2026-09-19_97c0b1592dc731bb54a9a30912531eb6_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-19_97c0b1592dc731bb54a9a30912531eb6_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat
Size 1.4MB
Sample260919-2s976scd43
SHA256 b1c2af256217597280dd5b21fdaa5672b0a747ca31929be5698eef2a68774ca3
MD5 97c0b1592dc731bb54a9a30912531eb6
SHA1 e22b8d758912b553cd7bfec25d74609b8c4d41da
SHA512 42095d8b750ceae251c11c59944de45e76044e72c5fd14e99ae43e00075c67413773e2d28b4c38aa036296a119892140f4428078c2810f740171ca39426ca583
SSDEEP 24576:+rggoAMPI9/322jq7pO8zwompCoKJC3uF1gvL5BskTh7Bc4W+oQV0aMaBKE7ckRN:+rgLOjqlO8ixKJccqTw4WYV0bhpq
TLSH
T1BD65D0123392C476FFA282331A54E35586BEFA904923861F67C4773C7F391B25B2D692
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-19_97c0b1592dc731bb54a9a30912531eb6_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

File Explorer

2026-09-19_97c0b1592dc731bb54a9a30912531eb6_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

.exe 1.4MB

2026-09-19_97c0b1592dc731bb54a9a30912531eb6_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

IMPHASH b1d04b1ebe040659866be4feed8055ce
SHA256 b1c2af256217597280dd5b21fdaa5672b0a747ca31929be5698eef2a68774ca3
MD5 97c0b1592dc731bb54a9a30912531eb6
SHA1 e22b8d758912b553cd7bfec25d74609b8c4d41da
SHA512 42095d8b750ceae251c11c59944de45e76044e72c5fd14e99ae43e00075c67413773e2d28b4c38aa036296a119892140f4428078c2810f740171ca39426ca583
SSDEEP 24576:+rggoAMPI9/322jq7pO8zwompCoKJC3uF1gvL5BskTh7Bc4W+oQV0aMaBKE7ckRN:+rgLOjqlO8ixKJccqTw4WYV0bhpq
TLSH
T1BD65D0123392C476FFA282331A54E35586BEFA904923861F67C4773C7F391B25B2D692
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

202347

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

iphlpapi

GetAdaptersInfo

kernel32

GetFileAttributesW GetFileAttributesExW RemoveDirectoryW SetFilePointer Sleep MoveFileExW GetEnvironmentVariableW SetEnvironmentVariableW GetSystemInfo GetVersionExW GetComputerNameW EnterCriticalSection LeaveCriticalSection FindClose FindFirstFileW FindNextFileW ResetEvent WaitForMultipleObjects InitializeCriticalSectionAndSpinCount TryEnterCriticalSection DeleteCriticalSection GetModuleFileNameW SetConsoleCtrlHandler FreeLibrary GetProcAddress LoadLibraryW VerSetConditionMask SetLastError CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus DeleteFileW QueueUserAPC TerminateThread TlsAlloc TlsGetValue TlsSetValue TlsFree FormatMessageA VerifyVersionInfoA MultiByteToWideChar FormatMessageW LocalFree WideCharToMultiByte GetSystemDirectoryW GetTempPathW GetLongPathNameW GetCurrentDirectoryW WriteFile ReadFile CreateEventW SetEvent GetStartupInfoW TerminateProcess GetCurrentProcessId DuplicateHandle GetStdHandle GetSystemTimeAsFileTime WTSGetActiveConsoleSessionId OpenProcess GetCurrentThread GetExitCodeProcess GetCurrentProcess WaitForSingleObject GetLastError CloseHandle SetWaitableTimer CreateFileW SetConsoleTextAttribute GetConsoleScreenBufferInfo WriteConsoleW HeapSize GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation ReadConsoleW FlushFileBuffers GetConsoleMode GetConsoleCP SetFilePointerEx GetFileSizeEx HeapReAlloc QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetExitCodeThread GetTickCount GetModuleHandleW EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW VirtualAlloc VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RaiseException RtlUnwind ExitThread GetModuleHandleExW ExitProcess GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW

ole32

CoImpersonateClient

advapi32

RegOpenKeyExW ReportEventW RegisterEventSourceW RegSetValueExW RegCreateKeyExW RegCloseKey OpenServiceW OpenSCManagerW DeleteService CreateServiceW CloseServiceHandle ChangeServiceConfigW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW SetTokenInformation GetTokenInformation DuplicateTokenEx CreateProcessAsUserA OpenThreadToken OpenProcessToken DeregisterEventSource

ws2_32

WSASocketW WSASend WSAGetLastError WSASetLastError WSACleanup WSAStartup shutdown listen htons ioctlsocket closesocket bind WSARecv setsockopt

mswsock

AcceptEx GetAcceptExSockaddrs

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-19_97c0b1592dc731bb54a9a30912531eb6_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

userenv

iphlpapi

kernel32

ole32

advapi32

ws2_32

mswsock

generic