2026-09-30_291a91a4228f99f8f8d034dfe094d5b2_amadey_darkgate_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_291a91a4228f99f8f8d034dfe094d5b2_amadey_darkgate_elex_luca-stealer_lynx_njrat
Size 1.7MB
Sample261001-vl8mfavvb1
SHA256 a7b52aad0c374769399486c174f822968e6a1b42b04febfc7146ee45b2eae935
MD5 291a91a4228f99f8f8d034dfe094d5b2
SHA1 e205e7a59e1b9f96f824ef72e23f570a5ff4267e
SHA512 0acbe9bc8f087fabe19226587e437c20ade42ceb51a23a93e09a891aa9c73576cd3635dbd998d6456e84e23b04ee5adfdbb03200ab2d20e7278ca2c2897e0812
SSDEEP 49152:wSm0932vrexTwMfJTF0D/m4Gq7IBAaci+n953z:OvrtMfJTm/+q7Ccr953z
TLSH
T10585BE22F932A172D4D200B190B6BFE2A9E87F21836548D7A3E4BF3B75191D32531B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_291a91a4228f99f8f8d034dfe094d5b2_amadey_darkgate_elex_luca-stealer_lynx_njrat

File Explorer

2026-09-30_291a91a4228f99f8f8d034dfe094d5b2_amadey_darkgate_elex_luca-stealer_lynx_njrat

.exe 1.7MB

2026-09-30_291a91a4228f99f8f8d034dfe094d5b2_amadey_darkgate_elex_luca-stealer_lynx_njrat

IMPHASH 0764dcb1f319e24940b94c28027927e1
SHA256 a7b52aad0c374769399486c174f822968e6a1b42b04febfc7146ee45b2eae935
MD5 291a91a4228f99f8f8d034dfe094d5b2
SHA1 e205e7a59e1b9f96f824ef72e23f570a5ff4267e
SHA512 0acbe9bc8f087fabe19226587e437c20ade42ceb51a23a93e09a891aa9c73576cd3635dbd998d6456e84e23b04ee5adfdbb03200ab2d20e7278ca2c2897e0812
SSDEEP 49152:wSm0932vrexTwMfJTF0D/m4Gq7IBAaci+n953z:OvrtMfJTm/+q7Ccr953z
TLSH
T10585BE22F932A172D4D200B190B6BFE2A9E87F21836548D7A3E4BF3B75191D32531B57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

538648

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\git\crashpad\build_crashpad-master\crashpad\out\x86\crashpad_handler.pdb

kernel32

EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection SetLastError GetModuleFileNameW GetFileInformationByHandleEx GetCurrentProcess RegisterWaitForSingleObject GetQueuedCompletionStatus WaitForSingleObject DuplicateHandle DisconnectNamedPipe OpenProcess PostQueuedCompletionStatus CreateEventW SetEvent CreateThread UnregisterWaitEx CreateIoCompletionPort ConnectNamedPipe ExitProcess SetNamedPipeHandleState CreateNamedPipeW GetVersion TransactNamedPipe WaitNamedPipeW LoadLibraryW GetProcAddress FindClose TerminateProcess ReleaseSemaphore CreateSemaphoreW GetStdHandle WriteFile SetEndOfFile UnlockFileEx SetFilePointerEx LockFileEx GetFileType GetModuleHandleW FormatMessageA LocalFree CreateDirectoryW GetFileAttributesW DeleteFileW GetTimeZoneInformation GetSystemInfo IsProcessorFeaturePresent VerSetConditionMask VerifyVersionInfoW GetProcessId SuspendThread ResumeThread GetThreadContext GetProcessTimes GetSystemDefaultLCID GetThreadLocale GetUserDefaultLCID GetPrivateProfileStringW CreateProcessW IsWow64Process WriteProcessMemory RtlCaptureContext Sleep VirtualAllocEx ReadProcessMemory SleepEx IsDebuggerPresent SizeofResource MultiByteToWideChar LockResource GlobalAlloc GlobalFree FindResourceExW IsDBCSLeadByte LoadResource FindResourceW GlobalLock lstrcpyW GlobalUnlock GetPrivateProfileSectionW VirtualFree VirtualAlloc VirtualProtect DeviceIoControl WideCharToMultiByte GetFullPathNameW GetCurrentProcessId GetLocalTime OutputDebugStringW FormatMessageW GetCurrentThreadId CloseHandle CreateFileW GetFileSizeEx ReadFile SetUnhandledExceptionFilter GetProcessHeap DeleteCriticalSection GetCurrentDirectoryW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW HeapDestroy SwitchToThread InitializeCriticalSection VirtualQueryEx GetFileTime RemoveDirectoryW WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetModuleHandleExW GetCommandLineW GetCommandLineA LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind GetStartupInfoW InitializeSListHead UnhandledExceptionFilter GetCPInfo GetStringTypeW GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable InitOnceExecuteOnce AcquireSRWLockExclusive ReleaseSRWLockExclusive DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionEx SetProcessShutdownParameters HeapFree CreateFileA SetConsoleCtrlHandler LCMapStringEx EncodePointer QueryPerformanceCounter

advapi32

ImpersonateNamedPipeClient RevertToSelf BuildSecurityDescriptorW ConvertStringSecurityDescriptorToSecurityDescriptorW BuildExplicitAccessWithNameW RegQueryValueExW RegOpenKeyExW RegQueryValueExA RegCloseKey SystemFunction036 RegOpenKeyExA

user32

SetWindowLongW DestroyWindow PostMessageW DispatchMessageW UnregisterClassW GetWindowLongW EnableWindow TranslateMessage RegisterClassW DefWindowProcW EndPaint BeginPaint InvalidateRect LoadImageW DialogBoxParamW GetSysColorBrush KillTimer GetMessageW CreateWindowExW DrawIconEx DrawTextW GetDlgItem GetClientRect MapDialogRect SetClipboardData SendDlgItemMessageW MapWindowPoints SetDlgItemTextW EmptyClipboard CloseClipboard ClientToScreen SetTimer OpenClipboard GetWindowTextLengthW EndDialog GetWindowTextW GetWindowThreadProcessId GetMenuItemCount CreatePopupMenu TrackPopupMenu IsWindow RegisterClipboardFormatW GetKeyState CallWindowProcW GetWindowRect SetWindowPos SendMessageW SetWindowTextW ShowWindow DestroyMenu

winhttp

WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpWriteData WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts WinHttpQueryHeaders WinHttpConnect WinHttpCrackUrl

powrprof

CallNtPowerInformation

ole32

CoTaskMemFree CoCreateGuid StringFromCLSID OleInitialize DoDragDrop OleUninitialize

shlwapi

PathFileExistsW PathRemoveFileSpecW

gdiplus

GdiplusStartup

comctl32

ImageList_ReplaceIcon ImageList_Create InitCommonControlsEx

gdi32

DeleteObject SetBkMode SetTextColor GetStockObject CreateFontW SelectObject

oleaut32

SysFreeString SysStringLen SysAllocString SysAllocStringByteLen SysStringByteLen

shell32

SHBindToParent ord155 SHGetFileInfoW ShellExecuteW SHGetDesktopFolder

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_291a91a4228f99f8f8d034dfe094d5b2_amadey_darkgate_elex_luca-stealer_lynx_njrat

kernel32

advapi32

user32

winhttp

powrprof

ole32

shlwapi

gdiplus

comctl32

gdi32

oleaut32

shell32

version

generic