2026-09-30_73382f126ac24602a50853c4c7936d42_amadey_darkgate_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_73382f126ac24602a50853c4c7936d42_amadey_darkgate_elex_luca-stealer_lynx_njrat
Size 1.7MB
Sample261001-pc33pswtas
SHA256 e8cf15a94d9d7e1936b1ab75dab6730bd91acdcb90ed2ea86fd71d0e03495241
MD5 73382f126ac24602a50853c4c7936d42
SHA1 8488419994d7bf3de9ae050f3aec3da6e3672083
SHA512 644b9d1e149ddc658dc22845a58b37c2963f04da83aeb7b262dab602f44a7b85da9be6e4a412fe3aa82679e148cab8a402fd48c4c3a487e337c9df201f138317
SSDEEP 49152:Mm3zCmNMOQQkETTMHJJ0D/m4Gq7IBAaci+n953z:Mm3zQQDMHJi/+q7Ccr953z
TLSH
T1A285DF25FD22E172D49240B290B5BFE2E9EC7F11436988D7A3D0BF2E69181D32531B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_73382f126ac24602a50853c4c7936d42_amadey_darkgate_elex_luca-stealer_lynx_njrat

File Explorer

2026-09-30_73382f126ac24602a50853c4c7936d42_amadey_darkgate_elex_luca-stealer_lynx_njrat

.exe 1.7MB

2026-09-30_73382f126ac24602a50853c4c7936d42_amadey_darkgate_elex_luca-stealer_lynx_njrat

IMPHASH 67904fa5fc7946f29c7ac9881ed81294
SHA256 e8cf15a94d9d7e1936b1ab75dab6730bd91acdcb90ed2ea86fd71d0e03495241
MD5 73382f126ac24602a50853c4c7936d42
SHA1 8488419994d7bf3de9ae050f3aec3da6e3672083
SHA512 644b9d1e149ddc658dc22845a58b37c2963f04da83aeb7b262dab602f44a7b85da9be6e4a412fe3aa82679e148cab8a402fd48c4c3a487e337c9df201f138317
SSDEEP 49152:Mm3zCmNMOQQkETTMHJJ0D/m4Gq7IBAaci+n953z:Mm3zQQDMHJi/+q7Ccr953z
TLSH
T1A285DF25FD22E172D49240B290B5BFE2E9EC7F11436988D7A3D0BF2E69181D32531B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

555928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Ugit\WXWork\WXWork\third_party\bugly\build_crashpad\crashpad\out\x86\release\crashpad_handler.pdb

kernel32

GetCurrentProcessId EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection SetLastError GetModuleFileNameW GetFileInformationByHandleEx GetCurrentProcess RegisterWaitForSingleObject GetQueuedCompletionStatus WaitForSingleObject DuplicateHandle DisconnectNamedPipe OpenProcess PostQueuedCompletionStatus CreateEventW SetEvent CreateThread UnregisterWaitEx CreateIoCompletionPort ConnectNamedPipe ExitProcess SetNamedPipeHandleState CreateNamedPipeW GetVersion TransactNamedPipe WaitNamedPipeW LoadLibraryW GetProcAddress FindClose TerminateProcess ReleaseSemaphore CreateSemaphoreW GetStdHandle WriteFile SetEndOfFile UnlockFileEx SetFilePointerEx LockFileEx GetFileType GetModuleHandleW FormatMessageA LocalFree CreateDirectoryW GetFileAttributesW DeleteFileW GetTimeZoneInformation GetSystemInfo IsProcessorFeaturePresent VerSetConditionMask VerifyVersionInfoW GetProcessId SuspendThread ResumeThread GetThreadContext GetProcessTimes GetSystemDefaultLCID GetThreadLocale GetUserDefaultLCID CreateProcessW IsWow64Process WriteProcessMemory RtlCaptureContext Sleep VirtualAllocEx ReadProcessMemory SleepEx IsDebuggerPresent SizeofResource MultiByteToWideChar LockResource GlobalAlloc GlobalFree FindResourceExW IsDBCSLeadByte LoadResource FindResourceW GlobalLock lstrcpyW GlobalUnlock GetPrivateProfileSectionW GetFileSizeEx VirtualAlloc VirtualProtect DeviceIoControl CreateFileA WideCharToMultiByte OutputDebugStringW ReadFile WritePrivateProfileStringW SetUnhandledExceptionFilter GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize GetCurrentDirectoryW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW InitializeCriticalSectionEx SwitchToThread InitializeCriticalSection VirtualQueryEx GetFileTime RemoveDirectoryW WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetModuleHandleExW GetCommandLineW GetCommandLineA LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind GetStartupInfoW InitializeSListHead UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCPInfo GetStringTypeW GetSystemTimeAsFileTime InitOnceExecuteOnce LCMapStringEx EncodePointer QueryPerformanceCounter GetLocalTime FormatMessageW GetCurrentThreadId CloseHandle GetPrivateProfileStringW GetFullPathNameW CreateFileW SetProcessShutdownParameters HeapFree VirtualFree SetConsoleCtrlHandler

advapi32

RegQueryValueExA RevertToSelf BuildSecurityDescriptorW SystemFunction036 ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyExA RegCloseKey ImpersonateNamedPipeClient RegOpenKeyExW RegQueryValueExW BuildExplicitAccessWithNameW

user32

SetWindowLongW CreateWindowExW DestroyWindow RegisterClassW DefWindowProcW GetMessageW GetWindowLongW TranslateMessage DispatchMessageW PostMessageW EnableWindow EndPaint BeginPaint InvalidateRect LoadImageW DialogBoxParamW GetSysColorBrush UnregisterClassW GetWindowTextW KillTimer DrawIconEx DrawTextW GetDlgItem GetClientRect MapDialogRect SetClipboardData SendDlgItemMessageW MapWindowPoints SetDlgItemTextW EmptyClipboard CloseClipboard ClientToScreen SetTimer GetWindowTextLengthW EndDialog SetWindowTextW GetWindowThreadProcessId GetMenuItemCount CreatePopupMenu TrackPopupMenu IsWindow DestroyMenu RegisterClipboardFormatW GetKeyState CallWindowProcW GetWindowRect SetWindowPos SendMessageW ShowWindow OpenClipboard

winhttp

WinHttpWriteData WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpConnect WinHttpSendRequest WinHttpSetTimeouts WinHttpCrackUrl

powrprof

CallNtPowerInformation

ole32

OleUninitialize CoTaskMemFree CoCreateGuid StringFromCLSID OleInitialize DoDragDrop

shlwapi

PathRemoveFileSpecW PathFileExistsW

gdiplus

GdiplusStartup

comctl32

ImageList_ReplaceIcon ImageList_Create InitCommonControlsEx

gdi32

DeleteObject SetTextColor GetStockObject CreateFontW SelectObject SetBkMode

oleaut32

SysAllocString SysFreeString SysStringByteLen SysAllocStringByteLen SysStringLen

shell32

SHGetDesktopFolder SHGetFileInfoW SHBindToParent ShellExecuteW ord155

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_73382f126ac24602a50853c4c7936d42_amadey_darkgate_elex_luca-stealer_lynx_njrat

kernel32

advapi32

user32

winhttp

powrprof

ole32

shlwapi

gdiplus

comctl32

gdi32

oleaut32

shell32

version

generic