2026-10-14_514db26a1a42b70ed436084119c1b08b_amadey_darkgate_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-14_514db26a1a42b70ed436084119c1b08b_amadey_darkgate_elex_luca-stealer_lynx_njrat
Size 2.2MB
Sample261014-1ffmcsab92
SHA256 afa5c1b06c71f0006f6efefdc9cf5ef7dde5018c13bbb1daed9cb0274787346b
MD5 514db26a1a42b70ed436084119c1b08b
SHA1 4ac73d3ca70e3314db627244a77737b7376d4dee
SHA512 44a83d44736a53fc76b36f00a47b57b8bab715f2de7db887bc064a08409c4b4b4c76c770255d34d956d27861ec137882b70c2832024d120c3137289d80c8b10c
SSDEEP 24576:5KQ1f+09TgA2WNzd+cl1S0rrexTJKMcOJ4moeE0QFtLPQqu8hCEl4kiUS5Wq4ucO:8Sm0932arexTwMfJfmtLIIjlbq4iWN6
TLSH
T10FB5BE22F922E172D4D200B194B6BFE2A9EC6F21932544CBA3D0BF3B75191D32536B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-14_514db26a1a42b70ed436084119c1b08b_amadey_darkgate_elex_luca-stealer_lynx_njrat

File Explorer

2026-10-14_514db26a1a42b70ed436084119c1b08b_amadey_darkgate_elex_luca-stealer_lynx_njrat

.exe 2.2MB

2026-10-14_514db26a1a42b70ed436084119c1b08b_amadey_darkgate_elex_luca-stealer_lynx_njrat

IMPHASH 0764dcb1f319e24940b94c28027927e1
SHA256 afa5c1b06c71f0006f6efefdc9cf5ef7dde5018c13bbb1daed9cb0274787346b
MD5 514db26a1a42b70ed436084119c1b08b
SHA1 4ac73d3ca70e3314db627244a77737b7376d4dee
SHA512 44a83d44736a53fc76b36f00a47b57b8bab715f2de7db887bc064a08409c4b4b4c76c770255d34d956d27861ec137882b70c2832024d120c3137289d80c8b10c
SSDEEP 24576:5KQ1f+09TgA2WNzd+cl1S0rrexTJKMcOJ4moeE0QFtLPQqu8hCEl4kiUS5Wq4ucO:8Sm0932arexTwMfJfmtLIIjlbq4iWN6
TLSH
T10FB5BE22F922E172D4D200B194B6BFE2A9EC6F21932544CBA3D0BF3B75191D32536B57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

538648

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\git\crashpad\build_crashpad-master\crashpad\out\x86\crashpad_handler.pdb

kernel32

EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection SetLastError GetModuleFileNameW GetFileInformationByHandleEx GetCurrentProcess RegisterWaitForSingleObject GetQueuedCompletionStatus WaitForSingleObject DuplicateHandle DisconnectNamedPipe OpenProcess PostQueuedCompletionStatus CreateEventW SetEvent CreateThread UnregisterWaitEx CreateIoCompletionPort ConnectNamedPipe ExitProcess SetNamedPipeHandleState CreateNamedPipeW GetVersion TransactNamedPipe WaitNamedPipeW LoadLibraryW GetProcAddress FindClose TerminateProcess ReleaseSemaphore CreateSemaphoreW GetStdHandle WriteFile SetEndOfFile UnlockFileEx SetFilePointerEx LockFileEx GetFileType GetModuleHandleW FormatMessageA LocalFree CreateDirectoryW GetFileAttributesW DeleteFileW GetTimeZoneInformation GetSystemInfo IsProcessorFeaturePresent VerSetConditionMask VerifyVersionInfoW GetProcessId SuspendThread ResumeThread GetThreadContext GetProcessTimes GetSystemDefaultLCID GetThreadLocale GetUserDefaultLCID GetPrivateProfileStringW CreateProcessW IsWow64Process WriteProcessMemory RtlCaptureContext Sleep VirtualAllocEx ReadProcessMemory SleepEx IsDebuggerPresent SizeofResource MultiByteToWideChar LockResource GlobalAlloc GlobalFree FindResourceExW IsDBCSLeadByte LoadResource FindResourceW GlobalLock lstrcpyW GlobalUnlock GetPrivateProfileSectionW VirtualFree VirtualAlloc VirtualProtect DeviceIoControl WideCharToMultiByte GetFullPathNameW GetCurrentProcessId GetLocalTime OutputDebugStringW FormatMessageW GetCurrentThreadId CloseHandle CreateFileW GetFileSizeEx ReadFile SetUnhandledExceptionFilter GetProcessHeap DeleteCriticalSection GetCurrentDirectoryW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW HeapDestroy SwitchToThread InitializeCriticalSection VirtualQueryEx GetFileTime RemoveDirectoryW WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetModuleHandleExW GetCommandLineW GetCommandLineA LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind GetStartupInfoW InitializeSListHead UnhandledExceptionFilter GetCPInfo GetStringTypeW GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable InitOnceExecuteOnce AcquireSRWLockExclusive ReleaseSRWLockExclusive DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionEx SetProcessShutdownParameters HeapFree CreateFileA SetConsoleCtrlHandler LCMapStringEx EncodePointer QueryPerformanceCounter

advapi32

ImpersonateNamedPipeClient RevertToSelf BuildSecurityDescriptorW ConvertStringSecurityDescriptorToSecurityDescriptorW BuildExplicitAccessWithNameW RegQueryValueExW RegOpenKeyExW RegQueryValueExA RegCloseKey SystemFunction036 RegOpenKeyExA

user32

SetWindowLongW DestroyWindow PostMessageW DispatchMessageW UnregisterClassW GetWindowLongW EnableWindow TranslateMessage RegisterClassW DefWindowProcW EndPaint BeginPaint InvalidateRect LoadImageW DialogBoxParamW GetSysColorBrush KillTimer GetMessageW CreateWindowExW DrawIconEx DrawTextW GetDlgItem GetClientRect MapDialogRect SetClipboardData SendDlgItemMessageW MapWindowPoints SetDlgItemTextW EmptyClipboard CloseClipboard ClientToScreen SetTimer OpenClipboard GetWindowTextLengthW EndDialog GetWindowTextW GetWindowThreadProcessId GetMenuItemCount CreatePopupMenu TrackPopupMenu IsWindow RegisterClipboardFormatW GetKeyState CallWindowProcW GetWindowRect SetWindowPos SendMessageW SetWindowTextW ShowWindow DestroyMenu

winhttp

WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpWriteData WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts WinHttpQueryHeaders WinHttpConnect WinHttpCrackUrl

powrprof

CallNtPowerInformation

ole32

CoTaskMemFree CoCreateGuid StringFromCLSID OleInitialize DoDragDrop OleUninitialize

shlwapi

PathFileExistsW PathRemoveFileSpecW

gdiplus

GdiplusStartup

comctl32

ImageList_ReplaceIcon ImageList_Create InitCommonControlsEx

gdi32

DeleteObject SetBkMode SetTextColor GetStockObject CreateFontW SelectObject

oleaut32

SysFreeString SysStringLen SysAllocString SysAllocStringByteLen SysStringByteLen

shell32

SHBindToParent ord155 SHGetFileInfoW ShellExecuteW SHGetDesktopFolder

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Name

.text

Size

691KB

Virtual Size

691KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

170KB

Virtual Size

169KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-14_514db26a1a42b70ed436084119c1b08b_amadey_darkgate_elex_luca-stealer_lynx_njrat

kernel32

advapi32

user32

winhttp

powrprof

ole32

shlwapi

gdiplus

comctl32

gdi32

oleaut32

shell32

version

generic