2026-10-16_623d99704b5cf288a673b6fbbaad485b_amadey_darkgate_elex_hijackloader_lockergoga_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-16_623d99704b5cf288a673b6fbbaad485b_amadey_darkgate_elex_hijackloader_lockergoga_luca-stealer_lynx_njrat
Size 1.4MB
Sample261017-tkpbqsas9s
SHA256 2e0bd931b3b51292b1fbcae2c6c75be07e2be203b84f291b3b46b10b2694499b
MD5 623d99704b5cf288a673b6fbbaad485b
SHA1 4afeabcb1c9cfea202e6958373a7ee12e0e6f3d1
SHA512 f81efa5f759729bd509276f2e3a018175bbfdc7ae66170a245ea03030f1df7988c434f882d91baf9109a71ae8cbba5e99caf78d68075e45b84107f73253cbd1d
SSDEEP 24576:agH90QD2yybr0oDlM/nZtxSxSEgRDKm2R7XB7ZFITqpvZUl5/yrxLwd8n5PCZK:LjibIf/Ztxe/lZFITqpBUl5/8dv56ZK
TLSH
T12265BF32B681C072E45310718AA96F26D9BDF9202B6145DBA3D03F4D9E305E35E37BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-16_623d99704b5cf288a673b6fbbaad485b_amadey_darkgate_elex_hijackloader_lockergoga_luca-stealer_lynx_njrat

.exe 1.4MB

2026-10-16_623d99704b5cf288a673b6fbbaad485b_amadey_darkgate_elex_hijackloader_lockergoga_luca-stealer_lynx_njrat

IMPHASH 50ddde27c2e914641b967973bc608133
SHA256 2e0bd931b3b51292b1fbcae2c6c75be07e2be203b84f291b3b46b10b2694499b
MD5 623d99704b5cf288a673b6fbbaad485b
SHA1 4afeabcb1c9cfea202e6958373a7ee12e0e6f3d1
SHA512 f81efa5f759729bd509276f2e3a018175bbfdc7ae66170a245ea03030f1df7988c434f882d91baf9109a71ae8cbba5e99caf78d68075e45b84107f73253cbd1d
SSDEEP 24576:agH90QD2yybr0oDlM/nZtxSxSEgRDKm2R7XB7ZFITqpvZUl5/yrxLwd8n5PCZK:LjibIf/Ztxe/lZFITqpBUl5/8dv56ZK
TLSH
T12265BF32B681C072E45310718AA96F26D9BDF9202B6145DBA3D03F4D9E305E35E37BA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

13:83:7f:f2:3f:c4:37:42:3b:9f:b2:54:13:96:78:bb:6f:65:0a:b0:aa:fa:74:81:7d:b5:e7:63:39:b3:6d:00

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Symantec Corporation,O=Symantec Corporation,L=San Jose,ST=California,C=US

Chains

Jan 27, 2025

CN=Symantec Corporation,O=Symantec Corporation,L=San Jose,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Symantec Corporation,O=Symantec Corporation,L=San Jose,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Symantec Corporation,O=Symantec Corporation,L=San Jose,ST=California,C=US

Serial Number

0e:59:30:9b:83:6b:fb:49:db:a2:23:e2:38:02:88:9b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 3, 2023 - Oct 23, 2026

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

848432

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Bld_area\SEP_14.3-RU10_CM-Build\Output\Install\Bin.iru\setiCollect.pdb

kernel32

TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId GetVersionExW UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA DeleteFileW HeapReAlloc CloseHandle GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress CreateFileMappingA LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers GetLogicalDriveStringsW GetDriveTypeW GetVolumeInformationW GetDiskFreeSpaceExW ExpandEnvironmentStringsW LoadLibraryExW RaiseException InitializeCriticalSectionEx GetModuleHandleW DecodePointer GetSystemDirectoryW FindFirstFileW FindNextFileW FindClose GetCurrentProcess LocalAlloc ReadFile LockResource LoadResource FindResourceW FindResourceExW lstrlenW InitializeCriticalSectionAndSpinCount GetModuleFileNameW VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree OpenProcess lstrlenA CreateEventW SetEvent ResetEvent CreateSemaphoreW ReleaseSemaphore WaitForMultipleObjectsEx WaitForMultipleObjects WriteConsoleW ReadConsoleW SetStdHandle FindFirstFileExW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage SetFilePointerEx GetConsoleMode GetConsoleCP GetFileType GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetCommandLineW GetCommandLineA GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread SetLastError SizeofResource AreFileApisANSI EncodePointer GetStringTypeW LoadLibraryExA VirtualProtect VirtualQuery

user32

MsgWaitForMultipleObjectsEx PeekMessageW IsWindowUnicode GetMessageA GetMessageW TranslateMessage DispatchMessageW DispatchMessageA

ole32

CoUninitialize CoInitializeEx CoInitializeSecurity CoCreateInstance CoSetProxyBlanket StringFromGUID2 CLSIDFromString

oleaut32

SysAllocStringByteLen SysFreeString SysStringByteLen SafeArrayAccessData SafeArrayUnaccessData SafeArrayCreateVector SafeArrayLock SafeArrayPtrOfIndex SafeArrayUnlock SafeArrayCreate VariantCopyInd VariantInit VariantClear SysAllocString

secur32

LsaGetLogonSessionData LsaEnumerateLogonSessions LsaFreeReturnBuffer

iphlpapi

GetAdaptersAddresses

rpcrt4

UuidCreate

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

208KB

Virtual Size

207KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

184B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_623d99704b5cf288a673b6fbbaad485b_amadey_darkgate_elex_hijackloader_lockergoga_luca-stealer_lynx_njrat

kernel32

user32

ole32

oleaut32

secur32

iphlpapi

rpcrt4

generic