2026-09-23_aeab6cd6e7e87a2a24925d0c741bb0db_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-23_aeab6cd6e7e87a2a24925d0c741bb0db_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat
Size 4.2MB
Sample260923-xpnsjs113l
SHA256 3ca70888cc626b25a90ae12471341b9bfbd9bb6ac720be337abae375c7a1dc97
MD5 aeab6cd6e7e87a2a24925d0c741bb0db
SHA1 af6b3ed5b114c1aedfb1c20be30deb51ae0c5500
SHA512 05065e544a0212c03d368851364f97d620239de0b56aec9bca6c255e43ae73e60ea2cd3535b76f92995175757d940602ee90dfce464a0e3b5c649da757b0cdac
SSDEEP 49152:5PBifFTSey2ubvRoYnR/VukqwxDAPAVAQcQh/WkN8YTp3FH7sywdwwOul/IBZK9j:5JkImyICxkPAVAQcQh/WkOYTyIBZDoT
TLSH
T1D8168EA03686C131E595527A9DBDBFBE841DA8382BB540C792C44B6E38351C32F35F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-23_aeab6cd6e7e87a2a24925d0c741bb0db_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

File Explorer

2026-09-23_aeab6cd6e7e87a2a24925d0c741bb0db_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

.exe 4.2MB

2026-09-23_aeab6cd6e7e87a2a24925d0c741bb0db_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

IMPHASH 36c640a6ebc54bb322c74d52efae7ca5
SHA256 3ca70888cc626b25a90ae12471341b9bfbd9bb6ac720be337abae375c7a1dc97
MD5 aeab6cd6e7e87a2a24925d0c741bb0db
SHA1 af6b3ed5b114c1aedfb1c20be30deb51ae0c5500
SHA512 05065e544a0212c03d368851364f97d620239de0b56aec9bca6c255e43ae73e60ea2cd3535b76f92995175757d940602ee90dfce464a0e3b5c649da757b0cdac
SSDEEP 49152:5PBifFTSey2ubvRoYnR/VukqwxDAPAVAQcQh/WkN8YTp3FH7sywdwwOul/IBZK9j:5JkImyICxkPAVAQcQh/WkOYTyIBZDoT
TLSH
T1D8168EA03686C131E595527A9DBDBFBE841DA8382BB540C792C44B6E38351C32F35F6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2006832

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\home\jenkins\agent\workspace\sfip\BAAS\code\services\AMTSW\Release\UNS\Release\lms.pdb

kernel32

FindResourceW SizeofResource WriteConsoleW LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW SetEnvironmentVariableW SetStdHandle GetModuleFileNameW FreeLibrary LocalAlloc LocalFree FormatMessageW GetCurrentThreadId GetFullPathNameW FreeLibraryAndExitThread ExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW VirtualQuery VirtualProtect GetCurrentThread VirtualAlloc GetModuleHandleExW FreeEnvironmentStringsW RtlUnwind GetCommandLineA GetOEMCP GetCurrentDirectoryW SetConsoleCtrlHandler GetConsoleMode ReadConsoleW GetConsoleOutputCP lstrcmpiW HeapSize HeapReAlloc GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage FindFirstFileExW OutputDebugStringW CreateThread IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo LCMapStringEx EncodePointer WaitForSingleObjectEx GetStringTypeW AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock ExpandEnvironmentStringsW GetComputerNameExW WideCharToMultiByte CreateFileW GetFinalPathNameByHandleW LoadLibraryW GetCurrentProcess CreateEventW WaitForSingleObject lstrlenW SetEvent DeleteCriticalSection InitializeCriticalSectionEx IsWow64Process OutputDebugStringA GetSystemPowerStatus GetFileInformationByHandle GetACP GetCurrentProcessId LeaveCriticalSection EnterCriticalSection GetLastError WaitForMultipleObjectsEx QueryPerformanceFrequency HeapAlloc HeapFree GetProcessHeap GetSystemDefaultLCID GetSystemTime GetFileSizeEx MultiByteToWideChar CreateFileA CancelIoEx WaitForMultipleObjects ReadFile WriteFile DeviceIoControl GetOverlappedResult InitializeCriticalSectionAndSpinCount GetTimeZoneInformation QueryPerformanceCounter SetLastError InitializeCriticalSection TryEnterCriticalSection SetThreadPriority ResumeThread GetComputerNameA GetSystemInfo DuplicateHandle TlsAlloc TlsGetValue TlsSetValue TlsFree RegisterWaitForSingleObject UnregisterWait InitOnceExecuteOnce TerminateProcess GetStdHandle RaiseException CloseHandle DecodePointer GetCommandLineW ResetEvent ReleaseSemaphore ReleaseMutex CreateMutexW CreateEventA CreateSemaphoreW GetExitCodeThread SuspendThread GetThreadId GetSystemTimeAsFileTime FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetEnvironmentStringsW ExitProcess GetVersionExW LockFileEx SetFilePointerEx UnlockFileEx SetDllDirectoryW GetStartupInfoW Sleep GlobalAlloc GlobalFree FlushFileBuffers SetEndOfFile SetFilePointer LoadLibraryExA

advapi32

RegCreateKeyW InitiateSystemShutdownExW LookupPrivilegeValueW AdjustTokenPrivileges SetEntriesInAclW RegSetKeySecurity RegDeleteKeyExW SetSecurityDescriptorDacl FreeSid AllocateAndInitializeSid ConvertSidToStringSidW LookupAccountSidW OpenProcessToken OpenThreadToken EqualSid CreateWellKnownSid StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW OpenServiceW OpenSCManagerW DeleteService CreateServiceW CopySid GetLengthSid GetTokenInformation InitializeSecurityDescriptor IsValidSid SetSecurityDescriptorGroup SetSecurityDescriptorOwner ControlService DeregisterEventSource RegisterEventSourceW ReportEventW CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey

user32

PostThreadMessageW UnregisterDeviceNotification CharNextW RegisterDeviceNotificationW DispatchMessageW GetMessageW TranslateMessage MessageBoxW LoadStringW CharUpperW

ole32

CoCreateInstance StringFromGUID2 CoTaskMemAlloc CoInitializeEx CoTaskMemFree CoImpersonateClient CoRevertToSelf CoUninitialize CoRegisterClassObject CoRevokeClassObject CoResumeClassObjects CoAddRefServerProcess CoReleaseServerProcess CoTaskMemRealloc CoSetProxyBlanket CoInitializeSecurity

oleaut32

VarBstrCat VariantClear SysAllocStringByteLen SysStringByteLen VariantInit SafeArrayCreateVector SafeArrayPutElement SysAllocString SysFreeString SysStringLen VarUI4FromStr LoadTypeLi RegisterTypeLi UnRegisterTypeLi SysAllocStringLen LoadRegTypeLi SafeArrayUnlock SafeArrayLock SafeArrayGetLBound SafeArrayDestroy SafeArrayCreate VariantChangeType SafeArrayGetUBound

iphlpapi

GetInterfaceInfo GetPerAdapterInfo GetAdaptersInfo GetIpAddrTable CancelIPChangeNotify NotifyRouteChange CancelMibChangeNotify2 NotifyIpInterfaceChange GetAdaptersAddresses SetTcpEntry GetExtendedTcpTable IpRenewAddress

cfgmgr32

CM_Get_DevNode_PropertyW CM_Get_Device_Interface_ListA CM_Get_Device_Interface_List_SizeA CM_Get_Device_Interface_PropertyW CM_Locate_DevNodeW

crypt32

CertFindCertificateInStore CertCloseStore CryptMsgGetParam CryptMsgClose CertFreeCertificateContext CertGetNameStringW CryptQueryObject CertOpenStore CertGetNameStringA

ws2_32

getaddrinfo WSAAddressToStringA WSAAccept WSAGetLastError socket shutdown setsockopt send select recv ntohs listen htons getsockname getpeername freeaddrinfo connect closesocket bind __WSAFDIsSet ntohl htonl getnameinfo inet_ntoa getservbyname inet_addr WSACloseEvent WSACreateEvent WSAEventSelect WSAEnumNetworkEvents WSASend WSACleanup WSAStartup getsockopt accept gethostname ioctlsocket

wintrust

WinVerifyTrust

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpSendRequest WinHttpSetCredentials WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpQueryAuthSchemes WinHttpQueryHeaders WinHttpReceiveResponse WinHttpAddRequestHeaders

api-ms-win-power-setting-l1-1-0

PowerReadACValue PowerReadDCValue

api-ms-win-power-base-l1-1-0

GetPwrCapabilities

powrprof

SetSuspendState

rpcrt4

UuidToStringA UuidCreate RpcStringFreeA

bcrypt

BCryptGenRandom

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

773KB

Virtual Size

772KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

169KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

824KB

Virtual Size

828KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=22, id=259, version=29395,

count=253, id=261, version=29395,

count=5, id=253, version=28518,

count=19, id=260, version=29804,

count=26, id=259, version=29804,

count=115, id=261, version=30154,

count=34, id=260, version=30158,

count=16, id=257, version=29395,

count=101, id=261, version=29804,

count=432, id=1, productName=Unmarked objects,

count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=29, id=260, version=29395,

count=386, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,

count=31, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,

count=1, id=256, productName=VS2019 v16.9.2 build 29913, version=29913,

count=1, id=255, productName=VS2019 v16.9.2 build 29913, version=29913,

count=2, id=151,

count=1, id=258, productName=VS2019 v16.9.2 build 29913, version=29913,