2026-10-21_7ce99d26f64e6720c7851845e668c341_amadey_darkgate_elex_luca-stealer_magniber_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-21_7ce99d26f64e6720c7851845e668c341_amadey_darkgate_elex_luca-stealer_magniber_njrat
Size 3.9MB
Sample261022-yzn2qsft2t
SHA256 62e87ee86ce03569d2715e2c99da723ab24eecc5df2b486ef97340665a5fe5e6
MD5 7ce99d26f64e6720c7851845e668c341
SHA1 f09a54ce2cd952a27fe71b559f94b6de2260fbb5
SHA512 43bda298ddfb1a9369a48ae44f518c295af6a149c6ab2dd0938864a2ca3ced7a16985a8d154121928314033791ea3efb05f06779662acc9514aef2990058487f
SSDEEP 49152:m/WtfjpoZx37KbKrOh2GHcuLiEyfUrIPoikcJSI2rF5+5LDLDezE29Eh1GCETXgq:mWMZx37KZhgEyf5J7SI2a53ez/9Eh1fO
TLSH
T17E167B22B34580FDD02721B0290DD3894379FD304B72A1DBB7D9A39D2E615C5ABBBA53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-21_7ce99d26f64e6720c7851845e668c341_amadey_darkgate_elex_luca-stealer_magniber_njrat

.exe 3.9MB

2026-10-21_7ce99d26f64e6720c7851845e668c341_amadey_darkgate_elex_luca-stealer_magniber_njrat

IMPHASH 9f26d063622977d8e684e6ad5e8b227f
SHA256 62e87ee86ce03569d2715e2c99da723ab24eecc5df2b486ef97340665a5fe5e6
MD5 7ce99d26f64e6720c7851845e668c341
SHA1 f09a54ce2cd952a27fe71b559f94b6de2260fbb5
SHA512 43bda298ddfb1a9369a48ae44f518c295af6a149c6ab2dd0938864a2ca3ced7a16985a8d154121928314033791ea3efb05f06779662acc9514aef2990058487f
SSDEEP 49152:m/WtfjpoZx37KbKrOh2GHcuLiEyfUrIPoikcJSI2rF5+5LDLDezE29Eh1GCETXgq:mWMZx37KZhgEyf5J7SI2a53ez/9Eh1fO
TLSH
T17E167B22B34580FDD02721B0290DD3894379FD304B72A1DBB7D9A39D2E615C5ABBBA53
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

79:78:08:9f:19:44:4a:1c:ea:da:e4:ae:84:cd:56:a4:e2:be:63:49:be:47:e1:6f:97:b9:ef:81:1b:ea:be:58

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 24, 2026

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Windows Production PCA 2023,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:1b:d3:fd:1f:c5:93:35:53:7c:00:00:00:00:01:1b

Issuer

CN=Windows Production PCA 2023,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 30, 2026 - Apr 29, 2027

Subject

CN=Windows Production PCA 2023,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:17:85:bd:56:09:4b:f8:c8:21:00:00:00:00:00:17

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 13, 2023 - Jun 13, 2035

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:20:24:e1:e6:e0:17:b9:b4:8e:00:01:00:00:02:20

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

125440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

NisSrv.pdb

mpclient

MpManagerOpen MpGetFCValue MpHandleClose MpNotificationRegister MpFreeMemory MpConfigGetValue MpConfigGetValueAlloc MpConfigClose MpConfigOpen MpManagerVersionQuery MpUtilsExportFunctions MpConfigUninitialize MpConfigInitialize MpClientUtilExportFunctions

ntdll

RtlNtStatusToDosError RtlIpv6StringToAddressExW RtlIpv4StringToAddressExW VerSetConditionMask RtlUnwind

kernel32

CreateMutexExW GetCurrentProcessId DebugBreak GetSystemTimeAsFileTime CreateFileW GetLocaleInfoW DeleteTimerQueueTimer DeviceIoControl FindFirstFileW FindNextFileW FindClose GetFileAttributesW GetProcessTimes GetFileSizeEx UnmapViewOfFile GetSystemInfo CreateFileMappingW MapViewOfFile QueryUnbiasedInterruptTime StartThreadpoolIo CreateThreadpoolIo WaitForThreadpoolIoCallbacks CancelThreadpoolIo CancelIoEx GetOverlappedResult CloseThreadpoolIo QueryProcessCycleTime GetLongPathNameW GetProcessId DuplicateHandle OpenProcess QueryFullProcessImageNameW GetCurrentDirectoryW InitializeSRWLock TryAcquireSRWLockExclusive ReleaseSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockShared InitializeCriticalSection ResetEvent GetModuleHandleA VerifyVersionInfoW CreateThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CloseThreadpoolWait LocalFree Sleep CreateNamedPipeW DecodePointer WriteFile WaitForMultipleObjects ConnectNamedPipe CancelIo CreateDirectoryW GetTempPathW GetVersionExW CreateMutexW GetLocaleInfoEx GetThreadPreferredUILanguages GetUserPreferredUILanguages GetSystemPreferredUILanguages ExpandEnvironmentStringsW GetProductInfo SwitchToThread GetSystemDirectoryW VirtualQuery GetProcessMitigationPolicy SetProcessMitigationPolicy InitializeCriticalSectionAndSpinCount SetEnvironmentVariableW FindFirstFileExW GetFileInformationByHandle LoadLibraryExA SetFileInformationByHandle SetFilePointerEx CreateTimerQueueTimer GetFileInformationByHandleEx FormatMessageA QueryPerformanceFrequency GetOEMCP HeapAlloc OpenSemaphoreW ReleaseMutex ReleaseSemaphore SetLastError HeapFree CreateSemaphoreExW GetModuleFileNameA DeleteFiber CreateFiberEx ConvertThreadToFiber IsThreadAFiber ConvertFiberToThread GlobalFree GetTickCount64 WideCharToMultiByte SwitchToFiber GetCurrentProcess TerminateProcess WaitForSingleObject WaitForSingleObjectEx SetEvent CreateEventW GetProcessHeap HeapSetInformation DeleteCriticalSection InitializeCriticalSectionEx LoadLibraryExW FindResourceW LoadResource SizeofResource EnterCriticalSection LeaveCriticalSection lstrcmpiW GetModuleHandleW GetProcAddress FreeLibrary CloseHandle RaiseException SystemTimeToFileTime GetSystemTime SubmitThreadpoolWork CreateThreadpoolWork SetThreadpoolThreadMaximum CreateThreadpool CloseThreadpoolWork WaitForThreadpoolWorkCallbacks CloseThreadpool MultiByteToWideChar GetLastError IsDebuggerPresent GetCurrentThreadId OutputDebugStringW CreateThreadpoolTimer CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer FormatMessageW GetModuleHandleExW GetModuleFileNameW RemoveVectoredExceptionHandler AddVectoredExceptionHandler SetErrorMode SetUnhandledExceptionFilter ExitProcess GetStdHandle GetCommandLineA GetCommandLineW GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc HeapSize HeapQueryInformation FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadConsoleW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle WriteConsoleW SetEndOfFile VirtualProtect DisconnectNamedPipe ReadFile GetACP IsValidCodePage FreeLibraryAndExitThread ExitThread CreateThread SetConsoleCtrlHandler TlsFree TlsSetValue TlsGetValue TlsAlloc InterlockedPushEntrySList GetStartupInfoW InitializeSListHead UnhandledExceptionFilter GetCPInfo CompareStringEx LCMapStringEx EncodePointer QueryPerformanceCounter GetExitCodeThread SleepConditionVariableSRW WakeConditionVariable WakeAllConditionVariable InitOnceComplete InitOnceBeginInitialize GetFileAttributesExW AreFileApisANSI CopyFileW MoveFileExW GetStringTypeW IsProcessorFeaturePresent

advapi32

RegSetKeyValueW RegOpenCurrentUser RegGetValueW ImpersonateLoggedOnUser ConvertStringSecurityDescriptorToSecurityDescriptorW RevertToSelf SetThreadToken DuplicateTokenEx CloseServiceHandle OpenSCManagerW StartServiceW OpenServiceW RegQueryValueExW SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW UnregisterTraceGuids RegisterTraceGuidsW GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle TraceMessage EventWriteTransfer EventUnregister EventRegister

user32

CharNextW

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

609KB

Virtual Size

609KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

640KB

Virtual Size

752KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

260B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

150KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-21_7ce99d26f64e6720c7851845e668c341_amadey_darkgate_elex_luca-stealer_magniber_njrat

mpclient

ntdll

kernel32

advapi32

user32

generic