2026-10-19_77c87f3ad0b37747fb148a79e0e6d19e_akira_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_77c87f3ad0b37747fb148a79e0e6d19e_akira_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat
Size 20.8MB
Sample261020-ththnsby2z
SHA256 48ec884c4791e63103f367ab580474968e39706215d221b9f1917e75b65f3ea5
MD5 77c87f3ad0b37747fb148a79e0e6d19e
SHA1 c62b780232ce45a680e6b8c637f5bddcf7c7897f
SHA512 42b7ee3b6d9c5178449f7707391e694d1f61ff046856e5c4b09f65c4fb17b0c82ae57e9cb2f7ad3cf1da3b7aa112bb4af748f9b99a70ad408146a5b93024637c
SSDEEP 393216:QOTgh60cJ6uO0UsGBXnoGgrldmrTtRSHGO7hOkLcmVYQYiK5HRO47EPC:QOT9suO0U/ozrXW3wGshUQk5HRFIPC
TLSH
T173272322B6818377E5A20179DA7C7F7F846DBD25076441CBA3C82E2E0A67DD32E31617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-19_77c87f3ad0b37747fb148a79e0e6d19e_akira_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

.exe 20.8MB

2026-10-19_77c87f3ad0b37747fb148a79e0e6d19e_akira_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

IMPHASH 633d96a1375cf6d628d6b7824eec405c
SHA256 48ec884c4791e63103f367ab580474968e39706215d221b9f1917e75b65f3ea5
MD5 77c87f3ad0b37747fb148a79e0e6d19e
SHA1 c62b780232ce45a680e6b8c637f5bddcf7c7897f
SHA512 42b7ee3b6d9c5178449f7707391e694d1f61ff046856e5c4b09f65c4fb17b0c82ae57e9cb2f7ad3cf1da3b7aa112bb4af748f9b99a70ad408146a5b93024637c
SSDEEP 393216:QOTgh60cJ6uO0UsGBXnoGgrldmrTtRSHGO7hOkLcmVYQYiK5HRO47EPC:QOT9suO0U/ozrXW3wGshUQk5HRFIPC
TLSH
T173272322B6818377E5A20179DA7C7F7F846DBD25076441CBA3C82E2E0A67DD32E31617
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

2c:43:50:af:0b:17:99:2a:74:57:dc:9b:e0:c3:76:f5:9a:17:75:37:81:be:d3:a7:fe:b5:fe:39:af:1f:5c:d7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91120116MA07A8KQXQ,CN=天津微极智科技有限公司,O=天津微极智科技有限公司,ST=天津市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c27e6bba8e6b5b7e696b0e58cbae9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5a4a9e6b4a5e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Aug 20, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

09:85:12:44:f3:c2:51:f4:33:a2:1a:9f:b0:e3:a7:1f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 10, 2025 - Mar 9, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1202776

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ProgramData\Jenkins\.jenkins\workspace\MGame\AIChat\AIChat_inst_uninst(NewVersion)\bin\Inst\Release\Install.pdb

kernel32

DeleteCriticalSection EnterCriticalSection WaitForSingleObject InitializeCriticalSection GetProcessHeap HeapSize SetEvent CreateEventW Sleep WaitForMultipleObjects GetLocalTime FindResourceExW FindFirstFileW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryW MultiByteToWideChar CreateThread DecodePointer GetLastError InitializeCriticalSectionEx GetCurrentProcess ExitThread FreeLibrary GetModuleFileNameW GetModuleHandleW CreateFileW DeleteFileW GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile lstrcmpW WideCharToMultiByte AreFileApisANSI MoveFileExW CopyFileW WritePrivateProfileStringW GetPrivateProfileStringW FindNextFileW LeaveCriticalSection SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW SetStdHandle GetTimeZoneInformation HeapFree HeapReAlloc HeapAlloc HeapDestroy RaiseException CloseHandle GetConsoleOutputCP SetFilePointerEx GetFileType GetModuleHandleExW RtlUnwind IsDebuggerPresent OutputDebugStringW EncodePointer GetStringTypeW FormatMessageW TryEnterCriticalSection GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread GetExitCodeThread SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo GetCurrentProcessId OpenProcess MulDiv GetACP ExitProcess FreeResource GetFileSize ReadFile SetEndOfFile SetFilePointer SetFileTime WriteFile GetVersion GlobalAlloc GlobalUnlock GlobalLock GlobalFree GetTempFileNameW GetTempPathW ResumeThread ResetEvent IsBadReadPtr lstrcpynW lstrcpyW lstrlenW GetFileAttributesExW GetLogicalDriveStringsW QueryDosDeviceW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW K32GetProcessImageFileNameW CreateMutexW GetLongPathNameW TerminateProcess GetExitCodeProcess K32EnumProcesses FindClose GetFileAttributesW GetFullPathNameW RemoveDirectoryW SetFileAttributesW GetWindowsDirectoryW MoveFileW GetShortPathNameW GetDiskFreeSpaceExW GetDriveTypeW CreateFileA DeleteFileA GetTempPathA GetTempFileNameA FlushFileBuffers GetFileSizeEx IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead LoadLibraryExW CreateDirectoryW GetFileInformationByHandle GetStdHandle LocalFree CreateProcessW WriteConsoleW GetDynamicTimeZoneInformation VirtualFree VirtualAlloc GetConsoleScreenBufferInfo SetConsoleTextAttribute WriteConsoleA GetConsoleMode SetThreadAffinityMask ReleaseSemaphore CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA GetVersionExW VirtualProtect InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx GetSystemWindowsDirectoryW DeviceIoControl lstrcmpA

user32

IntersectRect UnionRect IsRectEmpty PtInRect GetWindowLongW SetWindowLongW GetParent GetClassNameW GetWindow MonitorFromWindow wsprintfW DefWindowProcW CallWindowProcW RegisterClassW RegisterClassExW GetClassInfoExW EnableWindow GetSystemMetrics SetPropW GetPropW LoadCursorW LoadImageW wvsprintfW SetCursor InflateRect OffsetRect IsIconic SetWindowRgn MessageBoxW GetMonitorInfoW CharPrevW DrawTextW SetRect DestroyIcon DrawIconEx GetIconInfo GetMessagePos MoveWindow GetDlgCtrlID DrawFocusRect FillRect HideCaret ShowCaret ClientToScreen GetSysColor GetWindowDC GetWindowTextW GetWindowTextLengthW CreateAcceleratorTableW InvalidateRgn RemovePropW FindWindowExW IsWindowEnabled AttachThreadInput BringWindowToTop ScreenToClient GetWindowThreadProcessId PostMessageW GetDC ReleaseDC MonitorFromPoint GetMessageW TranslateMessage DispatchMessageW SendMessageW CreateWindowExW IsChild DestroyWindow UpdateLayeredWindow IsZoomed CharNextW SetFocus PeekMessageW PostQuitMessage IsWindow SetWindowPos SetTimer KillTimer GetWindowRect SystemParametersInfoW ShowWindow GetForegroundWindow IsWindowVisible SetForegroundWindow SetWindowTextW GetFocus GetKeyState SetCapture ReleaseCapture BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect GetCursorPos CreateCaret MapWindowPoints GetCaretBlinkTime SetCaretPos

shell32

SHGetSpecialFolderPathW ord165 ShellExecuteW SHGetKnownFolderPath SHFileOperationW SHChangeNotify SHCreateDirectoryExW ShellExecuteExW

ole32

CoInitializeSecurity CoInitializeEx CoTaskMemFree OleLockRunning CLSIDFromProgID CLSIDFromString CoCreateGuid CoCreateInstance CreateStreamOnHGlobal CoUninitialize CoInitialize CoSetProxyBlanket

shlwapi

StrTrimA StrCmpNIW StrCmpIW SHSetValueA PathRenameExtensionA PathFindFileNameA StrStrIW SHDeleteKeyW wnsprintfW SHAutoComplete StrStrIA SHGetValueW PathAppendW PathFileExistsW PathCombineW SHSetValueW PathIsDirectoryW PathIsRelativeW PathFindFileNameW PathIsPrefixW PathRemoveFileSpecW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

iphlpapi

GetAdaptersInfo

setupapi

SetupIterateCabinetW

gdiplus

GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipAddPathArcI GdipAddPathLineI GdipDeletePath GdipDeletePen GdipSetPenMode GdipSetPenDashStyle GdipCreateFromHDC GdipCreatePath GdipDeleteGraphics GdipSetSmoothingMode GdipDrawLineI GdipDrawPath GdipFillEllipseI GdipClosePathFigure GdipCreateTexture GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipGetImageGraphicsContext GdipFree GdipGetImageHeight GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipCreateHBITMAPFromBitmap GdipCloneBitmapAreaI GdipBitmapLockBits GdipBitmapUnlockBits GdipSetInterpolationMode GdipGraphicsClear GdipFillPath GdipDrawImagePointsI GdipGetImageEncoders GdipAddPathArc GdipDrawEllipseI GdipLoadImageFromFile GdipGetImagePixelFormat GdipDrawImageRectI GdipLoadImageFromStreamICM GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdiplusStartup GdiplusShutdown GdipDrawImageRectRectI GdipGetImageWidth GdipAlloc GdipGetImageEncodersSize GdipDrawRectangleI

msimg32

GradientFill AlphaBlend

comctl32

_TrackMouseEvent ImageList_DrawEx ImageList_GetIconSize InitCommonControlsEx ord17

wininet

InternetGetConnectedState

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

gdi32

CreatePen DeleteDC DeleteObject GetStockObject Rectangle RestoreDC SaveDC SelectObject GetTextMetricsW GetObjectW SetWindowOrgEx CreateRoundRectRgn CombineRgn CreateRectRgnIndirect GetCharABCWidthsW GetClipBox CreateCompatibleDC SelectClipRgn ExtSelectClipRgn SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor CreateDIBSection SetDIBColorTable TextOutW ExtTextOutW CreateSolidBrush GetTextColor CreateDCW GetDIBits SetDIBitsToDevice CreateFontIndirectW CreateCompatibleBitmap BitBlt GetTextExtentPoint32W GetDeviceCaps

advapi32

RegEnumKeyExW GetTokenInformation CreateServiceW CloseServiceHandle OpenSCManagerW ChangeServiceConfig2W RegCloseKey RegCreateKeyW RegOpenKeyExW RegQueryValueExW RegSetValueExW AllocateAndInitializeSid CheckTokenMembership FreeSid RegCreateKeyExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW OpenServiceW StartServiceW ControlService DeleteService

oleaut32

SafeArrayPutElement SafeArrayCreate SysFreeString SysStringLen SysAllocStringLen VariantClear VariantInit SysAllocString

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

generic

count=37, id=259, version=30795,

count=210, id=261, version=30795,

count=2, id=260, version=27034,

count=9, id=260, version=27045,

count=20, id=261, version=27045,

count=15, id=265, version=27054,

count=11, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=3, id=199, version=41118,

count=25, id=259, version=26706,

count=1, id=260, version=27054,

count=5, id=261, version=27032,

count=64, id=261, version=27048,

count=40, id=260, version=26706,

count=136, id=261, version=26706,

count=45, id=260, version=30795,

count=37, id=257, version=30795,

count=546, id=1, productName=Unmarked objects,

count=41, id=261, version=27054,

count=1, id=256, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,