2026-09-30_41648231e6002ef1ec73d4ef05e90eb7_amadey_darkgate_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_41648231e6002ef1ec73d4ef05e90eb7_amadey_darkgate_elex_luca-stealer_lynx_njrat
Size 1.5MB
Sample260930-n6m3xaee78
SHA256 d54d590acc884097a74ff9396a4ae9e7667e4016a9977371714db13d574d3427
MD5 41648231e6002ef1ec73d4ef05e90eb7
SHA1 26eed2571339ecb8727f013eb4d34356be05ac37
SHA512 250b95a0cedfa51c587f322197790f0f0f581f01eeb97583309b36271b4b363a334c2b6aa2113bc87dc8221e33d0dd12a15cc3a3ebb40aa5cf7e7005fb967579
SSDEEP 24576:OFud3zC9QNiY7A4iBOyLkyQkET3DMceJnjKOW0jxuBIRIMKsLPPn:OO3zCmNMOQQkETTMHJGh0jpIMlXn
TLSH
T10075BE25FD22E172D49240B190B6BFE2E9EC6F11432988D7A3E0BF2E75181D32535B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_41648231e6002ef1ec73d4ef05e90eb7_amadey_darkgate_elex_luca-stealer_lynx_njrat

File Explorer

2026-09-30_41648231e6002ef1ec73d4ef05e90eb7_amadey_darkgate_elex_luca-stealer_lynx_njrat

.exe 1.5MB

2026-09-30_41648231e6002ef1ec73d4ef05e90eb7_amadey_darkgate_elex_luca-stealer_lynx_njrat

IMPHASH 67904fa5fc7946f29c7ac9881ed81294
SHA256 d54d590acc884097a74ff9396a4ae9e7667e4016a9977371714db13d574d3427
MD5 41648231e6002ef1ec73d4ef05e90eb7
SHA1 26eed2571339ecb8727f013eb4d34356be05ac37
SHA512 250b95a0cedfa51c587f322197790f0f0f581f01eeb97583309b36271b4b363a334c2b6aa2113bc87dc8221e33d0dd12a15cc3a3ebb40aa5cf7e7005fb967579
SSDEEP 24576:OFud3zC9QNiY7A4iBOyLkyQkET3DMceJnjKOW0jxuBIRIMKsLPPn:OO3zCmNMOQQkETTMHJGh0jpIMlXn
TLSH
T10075BE25FD22E172D49240B190B6BFE2E9EC6F11432988D7A3E0BF2E75181D32535B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

555928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Ugit\WXWork\WXWork\third_party\bugly\build_crashpad\crashpad\out\x86\release\crashpad_handler.pdb

kernel32

GetCurrentProcessId EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection SetLastError GetModuleFileNameW GetFileInformationByHandleEx GetCurrentProcess RegisterWaitForSingleObject GetQueuedCompletionStatus WaitForSingleObject DuplicateHandle DisconnectNamedPipe OpenProcess PostQueuedCompletionStatus CreateEventW SetEvent CreateThread UnregisterWaitEx CreateIoCompletionPort ConnectNamedPipe ExitProcess SetNamedPipeHandleState CreateNamedPipeW GetVersion TransactNamedPipe WaitNamedPipeW LoadLibraryW GetProcAddress FindClose TerminateProcess ReleaseSemaphore CreateSemaphoreW GetStdHandle WriteFile SetEndOfFile UnlockFileEx SetFilePointerEx LockFileEx GetFileType GetModuleHandleW FormatMessageA LocalFree CreateDirectoryW GetFileAttributesW DeleteFileW GetTimeZoneInformation GetSystemInfo IsProcessorFeaturePresent VerSetConditionMask VerifyVersionInfoW GetProcessId SuspendThread ResumeThread GetThreadContext GetProcessTimes GetSystemDefaultLCID GetThreadLocale GetUserDefaultLCID CreateProcessW IsWow64Process WriteProcessMemory RtlCaptureContext Sleep VirtualAllocEx ReadProcessMemory SleepEx IsDebuggerPresent SizeofResource MultiByteToWideChar LockResource GlobalAlloc GlobalFree FindResourceExW IsDBCSLeadByte LoadResource FindResourceW GlobalLock lstrcpyW GlobalUnlock GetPrivateProfileSectionW GetFileSizeEx VirtualAlloc VirtualProtect DeviceIoControl CreateFileA WideCharToMultiByte OutputDebugStringW ReadFile WritePrivateProfileStringW SetUnhandledExceptionFilter GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize GetCurrentDirectoryW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW InitializeCriticalSectionEx SwitchToThread InitializeCriticalSection VirtualQueryEx GetFileTime RemoveDirectoryW WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetModuleHandleExW GetCommandLineW GetCommandLineA LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind GetStartupInfoW InitializeSListHead UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCPInfo GetStringTypeW GetSystemTimeAsFileTime InitOnceExecuteOnce LCMapStringEx EncodePointer QueryPerformanceCounter GetLocalTime FormatMessageW GetCurrentThreadId CloseHandle GetPrivateProfileStringW GetFullPathNameW CreateFileW SetProcessShutdownParameters HeapFree VirtualFree SetConsoleCtrlHandler

advapi32

RegQueryValueExA RevertToSelf BuildSecurityDescriptorW SystemFunction036 ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyExA RegCloseKey ImpersonateNamedPipeClient RegOpenKeyExW RegQueryValueExW BuildExplicitAccessWithNameW

user32

SetWindowLongW CreateWindowExW DestroyWindow RegisterClassW DefWindowProcW GetMessageW GetWindowLongW TranslateMessage DispatchMessageW PostMessageW EnableWindow EndPaint BeginPaint InvalidateRect LoadImageW DialogBoxParamW GetSysColorBrush UnregisterClassW GetWindowTextW KillTimer DrawIconEx DrawTextW GetDlgItem GetClientRect MapDialogRect SetClipboardData SendDlgItemMessageW MapWindowPoints SetDlgItemTextW EmptyClipboard CloseClipboard ClientToScreen SetTimer GetWindowTextLengthW EndDialog SetWindowTextW GetWindowThreadProcessId GetMenuItemCount CreatePopupMenu TrackPopupMenu IsWindow DestroyMenu RegisterClipboardFormatW GetKeyState CallWindowProcW GetWindowRect SetWindowPos SendMessageW ShowWindow OpenClipboard

winhttp

WinHttpWriteData WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpConnect WinHttpSendRequest WinHttpSetTimeouts WinHttpCrackUrl

powrprof

CallNtPowerInformation

ole32

OleUninitialize CoTaskMemFree CoCreateGuid StringFromCLSID OleInitialize DoDragDrop

shlwapi

PathRemoveFileSpecW PathFileExistsW

gdiplus

GdiplusStartup

comctl32

ImageList_ReplaceIcon ImageList_Create InitCommonControlsEx

gdi32

DeleteObject SetTextColor GetStockObject CreateFontW SelectObject SetBkMode

oleaut32

SysAllocString SysFreeString SysStringByteLen SysAllocStringByteLen SysStringLen

shell32

SHGetDesktopFolder SHGetFileInfoW SHBindToParent ShellExecuteW ord155

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

Name

.text

Size

709KB

Virtual Size

708KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

171KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

622KB

Virtual Size

624KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_41648231e6002ef1ec73d4ef05e90eb7_amadey_darkgate_elex_luca-stealer_lynx_njrat

kernel32

advapi32

user32

winhttp

powrprof

ole32

shlwapi

gdiplus

comctl32

gdi32

oleaut32

shell32

version

generic