2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat
Size 3.3MB
Sample261006-tmlnma1yev
SHA256 e2760255374e4de30916a4e133b90e83d383f93137bec86f9130ddca8edb1f07
MD5 bb64a0caddf1be79707b5bb950a6034e
SHA1 13ab055bbb6f9a984696f74494140b31875b5a57
SHA512 ba443cb9ebc53c7a5851fde5968aed16c222d44d81ecb8a3227c131f167b0f4ba246f401f92115e59c604260137452b4fe732aa4798bddd7ac87b959ec6b1a97
SSDEEP 49152:1ZbqCBYywXtNnM2wAeyfvE0Z3R0vnxn1o2d5XQ1LNiXicJFFRGNzj3:3OCBYywXtUAeKtEnW2fA7wRGpj3
TLSH
T12CF5AF31B2D18120D1B3D270297EB7EA5B75BC256F76408F32D8BA390B725C09D75B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat

File Explorer

2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat

.exe 3.3MB

2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat

IMPHASH df946247d8a78704909334dc27b7cef5
SHA256 e2760255374e4de30916a4e133b90e83d383f93137bec86f9130ddca8edb1f07
MD5 bb64a0caddf1be79707b5bb950a6034e
SHA1 13ab055bbb6f9a984696f74494140b31875b5a57
SHA512 ba443cb9ebc53c7a5851fde5968aed16c222d44d81ecb8a3227c131f167b0f4ba246f401f92115e59c604260137452b4fe732aa4798bddd7ac87b959ec6b1a97
SSDEEP 49152:1ZbqCBYywXtNnM2wAeyfvE0Z3R0vnxn1o2d5XQ1LNiXicJFFRGNzj3:3OCBYywXtUAeKtEnW2fA7wRGpj3
TLSH
T12CF5AF31B2D18120D1B3D270297EB7EA5B75BC256F76408F32D8BA390B725C09D75B2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

620655

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Jenkins\workspace\MBAM-Windows\A_MB5_MBSetup\bin\Win32\Release\MBSetup.pdb

kernel32

LeaveCriticalSection EnterCriticalSection GetLastError MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW InitializeCriticalSectionEx DeleteCriticalSection RaiseException IsWow64Process GetCurrentProcess VerifyVersionInfoW VerSetConditionMask GetSystemDirectoryW CreateFileW DeviceIoControl CloseHandle GetCurrentThreadId CreateEventW SetLastError LockResource FindResourceExW Sleep DeleteFileW GlobalFree WaitForSingleObject LocalFree FormatMessageW LocalAlloc CallNamedPipeW GetWindowsDirectoryW SetCurrentDirectoryW GetCommandLineW DecodePointer lstrcmpiW GetNativeSystemInfo GetDiskFreeSpaceExW FindFirstFileW FindClose CreateProcessW FindNextFileW WideCharToMultiByte GlobalAlloc GlobalLock SetThreadUILanguage LoadLibraryW CreateDirectoryW GetLogicalDrives GetTempPathW MoveFileExW InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList OpenProcess ResumeThread TerminateProcess GetCurrentProcessId GetModuleFileNameA ProcessIdToSessionId CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLogicalDriveStringsW QueryDosDeviceW OutputDebugStringW GetLocalTime GetExitCodeProcess GetFileSizeEx GetFileAttributesW WriteConsoleW SetStdHandle SetEnvironmentVariableW GetProcAddress GetModuleHandleW FreeLibrary GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy CreateMutexW MulDiv FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW SetEndOfFile LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW ReadFile SetFilePointerEx GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA FormatMessageA GetStringTypeW GetLocaleInfoEx FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle AreFileApisANSI CopyFileW GetFileInformationByHandleEx QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive EncodePointer LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime GetCPInfo IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetCommandLineA GetStdHandle WriteFile GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode

dwmapi

DwmGetWindowAttribute

crypt32

CertFreeCertificateContext CertGetNameStringW CertFindCertificateInStore CryptMsgClose CertCloseStore CryptMsgGetParam CryptQueryObject

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat

kernel32

dwmapi

crypt32

rpcrt4

wtsapi32

wintrust

generic