec8ac21f600ff6d177506fecd0e83
MD5 78dd3049fa7e4a7e4e039828076a6e1c
SHA1 230511f1742a209e09113aee8353b00e335f6ec9
SHA512 4730c52f36afd85a9e65616448abebc7b115fb523e621832f7e4c43063d9b81fc790bb76bf0ce0b2378bc654657be4fef0b31440be098b4a271b5a31e625cdbf
SSDEEP 24576:t8/7eWQerJ2PHog66Tyxknw4FYnshx8OfVe247:i/7eWQerQPH16Jx4x8EVep
TLSH
T12595F12075B1C072E56151720E79EB65927EF8344F3201DBB3E86B3EAA305D26736E27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

201832

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\workspace\repo\bongiovi\Motherboard\MotherboardSolutions\InstallerAsus\Includes\x86Includes\BongioviBinaryDeleter.pdb

kernel32

CloseHandle GetNativeSystemInfo RaiseException HeapAlloc DecodePointer HeapReAlloc DeleteCriticalSection GetProcessHeap GetModuleHandleW GetExitCodeProcess SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetLastError Wow64RevertWow64FsRedirection HeapSize WaitForSingleObject InitializeCriticalSectionEx Wow64DisableWow64FsRedirection GetCurrentProcess GetProcAddress HeapFree GetEnvironmentStringsW GetOEMCP MultiByteToWideChar LocalFree FormatMessageA GetStringTypeW CreateDirectoryW CreateFileW FindClose FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW SetEndOfFile SetFileInformationByHandle SetFilePointerEx GetTempPathW GetFileInformationByHandleEx WideCharToMultiByte QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetSystemTimeAsFileTime GetLocaleInfoEx CompareStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW InitializeCriticalSectionAndSpinCount CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetFileSizeEx GetFileType GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP GetConsoleMode CreateProcessW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW IsValidCodePage GetACP WriteConsoleW

advapi32

RegDeleteKeyW RegEnumKeyExW OpenProcessToken RegOpenKeyExW RegDeleteValueW RegQueryValueExW GetTokenInformation RegCloseKey

shell32

ShellExecuteExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat

kernel32

advapi32

shell32

generic