2026-09-29_5d39ae5235bc0537573f7f63b37c471f_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_5d39ae5235bc0537573f7f63b37c471f_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat
Size 2.4MB
Sample260930-afgxbaab28
SHA256 3c7165a734a82e04ea7e3d38c8aaa15c8525bffb643c19755f953df11189d430
MD5 5d39ae5235bc0537573f7f63b37c471f
SHA1 71bc0a49a7dd6858941385c2ad958e9a53562c3e
SHA512 5bb8da62fb7a1db73a6192571a4538cb141e37dbc00e6ba4bd17c5abdeddd6646271dcdaeccdc242b3136942345f1a255e309850103b8f75088a84e8bf4fc4df
SSDEEP 49152:CtsKkGgXKN1RsyxgVDnA48mzh5WAKo2SBKFXI19NTxuezRhig:CfROL515WAKdWrNTx9
TLSH
T1CAB59E3136518236DAB100F29C2EAFBFD4299E2403A5D9D3E3C40D6E5934AD37E7661B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-29_5d39ae5235bc0537573f7f63b37c471f_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

.exe 2.4MB

2026-09-29_5d39ae5235bc0537573f7f63b37c471f_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

IMPHASH 985d8dc2b51d982ac81f62fcc00aaab7
SHA256 3c7165a734a82e04ea7e3d38c8aaa15c8525bffb643c19755f953df11189d430
MD5 5d39ae5235bc0537573f7f63b37c471f
SHA1 71bc0a49a7dd6858941385c2ad958e9a53562c3e
SHA512 5bb8da62fb7a1db73a6192571a4538cb141e37dbc00e6ba4bd17c5abdeddd6646271dcdaeccdc242b3136942345f1a255e309850103b8f75088a84e8bf4fc4df
SSDEEP 49152:CtsKkGgXKN1RsyxgVDnA48mzh5WAKo2SBKFXI19NTxuezRhig:CfROL515WAKdWrNTx9
TLSH
T1CAB59E3136518236DAB100F29C2EAFBFD4299E2403A5D9D3E3C40D6E5934AD37E7661B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

27:f9:4a:da:32:0e:02:e5:c7:39:3d:7b:b2:b2:2c:e9:77:9a:ae:58:e8:12:b8:ed:95:e4:13:48:e2:6c:9a:f8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91510100MAC13UF2XR,CN=成都霁悦科技有限公司,O=成都霁悦科技有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Aug 11, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

07:f6:2f:c4:75:14:15:80:d1:17:c2:44:48:43:66:d5

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 28, 2023 - Nov 27, 2026

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

1134767

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ProgramData\Jenkins\.jenkins\workspace\MGame\AIClean\AIClean_tray\bin\Release\DeepAICleanerTray.pdb

kernel32

GetTickCount64 Process32NextW Process32FirstW GetProcessTimes TerminateThread K32GetModuleFileNameExW AttachConsole GetConsoleDisplayMode FreeConsole CopyFileW DeleteAtom FindAtomW AddAtomW FreeLibrary LoadLibraryW GetCurrentThread Sleep OpenProcess GetVersionExW GetProcessId lstrlenW GetLogicalDrives SetUnhandledExceptionFilter IsBadReadPtr GetModuleHandleW GetCurrentProcessId GetProcAddress GetCurrentThreadId WaitForSingleObject VirtualProtect lstrcmpiW MultiByteToWideChar CreateMutexW TerminateProcess GetCurrentProcess lstrcpynW CreateToolhelp32Snapshot GetFileSizeEx SystemTimeToFileTime WaitForSingleObjectEx ResumeThread DisconnectNamedPipe CreateFileW WaitForMultipleObjects WriteFile ReadFile GetDriveTypeW ResetEvent SetEvent CreateEventW ReleaseMutex OutputDebugStringW GetShortPathNameW GetModuleFileNameW GetPrivateProfileIntW WideCharToMultiByte CreateProcessW GetProcessHeap GetTickCount HeapDestroy DecodePointer HeapAlloc FindResourceW LoadResource FindResourceExW RaiseException CloseHandle HeapReAlloc LockResource GetLastError GetPrivateProfileStringW HeapSize InitializeCriticalSectionEx InitializeCriticalSection LeaveCriticalSection DeleteFileW FindClose GetTempPathW FindNextFileW SetLastError FindFirstFileW WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW ReadConsoleW SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetStdHandle GetModuleHandleExW ExitThread SetFilePointerEx GetFileType GetConsoleMode GetConsoleOutputCP GetTimeZoneInformation GetFileAttributesExW RtlUnwind CreateFileMappingA FindNextFileA FindFirstFileA CreateFileA lstrcmpA DeviceIoControl GetSystemWindowsDirectoryW UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore LoadLibraryExW GetModuleHandleA DeleteCriticalSection GetCommandLineW FreeLibraryAndExitThread GetThreadTimes UnregisterWait EnterCriticalSection HeapFree WritePrivateProfileStringW SizeofResource GetStartupInfoW IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA TryEnterCriticalSection FormatMessageW GetStringTypeW DuplicateHandle SwitchToThread GetExitCodeThread InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime QueryPerformanceCounter QueryPerformanceFrequency CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo lstrcpyW MulDiv ExitProcess FreeResource GetACP GetFileSize lstrcmpW SetEndOfFile SetFilePointer CreateFileMappingW MapViewOfFile UnmapViewOfFile GetVersion GlobalAlloc GlobalUnlock GlobalLock GlobalFree GetTempFileNameW GetLocalTime UnhandledExceptionFilter FlushFileBuffers LocalFree CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject

user32

GetKeyState SetCapture ReleaseCapture BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect CreateCaret GetCaretBlinkTime SetCaretPos ScreenToClient MapWindowPoints UnionRect IsRectEmpty GetParent GetClassNameW MonitorFromWindow SetCursor IsIconic SetWindowRgn MessageBoxW RegisterClassW ShowWindow EnableWindow SetPropW GetPropW RegisterWindowMessageW wvsprintfW InflateRect OffsetRect RemovePropW CharPrevW DrawTextW SetRect GetFocus GetIconInfo GetMessagePos GetDlgCtrlID DrawFocusRect FillRect HideCaret ShowCaret ClientToScreen GetSysColor SetLayeredWindowAttributes RedrawWindow GetWindowDC SetWindowTextW GetWindowTextW GetWindowTextLengthW CreateAcceleratorTableW InvalidateRgn FindWindowExW IsWindowEnabled CharNextW IsZoomed IsWindowVisible UpdateLayeredWindow IsChild DispatchMessageW TranslateMessage GetMessageW ReleaseDC GetDC MoveWindow CopyRect SetTimer UnregisterClassW MonitorFromPoint GetWindow EqualRect MonitorFromRect SendMessageW WindowFromPoint GetWindowInfo ChangeWindowMessageFilter IntersectRect LoadIconW PostQuitMessage GetDesktopWindow GetAncestor SetFocus GetCursorPos DefWindowProcW CallWindowProcW DestroyWindow CreateWindowExW RegisterClassExW LoadCursorW SetWindowLongW KillTimer GetClassInfoExW wsprintfW GetWindowLongW GetWindowThreadProcessId SetWindowPos EnumDisplayMonitors GetShellWindow GetMonitorInfoW AttachThreadInput GetForegroundWindow BringWindowToTop SystemParametersInfoW PtInRect SetForegroundWindow SendMessageTimeoutW IsWindow FindWindowW PostMessageW DestroyIcon GetWindowRect DrawIconEx LoadImageW

advapi32

RegEnumKeyExW RegCreateKeyExW RegSetValueExW RegCloseKey QueryServiceStatus EqualSid CloseServiceHandle OpenSCManagerW AllocateAndInitializeSid OpenProcessToken FreeSid RegOpenKeyExW OpenServiceW OpenThreadToken RegQueryValueExW GetTokenInformation RegCreateKeyW

shell32

SHGetDiskFreeSpaceExW SHGetKnownFolderPath ShellExecuteExW ord680 Shell_NotifyIconW ord165 SHGetSpecialFolderPathW SHChangeNotify SHFileOperationW SHCreateDirectoryExW SHQueryUserNotificationState

ole32

CoTaskMemFree CoCreateGuid CoCreateInstance CoInitialize CoUninitialize CreateStreamOnHGlobal CoSetProxyBlanket CoInitializeSecurity CoInitializeEx OleLockRunning CLSIDFromProgID CLSIDFromString

oleaut32

SafeArrayPutElement SafeArrayCreate SysStringLen SysFreeString VariantClear VariantChangeType SysAllocStringLen SysAllocString VariantInit

shlwapi

PathCombineW SHAutoComplete PathFileExistsW StrTrimA StrStrIA PathAppendW PathRemoveFileSpecW StrStrIW StrFormatByteSizeW wnsprintfW PathIsRelativeW PathFindExtensionW StrCmpIW PathFindFileNameW StrCmpNIW StrCpyW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

secur32

GetUserNameExW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

gdi32

GetClipBox GetDeviceCaps BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW CreatePen DeleteDC DeleteObject GetStockObject Rectangle RestoreDC SaveDC SelectObject GetTextMetricsW GetObjectW SetWindowOrgEx CreateRoundRectRgn GetTextExtentPoint32W CombineRgn CreateRectRgnIndirect GetCharABCWidthsW SelectClipRgn ExtSelectClipRgn SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor CreateDIBSection SetDIBColorTable TextOutW ExtTextOutW CreateSolidBrush GetTextColor CreateDCW GetDIBits SetDIBitsToDevice

comctl32

InitCommonControlsEx ImageList_GetIconSize ImageList_DrawEx _TrackMouseEvent ord17

msimg32

AlphaBlend GradientFill

gdiplus

GdipAddPathArc GdipDrawImageRectRectI GdipDrawEllipseI GdipGetImagePixelFormat GdipLoadImageFromFile GdipGetImageEncodersSize GdipDrawImageRectI GdipLoadImageFromStreamICM GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipGetImageEncoders GdipSetSmoothingMode GdipGetPropertyItem GdipGetPropertyItemSize GdipAlloc GdipFree GdipCreatePath GdipDeletePath GdipAddPathLineI GdipAddPathArcI GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipSetPenDashStyle GdipCreateFromHDC GdipDeleteGraphics GdipDrawImagePointsI GdipDrawLineI GdipDrawRectangleI GdipDrawPath GdipFillEllipseI GdipClosePathFigure GdipCreateTexture GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipCreateHBITMAPFromBitmap GdipCloneBitmapAreaI GdipBitmapLockBits GdipBitmapUnlockBits GdipSetInterpolationMode GdipGraphicsClear GdipFillPath GdipImageSelectActiveFrame

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_5d39ae5235bc0537573f7f63b37c471f_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

secur32

wininet

iphlpapi

urlmon

gdi32

comctl32

msimg32

gdiplus

generic