2026-09-16_51996d98c5b3d905315c02d5512775de_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_51996d98c5b3d905315c02d5512775de_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat
Size 4.2MB
Sample260916-1hpcaazz5r
SHA256 90667d191918f98734b59a4a72568d608d522b17cbb34cf47f0d4e2d3b0db381
MD5 51996d98c5b3d905315c02d5512775de
SHA1 53ca29430255e52858899857e5c18a7de3459bc9
SHA512 8a6ba10260e7264e1951c11d74e7e436219e6d24c6f36db0e41068561dd9e37da11fa1da7ddad51db2ce75a829a03954ae0b34b458d1df4a7283b988d7858aea
SSDEEP 49152:Im4PRZ0sPUyWzt5YxFUAfuLePAEvvQxruk660JVB4jDmg27RnWGj:wRFUfzt5YxFU1LePDvolkCD527BWG
TLSH
T152169EA0364AC132D55651795DBEBFBEC86DA96A0F7190C7A2C58D2E38201C32F35F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_51996d98c5b3d905315c02d5512775de_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

File Explorer

2026-09-16_51996d98c5b3d905315c02d5512775de_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

.exe 4.2MB

2026-09-16_51996d98c5b3d905315c02d5512775de_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

IMPHASH 56d4a3b3c43b174475b4fdfc5e20af9b
SHA256 90667d191918f98734b59a4a72568d608d522b17cbb34cf47f0d4e2d3b0db381
MD5 51996d98c5b3d905315c02d5512775de
SHA1 53ca29430255e52858899857e5c18a7de3459bc9
SHA512 8a6ba10260e7264e1951c11d74e7e436219e6d24c6f36db0e41068561dd9e37da11fa1da7ddad51db2ce75a829a03954ae0b34b458d1df4a7283b988d7858aea
SSDEEP 49152:Im4PRZ0sPUyWzt5YxFUAfuLePAEvvQxruk660JVB4jDmg27RnWGj:wRFUfzt5YxFU1LePDvolkCD527BWG
TLSH
T152169EA0364AC132D55651795DBEBFBEC86DA96A0F7190C7A2C58D2E38201C32F35F1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1986688

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\buildagent-cd_8818\p4\987899998\services\AMTSW\Release\UNS\Release\lms.pdb

kernel32

GetCommandLineA FreeEnvironmentStringsW lstrcmpiW FindResourceW SizeofResource WriteConsoleW LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW SetEnvironmentVariableW SetStdHandle GetModuleFileNameW FreeLibrary LocalAlloc LocalFree FormatMessageW GetCurrentThreadId GetFullPathNameW FreeLibraryAndExitThread ExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW VirtualQuery VirtualProtect GetCurrentThread VirtualAlloc GetModuleHandleExW RtlUnwind GetCurrentDirectoryW SetConsoleCtrlHandler GetConsoleMode ReadConsoleW GetConsoleOutputCP HeapSize HeapReAlloc GetDateFormatW GetOEMCP GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage FindFirstFileExW OutputDebugStringW GetStartupInfoW CreateThread InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo LCMapStringEx EncodePointer WaitForSingleObjectEx GetStringTypeW AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock ExpandEnvironmentStringsW GetComputerNameExW WideCharToMultiByte CreateFileW GetFinalPathNameByHandleW LoadLibraryW GetCurrentProcess CreateEventW WaitForSingleObject lstrlenW SetEvent DeleteCriticalSection InitializeCriticalSectionEx IsWow64Process OutputDebugStringA GetSystemPowerStatus GetACP GetCurrentProcessId LeaveCriticalSection EnterCriticalSection GetLastError GetFileInformationByHandle WaitForMultipleObjectsEx HeapAlloc HeapFree GetProcessHeap GetSystemDefaultLCID GetSystemTime QueryPerformanceFrequency GetFileSizeEx CreateFileA CancelIoEx WaitForMultipleObjects ReadFile WriteFile DeviceIoControl GetOverlappedResult InitializeCriticalSectionAndSpinCount MultiByteToWideChar GetTimeZoneInformation QueryPerformanceCounter SetLastError InitializeCriticalSection TryEnterCriticalSection SetThreadPriority ResumeThread GetComputerNameA GetSystemInfo DuplicateHandle TlsAlloc TlsGetValue TlsSetValue TlsFree RegisterWaitForSingleObject UnregisterWait TerminateProcess GetStdHandle RaiseException CloseHandle DecodePointer GetCommandLineW GetSystemTimeAsFileTime ResetEvent ReleaseSemaphore ReleaseMutex CreateMutexW CreateEventA CreateSemaphoreW GetExitCodeThread SuspendThread GetThreadId FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetEnvironmentStringsW ExitProcess GetVersionExW LockFileEx SetFilePointerEx UnlockFileEx SetDllDirectoryW IsDebuggerPresent Sleep GlobalAlloc GlobalFree FlushFileBuffers SetEndOfFile SetFilePointer LoadLibraryExA

advapi32

RegCreateKeyW InitiateSystemShutdownExW LookupPrivilegeValueW AdjustTokenPrivileges SetEntriesInAclW RegSetKeySecurity RegDeleteKeyExW SetSecurityDescriptorDacl FreeSid AllocateAndInitializeSid ConvertSidToStringSidW LookupAccountSidW OpenProcessToken OpenThreadToken EqualSid CreateWellKnownSid StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW OpenServiceW OpenSCManagerW DeleteService CreateServiceW CopySid GetLengthSid GetTokenInformation InitializeSecurityDescriptor IsValidSid SetSecurityDescriptorGroup SetSecurityDescriptorOwner ControlService DeregisterEventSource RegisterEventSourceW ReportEventW CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey

user32

GetMessageW LoadStringW RegisterDeviceNotificationW UnregisterDeviceNotification PostThreadMessageW DispatchMessageW TranslateMessage MessageBoxW CharUpperW CharNextW

ole32

CoCreateInstance StringFromGUID2 CoTaskMemAlloc CoInitializeEx CoTaskMemFree CoImpersonateClient CoRevertToSelf CoUninitialize CoRegisterClassObject CoRevokeClassObject CoResumeClassObjects CoAddRefServerProcess CoReleaseServerProcess CoTaskMemRealloc CoSetProxyBlanket CoInitializeSecurity

oleaut32

SafeArrayDestroy VarBstrCat SysAllocStringByteLen SafeArrayLock SafeArrayPutElement SafeArrayCreateVector SysAllocString SysFreeString SysStringLen VarUI4FromStr LoadTypeLi RegisterTypeLi UnRegisterTypeLi SysAllocStringLen LoadRegTypeLi VariantClear VariantInit SafeArrayCreate SafeArrayGetLBound SysStringByteLen SafeArrayGetUBound VariantChangeType SafeArrayUnlock

iphlpapi

GetInterfaceInfo GetPerAdapterInfo GetAdaptersInfo GetIpAddrTable CancelIPChangeNotify NotifyRouteChange CancelMibChangeNotify2 NotifyIpInterfaceChange GetAdaptersAddresses SetTcpEntry GetExtendedTcpTable IpRenewAddress

cfgmgr32

CM_Get_Device_Interface_ListA CM_Get_Device_Interface_List_SizeA

crypt32

CertOpenStore CryptQueryObject CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CryptMsgGetParam CryptMsgClose CertGetNameStringA

ws2_32

getaddrinfo WSAAddressToStringA WSAAccept WSAGetLastError socket shutdown setsockopt send select recv ntohs listen htons getsockname getpeername freeaddrinfo connect closesocket bind __WSAFDIsSet ntohl htonl inet_ntoa getnameinfo WSACloseEvent getservbyname inet_addr WSACreateEvent WSAEventSelect WSAEnumNetworkEvents WSASend WSACleanup WSAStartup getsockopt accept gethostname ioctlsocket

wintrust

WinVerifyTrust

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpReadData WinHttpSetCredentials WinHttpAddRequestHeaders WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpQueryAuthSchemes WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders

api-ms-win-power-setting-l1-1-0

PowerReadACValue PowerReadDCValue

api-ms-win-power-base-l1-1-0

GetPwrCapabilities

powrprof

SetSuspendState

rpcrt4

UuidCreate UuidToStringA RpcStringFreeA

bcrypt

BCryptGenRandom

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

750KB

Virtual Size

749KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

169KB

Virtual Size

197KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

828KB

Virtual Size

832KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=22, id=259, version=29395,

count=253, id=261, version=29395,

count=5, id=253, version=28518,

count=19, id=260, version=29804,

count=26, id=259, version=29804,

count=115, id=261, version=30154,

count=34, id=260, version=30158,

count=16, id=257, version=29395,

count=101, id=261, version=29804,

count=429, id=1, productName=Unmarked objects,

count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=29, id=260, version=29395,

count=386, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,

count=31, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,

count=1, id=256, productName=VS2019 v16.9.2 build 29913, version=29913,

count=1, id=255, productName=VS2019 v16.9.2 build 29913, version=29913,

count=2, id=151,

count=1, id=258, productName=VS2019 v16.9.2 build 29913, version=29913,