2026-10-10_a40d53bb5cf3d20b75accea912dfc394_amadey_darkgate_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-10_a40d53bb5cf3d20b75accea912dfc394_amadey_darkgate_elex_luca-stealer_lynx_njrat
Size 2.0MB
Sample261011-hcprradb84
SHA256 0f7dd14128b1816e2befbe3001360c52dcd48fb5efc6782eeb1b0ac82835584d
MD5 a40d53bb5cf3d20b75accea912dfc394
SHA1 1c6b65f868a90e593d1b8ed2dba90ed28a03de15
SHA512 1f6f985fda344a60bea03f8d95fcb219d5f499477375a189857e95e5a612199e4d4b0133f005c7c155e3ea3cbd3bde295efee69bffcf4b88f53c14ed1a2152d4
SSDEEP 49152:nfb4J+XM8VRXc9WsoN/j2U4FHpVsWJe+Zs6GFL:n0J+XM8V2bUj2jFvsy4
TLSH
T10CA50127B5A1C03BC17909711E5973A126EDBD29892ED3A72A9433BD1F789F00E27533
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_a40d53bb5cf3d20b75accea912dfc394_amadey_darkgate_elex_luca-stealer_lynx_njrat

File Explorer

2026-10-10_a40d53bb5cf3d20b75accea912dfc394_amadey_darkgate_elex_luca-stealer_lynx_njrat

.exe 2.0MB

2026-10-10_a40d53bb5cf3d20b75accea912dfc394_amadey_darkgate_elex_luca-stealer_lynx_njrat

IMPHASH 94dace2a4f2b30f7b223e61e366e5b0d
SHA256 0f7dd14128b1816e2befbe3001360c52dcd48fb5efc6782eeb1b0ac82835584d
MD5 a40d53bb5cf3d20b75accea912dfc394
SHA1 1c6b65f868a90e593d1b8ed2dba90ed28a03de15
SHA512 1f6f985fda344a60bea03f8d95fcb219d5f499477375a189857e95e5a612199e4d4b0133f005c7c155e3ea3cbd3bde295efee69bffcf4b88f53c14ed1a2152d4
SSDEEP 49152:nfb4J+XM8VRXc9WsoN/j2U4FHpVsWJe+Zs6GFL:n0J+XM8V2bUj2jFvsy4
TLSH
T10CA50127B5A1C03BC17909711E5973A126EDBD29892ED3A72A9433BD1F789F00E27533
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

306751

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\data\landun\workspace\product\win32\dbginfo\KCommonUninstaller.pdb

kernel32

VerifyVersionInfoW VerSetConditionMask lstrlenW FreeResource GetLongPathNameW SetFileAttributesW lstrcmpW CreateFileMappingW MapViewOfFileEx UnmapViewOfFile lstrcmpiW LoadLibraryExW GetCommandLineW GetCurrentProcessId K32GetModuleFileNameExW OutputDebugStringW GetExitCodeThread OpenEventW CreateEventW SetEvent QueryPerformanceFrequency GlobalLock GlobalAlloc GlobalFree GlobalUnlock GetPrivateProfileIntW OutputDebugStringA WaitForMultipleObjects TerminateThread WriteConsoleW GetConsoleOutputCP GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW OpenMutexW LCMapStringW CompareStringW GetTimeZoneInformation GetFileSizeEx GetConsoleMode SetFilePointerEx GetFileType GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread GetFileAttributesExW GetCommandLineA TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent GetSystemTime EnterCriticalSection InitializeCriticalSection LeaveCriticalSection GetWindowsDirectoryW MoveFileExW GetTickCount GetLocalTime WideCharToMultiByte MultiByteToWideChar CopyFileW FlushFileBuffers GetFileSize LocalFree CreateFileW LocalAlloc SetFilePointer WriteFile ReadFile GetSystemDirectoryW GetVersionExW Sleep FreeLibrary GetModuleHandleW CreateProcessW GetProcAddress LoadLibraryW CloseHandle Process32FirstW Process32NextW CreateToolhelp32Snapshot GetLogicalDriveStringsW OpenProcess WaitForSingleObject TerminateProcess GetCurrentProcess SetLastError QueryDosDeviceW GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc FindResourceW LoadResource FindResourceExW RaiseException HeapReAlloc DeleteFileW LockResource GetLastError HeapSize GetFileAttributesW FindClose InitializeCriticalSectionEx GetModuleFileNameW RemoveDirectoryW FindNextFileW HeapFree GetCurrentThreadId FindFirstFileW SizeofResource VirtualQuery

user32

DispatchMessageW GetWindow UnregisterClassW IsWindowVisible GetWindowThreadProcessId SendMessageW GetDlgCtrlID GetDesktopWindow ReleaseDC MapWindowPoints CreateWindowExW RegisterClassExW GetClassInfoExW WindowFromPoint GetScrollPos GetFocus IsChild IsDialogMessageW GetKeyState MonitorFromWindow GetMonitorInfoW CharNextW IntersectRect ClientToScreen LoadBitmapW SetWindowTextW DrawTextW InflateRect GetDC SetRect TranslateMessage GetMessageW PeekMessageW ScreenToClient GetCursorPos PtInRect SetCursor LoadCursorW IsWindow SetRectEmpty PostThreadMessageW GetActiveWindow IsWindowEnabled EnableWindow GetForegroundWindow SystemParametersInfoW SetWindowPos AttachThreadInput SetForegroundWindow SetActiveWindow DestroyWindow RegisterWindowMessageW PostMessageW SetWindowLongW GetWindowLongW DefWindowProcW CallWindowProcW SetTimer KillTimer UpdateLayeredWindow GetWindowRect GetClientRect EndPaint BeginPaint GetParent GetDlgItem InvalidateRect CopyRect GetNextDlgTabItem SetFocus ReleaseCapture SetCapture MoveWindow EqualRect IsRectEmpty IsIconic LoadImageW UnionRect ShowWindow DrawIconEx DestroyIcon OffsetRect LoadIconW

gdi32

BitBlt CreateRectRgnIndirect CombineRgn RectInRegion ExtTextOutW CreateDIBSection Rectangle GetCurrentObject StretchBlt SetTextColor SetBkMode SetBkColor DeleteDC CreateCompatibleDC SelectObject GetObjectW GetStockObject CreateFontIndirectW DeleteObject CreateBitmap CreateCompatibleBitmap SetGraphicsMode SelectClipRgn RestoreDC TextOutW GetTextExtentPoint32W SaveDC LineTo MoveToEx CreatePen GetClipRgn CreateRectRgn RoundRect GetViewportOrgEx ExtSelectClipRgn CreateDCW GetDIBits SetStretchBltMode GetStretchBltMode GetRgnBox CreateRoundRectRgn SetWindowOrgEx GetWindowOrgEx SetViewportOrgEx GetTextColor OffsetRgn

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegOpenKeyW RegCreateKeyExW RegCloseKey ControlService StartServiceW QueryServiceStatus DeleteService ChangeServiceConfig2W ChangeServiceConfigW OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW SetNamedSecurityInfoW GetNamedSecurityInfoW RegQueryInfoKeyW RegDeleteValueW RegEnumKeyExW RegSetValueExW RegDeleteKeyW RegOpenKeyExW RegQueryValueExW

shell32

ShellExecuteExW ShellExecuteW SHGetSpecialFolderPathW ord680 SHGetFolderPathW

ole32

CreateStreamOnHGlobal CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoUninitialize CoCreateInstance CoInitialize CoInitializeEx

oleaut32

SysStringLen SysAllocString SysFreeString VarUI4FromStr

shlwapi

StrToIntW StrToIntA PathFileExistsW PathFindFileNameW PathAddBackslashW PathAppendW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

comctl32

InitCommonControlsEx _TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdipCreatePath GdipImageRotateFlip GdipSetPenEndCap GdipSetPenStartCap GdipSetPenMode GdipDrawLine GdipDrawRectangleI GdipAddPathArcI GdipDrawPath GdipSetPenDashStyle GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipFillPath GdipAddPathRectangle GdipDrawImageRectI GdipSetInterpolationMode GdipSetWorldTransform GdipDeleteMatrix GdipCreateMatrix2 GdipGetImageGraphicsContext GdipCreateBitmapFromGraphics GdipFillRectangle GdipSetPixelOffsetMode GdipCreateLineBrushFromRectWithAngleI GdipLoadImageFromStream GdipCloneBitmapArea GdipGraphicsClear GdipGetImagePixelFormat GdipDrawImagePointsRectI GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromStream GdipAddPathPieI GdipSetSmoothingMode GdipSetClipPath GdipDrawImageRectRect GdipLoadImageFromFile GdipAddPathRectangleI GdipDisposeImage GdipGetImageHeight GdipTranslateWorldTransform GdipRotateWorldTransform GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipDrawImageRectRectI GdipResetWorldTransform GdipCreatePen1 GdipDeletePen GdipDrawLinesI GdipFillRectangleI GdipCreateSolidFill GdipCloneBrush GdipDeleteBrush GdipSetStringFormatFlags GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipSetTextRenderingHint GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipCreateFromHDC GdipDeleteGraphics GdipCreateFont GdipCreateFontFromLogfontW GdipDeleteFont GdipSetStringFormatAlign GdipMeasureString GdiplusShutdown GdiplusStartup GdipNewPrivateFontCollection GdipDeletePrivateFontCollection GdipPrivateAddFontFile GdipGetFontCollectionFamilyCount GdipAlloc GdipGetFontCollectionFamilyList GdipCloneFontFamily GdipDeleteFontFamily GdipFree GdipDeletePath GdipCloneImage GdipClosePathFigure GdipGetImageWidth

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_a40d53bb5cf3d20b75accea912dfc394_amadey_darkgate_elex_luca-stealer_lynx_njrat

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

comctl32

msimg32

gdiplus

generic