2026-10-06_3ba2c5edf4a15c6a230a0066d308939e_amadey_darkgate_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-06_3ba2c5edf4a15c6a230a0066d308939e_amadey_darkgate_elex_luca-stealer_lynx_njrat
Size 1.9MB
Sample261006-rf53kscs5m
SHA256 09a62a4dfc343717aa701bc9ef1f5cf2aa64bfe5f047cef3398bed55b0d63bcb
MD5 3ba2c5edf4a15c6a230a0066d308939e
SHA1 952d9a452aa94d9d8bc0d60fec74602c944b066e
SHA512 25d3f6f80ec05c023daa863cffaa8a7b421c3ce984088eebcd24483183dd0db0c2c642cfee7b7fa811a51303a61bdd7e0e6eccf3dd7f5c1a986734510adc1fe6
SSDEEP 24576:DitHbptR5UngkbfXXqO7jiugTdtHxVAuN9AGFwzojqnIXxXi2+QV8epwMGq:WtR5UngkzvyPtHxWzojqnIXtl+NeBGq
TLSH
T188953A203942C13EEA9113718D78EAFA565DAD102F35D1CF63987A6A3B78DC31933627
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-06_3ba2c5edf4a15c6a230a0066d308939e_amadey_darkgate_elex_luca-stealer_lynx_njrat

File Explorer

2026-10-06_3ba2c5edf4a15c6a230a0066d308939e_amadey_darkgate_elex_luca-stealer_lynx_njrat

.exe 1.9MB

2026-10-06_3ba2c5edf4a15c6a230a0066d308939e_amadey_darkgate_elex_luca-stealer_lynx_njrat

IMPHASH 9071e050024b691ff30e815dde620015
SHA256 09a62a4dfc343717aa701bc9ef1f5cf2aa64bfe5f047cef3398bed55b0d63bcb
MD5 3ba2c5edf4a15c6a230a0066d308939e
SHA1 952d9a452aa94d9d8bc0d60fec74602c944b066e
SHA512 25d3f6f80ec05c023daa863cffaa8a7b421c3ce984088eebcd24483183dd0db0c2c642cfee7b7fa811a51303a61bdd7e0e6eccf3dd7f5c1a986734510adc1fe6
SSDEEP 24576:DitHbptR5UngkbfXXqO7jiugTdtHxVAuN9AGFwzojqnIXxXi2+QV8epwMGq:WtR5UngkzvyPtHxWzojqnIXtl+NeBGq
TLSH
T188953A203942C13EEA9113718D78EAFA565DAD102F35D1CF63987A6A3B78DC31933627
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

602197

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\gitlab\builds\aCoD4X3k\0\qingyun\qingyuninput\ivan\output\KafanInputService.pdb

imm32

ImmDisableIME

rime

RimeFreeStatus RimeGetStatus rime_get_api RimeConfigNext RimeConfigBeginMap RimeConfigGetString RimeConfigGetBool RimeConfigGetInt RimeGetProperty RimeSchemaOpen RimeConfigSetBool RimeConfigEnd RimeSetOption RimeDeleteCandidate RimeFixAtFirst RimeSetProperty RimeConfigSetInt RimeClearComposition RimeCommitComposition RimeIsKeyEaten RimeProcessKey RimeDestroySession RimeCreateSession RimeFindSession RimeFinalize RimeConfigOpen RimeStartMaintenance RimeInitialize RimeSetNotificationHandler RimeSetup RimeConfigGetCString RimeConfigClose RimeConfigSetString RimeUserConfigOpen RimeGetOption

kernel32

GetProcAddress LoadLibraryExW LoadResource SizeofResource FindResourceW LoadLibraryW LocalAlloc LocalFree lstrcmpiW IsBadWritePtr VerifyVersionInfoW MultiByteToWideChar CreateToolhelp32Snapshot Thread32First Thread32Next HeapAlloc HeapFree GetProcessHeap SetEvent CreateEventA CreateEventW FormatMessageW WideCharToMultiByte WaitForSingleObjectEx CreateMutexW GetModuleFileNameA FindResourceA LockResource InitializeCriticalSectionEx Sleep QueryPerformanceCounter QueryPerformanceFrequency WaitNamedPipeW SetNamedPipeHandleState CreateFileW WriteFile FlushFileBuffers DisconnectNamedPipe ReadFile CreateNamedPipeW ConnectNamedPipe GetModuleHandleExW SleepEx ExpandEnvironmentStringsW HeapSize HeapReAlloc HeapDestroy FileTimeToSystemTime SystemTimeToFileTime GetLocalTime GetTempPathW SetErrorMode GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameW GetCurrentProcess GetExitCodeProcess Process32FirstW Process32NextW GetFileAttributesW DeleteFileW FindFirstFileW SetFileAttributesW FindNextFileW FindClose RemoveDirectoryW GetFileSize CopyFileW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitOnceInitialize InitOnceExecuteOnce InitOnceBeginInitialize InitOnceComplete InitializeConditionVariable WakeConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime GetTickCount64 GetModuleHandleA GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetTickCount TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread GetStringTypeW GetStartupInfoW ResetEvent TerminateProcess UnhandledExceptionFilter LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer WriteConsoleW OutputDebugStringW IsDebuggerPresent FreeLibrary UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualQuery GetVersionExW CreateProcessW ResumeThread SuspendThread OpenThread GetCurrentThreadId GetCurrentProcessId WaitForSingleObject LeaveCriticalSection EnterCriticalSection InitializeCriticalSection SetLastError SetUnhandledExceptionFilter CloseHandle CreateDirectoryW GetCommandLineW VerSetConditionMask DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError RaiseException DecodePointer ReleaseSemaphore WaitForMultipleObjectsEx OpenEventA SetWaitableTimer GetSystemInfo GetLogicalProcessorInformation CreateWaitableTimerA RtlUnwind InterlockedFlushSList GetConsoleMode ReadConsoleW GetConsoleCP ExitProcess GetStdHandle CreateThread ExitThread FreeLibraryAndExitThread GetCurrentThread GetFileType GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetConsoleCtrlHandler SetStdHandle SetFilePointerEx HeapQueryInformation FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA SetEnvironmentVariableW GetTimeZoneInformation GetFileSizeEx GetModuleHandleW OpenProcess

user32

WindowFromPoint MoveWindow UpdateLayeredWindow ReleaseDC SystemParametersInfoW IsRectEmpty GetKeyState SendInput GetSystemMetrics UnregisterClassW DefWindowProcW DestroyWindow CharNextW wsprintfW SetWindowTextW PostQuitMessage MonitorFromWindow GetWindowThreadProcessId CloseDesktop OpenDesktopW AllowSetForegroundWindow WaitForInputIdle LoadStringW LoadCursorW GetDC IsWindow PostMessageW DispatchMessageW TranslateMessage GetMessageW SetWindowPos ScreenToClient GetMonitorInfoW EnableWindow ShowWindow GetDlgItem CallWindowProcW CreateWindowExW GetWindowLongW SetWindowLongW GetWindowRect GetClassInfoExW RegisterClassExW PeekMessageW

gdi32

GetObjectW CreateCompatibleDC SelectObject DeleteDC TextOutW

advapi32

BuildExplicitAccessWithNameW GetNamedSecurityInfoW ConvertSidToStringSidW CreateProcessAsUserW SetTokenInformation ConvertStringSidToSidW DuplicateTokenEx GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation OpenProcessToken RegSetKeySecurity AddAccessAllowedAce InitializeAcl GetLengthSid RegRestoreKeyW RegSaveKeyW RegEnumValueW RegQueryValueExW RegOpenKeyW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW ConvertStringSecurityDescriptorToSecurityDescriptorW SetEntriesInAclW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey GetUserNameW SetSecurityDescriptorSacl SetSecurityDescriptorDacl InitializeSecurityDescriptor GetSecurityDescriptorSacl FreeSid AllocateAndInitializeSid LookupAccountSidW GetAclInformation GetSecurityDescriptorDacl AdjustTokenPrivileges LookupPrivilegeValueW AccessCheck SetNamedSecurityInfoW IsValidSid GetSidIdentifierAuthority GetAce GetSidLengthRequired InitializeSid AddAce GetFileSecurityW DuplicateToken MapGenericMask

shell32

ord165 SHGetFolderPathW ShellExecuteW

ole32

CoInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoUninitialize CoCreateGuid

oleaut32

SysFreeString VarUI4FromStr

shlwapi

PathFileExistsW PathRemoveFileSpecW PathAppendW PathAddBackslashW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-06_3ba2c5edf4a15c6a230a0066d308939e_amadey_darkgate_elex_luca-stealer_lynx_njrat

imm32

rime

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

generic