2026-09-23_ba673172495fd5c7610b5dfe10fcdfa9_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-23_ba673172495fd5c7610b5dfe10fcdfa9_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat
Size 2.4MB
Sample260924-cf5pgsbg34
SHA256 08664df44f1b24ce81950b551e158cfe78ee763c787039af50c28453a24a4ecb
MD5 ba673172495fd5c7610b5dfe10fcdfa9
SHA1 38620a2bb2699091c83c9fb6bb9c612dd6fbb15d
SHA512 760a49f3e3278685e8533d248e473f5e82503096d78ff9c60385f638b1cefaff1fa27532411ed79889aa5ffed289ca3910d99e6cf15054833096598a4985491c
SSDEEP 49152:MEug8a5LbuKj7q1ydxHFN1wER7LiCrYr9u6ynl:MLc6KaMjHFNCirN
TLSH
T132C57C317A01D236E6A102F2892C6EBF943D9E680BA855D7F2443D792D709D27B3391F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-23_ba673172495fd5c7610b5dfe10fcdfa9_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

.exe 2.4MB

2026-09-23_ba673172495fd5c7610b5dfe10fcdfa9_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

IMPHASH 34ba7b64c51e2ed312110e597124eecd
SHA256 08664df44f1b24ce81950b551e158cfe78ee763c787039af50c28453a24a4ecb
MD5 ba673172495fd5c7610b5dfe10fcdfa9
SHA1 38620a2bb2699091c83c9fb6bb9c612dd6fbb15d
SHA512 760a49f3e3278685e8533d248e473f5e82503096d78ff9c60385f638b1cefaff1fa27532411ed79889aa5ffed289ca3910d99e6cf15054833096598a4985491c
SSDEEP 49152:MEug8a5LbuKj7q1ydxHFN1wER7LiCrYr9u6ynl:MLc6KaMjHFNCirN
TLSH
T132C57C317A01D236E6A102F2892C6EBF943D9E680BA855D7F2443D792D709D27B3391F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

8a:c1:66:0d:3b:b6:97:20:fa:33:c6:6f:4f:bd:43:10:b8:ac:29:78:39:17:04:60:11:cf:73:3e:89:8c:d6:24

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=成都星汉云科科技有限公司,O=成都星汉云科科技有限公司,L=成都市,ST=四川省,C=CN

Chains

Aug 5, 2026

CN=成都星汉云科科技有限公司,O=成都星汉云科科技有限公司,L=成都市,ST=四川省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=成都星汉云科科技有限公司,O=成都星汉云科科技有限公司,L=成都市,ST=四川省,C=CN

Serial Number

01:cd:71:67:23:ee:3c:14:c3:36:fe:fa:6f:5a:b8:cb

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 28, 2025 - Apr 26, 2028

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

1217371

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ProgramData\Jenkins\.jenkins\workspace\MGame\Privacy\privacy_set_tray\bin\Release\MLPrivacyTray.pdb

kernel32

SystemTimeToFileTime GetProcessTimes CopyFileW DeleteAtom FindAtomW AddAtomW DeleteFileW GetTempPathW GetShortPathNameW GetSystemTimeAsFileTime VerifyVersionInfoW GetCurrentProcessId VerSetConditionMask CreateThread Process32FirstW TerminateThread Process32NextW CreateToolhelp32Snapshot SetThreadPriority GetCurrentProcess GetTickCount FreeLibrary GetTickCount64 GetPrivateProfileStringW DisconnectNamedPipe CreateFileW WriteFile ReadFile ResetEvent OutputDebugStringW SetUnhandledExceptionFilter IsBadReadPtr VirtualProtect lstrcmpiW MapViewOfFile CreateFileMappingW GetProcAddress FindResourceW LoadResource FindResourceExW LoadLibraryW CloseHandle LockResource WaitForSingleObject FindClose GetModuleFileNameW lstrlenW FindNextFileW GetCommandLineW FindFirstFileW SizeofResource GetCurrentThreadId LeaveCriticalSection EnterCriticalSection SetLastError GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError QueryFullProcessImageNameW WideCharToMultiByte UnmapViewOfFile ReleaseMutex CreateMutexW TerminateProcess GetLocalTime GetExitCodeProcess GetModuleHandleW CreateProcessW GetCurrentThread OpenProcess GetVersionExW GetProcessId GetStartupInfoW GetPrivateProfileIntW WritePrivateProfileStringW Sleep WaitForMultipleObjects SetEvent MultiByteToWideChar WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetStdHandle SetFilePointerEx GetFileType GetConsoleMode GetConsoleOutputCP GetTimeZoneInformation GetFileAttributesExW GetModuleHandleExW ExitThread RtlUnwind CreateFileMappingA FindNextFileA FindFirstFileA CreateFileA lstrcmpA DeviceIoControl GetSystemWindowsDirectoryW UnregisterWaitEx QueryDepthSList CreateEventW HeapSize InitializeCriticalSectionEx InitializeCriticalSection lstrcpynW HeapFree EncodePointer ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared FormatMessageW GetStringTypeW TryEnterCriticalSection DuplicateHandle WaitForSingleObjectEx SwitchToThread GetExitCodeThread QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA GetFileSizeEx lstrcpyW FlushFileBuffers GetFileSize MulDiv GetACP ExitProcess FreeResource lstrcmpW SetEndOfFile SetFilePointer GetVersion GlobalAlloc GlobalUnlock GlobalLock GlobalFree GetTempFileNameW ResumeThread UnhandledExceptionFilter LocalFree CreateTimerQueue SignalObjectAndWait GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW ReleaseSemaphore InterlockedFlushSList

user32

BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect CreateCaret GetCaretBlinkTime SetCaretPos ScreenToClient MapWindowPoints IntersectRect UnionRect IsRectEmpty GetParent GetClassNameW GetWindow MonitorFromWindow RegisterClassW ShowWindow EnableWindow SetPropW GetPropW LoadImageW wvsprintfW SetCapture InflateRect OffsetRect ReleaseDC SetWindowRgn MessageBoxW MonitorFromPoint CharPrevW DrawTextW SetRect DrawIconEx GetIconInfo GetMessagePos GetDlgCtrlID DrawFocusRect FillRect HideCaret ShowCaret ClientToScreen GetSysColor GetWindowDC SetWindowTextW GetWindowTextW GetWindowTextLengthW CreateAcceleratorTableW InvalidateRgn RemovePropW FindWindowExW IsWindowEnabled GetKeyState GetFocus SetFocus CharNextW GetDC IsIconic ReleaseCapture RegisterWindowMessageW DestroyIcon UnregisterClassW IsZoomed PostMessageW GetClassInfoExW UpdateLayeredWindow IsChild SendMessageW DispatchMessageW TranslateMessage GetMessageW SetCursor KillTimer SetWindowLongW MoveWindow GetCursorPos IsWindowVisible ChangeWindowMessageFilter LoadIconW PostQuitMessage wsprintfW SendMessageTimeoutW FindWindowW PostThreadMessageW GetWindowRect SetWindowPos EnumDisplayMonitors GetMonitorInfoW CopyRect PtInRect SetForegroundWindow SendNotifyMessageW GetWindowLongW DefWindowProcW CallWindowProcW DestroyWindow CreateWindowExW RegisterClassExW IsWindow SetTimer LoadCursorW

advapi32

RegEnumKeyExW RegCreateKeyExW RegSetValueExW RegCreateKeyW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey QueryServiceStatus EqualSid CloseServiceHandle OpenSCManagerW AllocateAndInitializeSid FreeSid RegOpenKeyExW OpenServiceW OpenThreadToken RegQueryValueExW GetTokenInformation LookupPrivilegeValueW AdjustTokenPrivileges StartTraceW ProcessTrace CloseTrace OpenProcessToken ControlTraceW OpenTraceW

shell32

SHGetSpecialFolderPathW ord680 SHCreateDirectoryExW ShellExecuteExW SHGetKnownFolderPath ord165 SHChangeNotify Shell_NotifyIconW SHFileOperationW

ole32

CoUninitialize CLSIDFromProgID CoInitialize CoInitializeEx CoTaskMemFree CoCreateGuid CoCreateInstance CreateStreamOnHGlobal CLSIDFromString OleLockRunning CoInitializeSecurity CoSetProxyBlanket

oleaut32

SysStringLen SafeArrayPutElement SafeArrayCreate VariantInit SysAllocString SysAllocStringLen VariantClear VariantChangeType SysFreeString

shlwapi

PathAppendW PathFileExistsW PathRemoveFileSpecW PathCombineW wnsprintfW SHSetValueW SHAutoComplete StrCmpNIW StrTrimA StrStrIA StrCmpIW StrCpyW StrStrIW PathFindFileNameW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

tdh

TdhGetPropertySize TdhGetEventInformation

secur32

GetUserNameExW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

gdi32

SelectClipRgn SetDIBitsToDevice BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW CreatePen DeleteDC DeleteObject GetStockObject Rectangle RestoreDC SaveDC SelectObject GetTextMetricsW GetObjectW SetWindowOrgEx CreateRoundRectRgn GetDeviceCaps CombineRgn CreateRectRgnIndirect GetCharABCWidthsW GetClipBox GetTextExtentPoint32W GetDIBits ExtSelectClipRgn SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor CreateDIBSection SetDIBColorTable TextOutW ExtTextOutW CreateSolidBrush GetTextColor CreateDCW

comctl32

InitCommonControlsEx ImageList_GetIconSize ImageList_DrawEx _TrackMouseEvent ord17

msimg32

AlphaBlend GradientFill

gdiplus

GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipLoadImageFromStreamICM GdipDrawImageRectI GdipImageSelectActiveFrame GdipLoadImageFromFile GdipDrawEllipseI GdipAddPathArc GdipImageGetFrameCount GdipGetPropertyItemSize GdipGetPropertyItem GdipGetImagePixelFormat GdipDrawLineI GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImageRectRectI GdipDrawImagePointsI GdipFillPath GdipGraphicsClear GdipSetInterpolationMode GdipAlloc GdipFree GdipCreatePath GdipDeletePath GdipAddPathLineI GdipAddPathArcI GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipSetPenDashStyle GdipBitmapUnlockBits GdipDeleteGraphics GdipSetSmoothingMode GdipCreateFromHDC GdipDrawRectangleI GdipDrawPath GdipFillEllipseI GdipClosePathFigure GdipCreateTexture GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipCreateHBITMAPFromBitmap GdipCloneBitmapAreaI GdipBitmapLockBits

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-23_ba673172495fd5c7610b5dfe10fcdfa9_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

urlmon

tdh

secur32

wininet

iphlpapi

gdi32

comctl32

msimg32

gdiplus

generic