2026-10-15_f90c693a7a5211515d71873cc90e6b60_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-15_f90c693a7a5211515d71873cc90e6b60_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat
Size 8.1MB
Sample261015-2a2hbas1gx
SHA256 1955bbc78ca938d03e37fc15828b0ba64d35ffcc1ff4da9848065b7e168c1956
MD5 f90c693a7a5211515d71873cc90e6b60
SHA1 2b4a70008875bdd64d1c0d5fe76caf86ba7a4ebd
SHA512 ec1bac9ddcfcb7a2d8ec2dd722c345e3ab0b6649764721471af09b12ac338f3239888ca7e6fe610ae953eded22b2ae9b2adc1c691eed78c2ce0f255a43b21af8
SSDEEP 98304:M1JRkjg/W8NpH50FVl18oOg2A55ER+oHgs+bUTIA0+dW/MD3YYW0hbTM4a:qRk8/W8NBGFVl1mg0+Ggss4a
TLSH
T14A860950A3D68094F1B326B56A7A5AB54A377D221F34D8CFB18C6D1D0BB36C2D530B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-15_f90c693a7a5211515d71873cc90e6b60_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat

File Explorer

2026-10-15_f90c693a7a5211515d71873cc90e6b60_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat

.exe 8.1MB

2026-10-15_f90c693a7a5211515d71873cc90e6b60_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat

IMPHASH 49f0035f63fbd44961ac1b876c6625e5
SHA256 1955bbc78ca938d03e37fc15828b0ba64d35ffcc1ff4da9848065b7e168c1956
MD5 f90c693a7a5211515d71873cc90e6b60
SHA1 2b4a70008875bdd64d1c0d5fe76caf86ba7a4ebd
SHA512 ec1bac9ddcfcb7a2d8ec2dd722c345e3ab0b6649764721471af09b12ac338f3239888ca7e6fe610ae953eded22b2ae9b2adc1c691eed78c2ce0f255a43b21af8
SSDEEP 98304:M1JRkjg/W8NpH50FVl18oOg2A55ER+oHgs+bUTIA0+dW/MD3YYW0hbTM4a:qRk8/W8NBGFVl1mg0+Ggss4a
TLSH
T14A860950A3D68094F1B326B56A7A5AB54A377D221F34D8CFB18C6D1D0BB36C2D530B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

3a:a4:da:5c:e8:99:63:0a:bc:8a:a7:49:4b:ac:86:40:7e:bf:83:af:07:1e:e7:27:5b:e7:ce:80:fc:75:17:93

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 13, 2023

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0c:28:96:11:07:88:b1:29:82:5f:b1:d1:f6:ba:ac:a3

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2022 - May 1, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

3582555

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\ccd-hyperdrive\main\native\win32\build\msvs_win32_x86\Release\x86\sym\HDBootStrapper\HDBootStrapper\Set-up.pdb

kernel32

FindFirstFileW SetLastError FindNextFileW lstrlenW RemoveDirectoryW GetModuleFileNameW GetTempPathW FindClose LocalAlloc CreateFileW GetFileAttributesW SetFileAttributesW FormatMessageW GetLastError GetDiskFreeSpaceExW DeleteFileW CloseHandle GetCurrentDirectoryW SetCurrentDirectoryW LocalFree MoveFileExW CopyFileW lstrcmpiW lstrcmpW GetDriveTypeW GetCurrentProcess ReadFile WaitForSingleObject GetProcAddress CreateProcessW GetModuleHandleW GetExitCodeProcess InitializeCriticalSectionEx DecodePointer DeleteCriticalSection TerminateProcess OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep Process32NextW Process32FirstW LoadLibraryW FreeLibrary WideCharToMultiByte HeapFree HeapSize HeapReAlloc HeapAlloc HeapDestroy GetProcessHeap EnterCriticalSection LeaveCriticalSection GetCurrentThreadId GlobalAlloc RaiseException GlobalLock GlobalUnlock MulDiv GetStdHandle AttachConsole FreeConsole GetConsoleWindow CreateMutexW ReleaseMutex GetSystemDirectoryW SetDllDirectoryW GetVersionExW GetFullPathNameW OpenMutexW SetWaitableTimer CreateWaitableTimerW WaitForMultipleObjects CancelWaitableTimer CreateEventW SetEvent ResetEvent GetOverlappedResult ReadDirectoryChangesW GetFileSizeEx GetLocalTime GetTimeFormatW GetDateFormatW SetHandleInformation ExpandEnvironmentStringsW DeviceIoControl CreatePipe GetComputerNameExW FileTimeToSystemTime GetNativeSystemInfo GetWindowsDirectoryW VerSetConditionMask VerifyVersionInfoW InitializeCriticalSection GetCurrentProcessId GetLocaleInfoA EnumSystemLocalesW GetUserDefaultLangID GetUserDefaultUILanguage GetACP WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA LoadLibraryA LCMapStringW GetUserDefaultLCID SizeofResource WriteFile LockResource LoadResource FindResourceW GetFileSize FlushFileBuffers GetCurrentThread GlobalFree CreateThread SetFilePointer ProcessIdToSessionId TerminateThread FindResourceExW QueryFullProcessImageNameW GetFileInformationByHandle CreateNamedPipeW ConnectNamedPipe CreateDirectoryW ReleaseSemaphore OpenSemaphoreW CreateSemaphoreW GetTimeZoneInformation SystemTimeToFileTime VirtualFree VirtualAlloc CreateFileA AreFileApisANSI TryEnterCriticalSection HeapCreate GetDiskFreeSpaceW OutputDebugStringA LockFile GetFullPathNameA SetEndOfFile UnlockFileEx UnmapViewOfFile HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile WaitForSingleObjectEx DeleteFileA HeapCompact UnlockFile LockFileEx GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount SetFilePointerEx ResumeThread SetThreadPriority QueryPerformanceFrequency GetStringTypeW InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW IsProcessorFeaturePresent FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive GetLocaleInfoEx InitOnceComplete InitOnceBeginInitialize GetExitCodeThread EncodePointer LCMapStringEx CompareStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent GetStartupInfoW InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime SetStdHandle ExitThread FreeLibraryAndExitThread ExitProcess CompareStringW GetLocaleInfoW IsValidLocale GetConsoleOutputCP GetConsoleMode ReadConsoleW FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentVariableW

ws2_32

getnameinfo WSAStartup WSACleanup

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-15_f90c693a7a5211515d71873cc90e6b60_amadey_darkgate_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat

PE Signature issue

kernel32

ws2_32

generic