2026-10-22_b17f6b9bf9b447f5f2d6cca9d8c3c7e0_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_b17f6b9bf9b447f5f2d6cca9d8c3c7e0_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat
Size 3.2MB
Sample261024-agpcsaws2r
SHA256 95fd72830838500a9f37114db84309f6a8f3f3f442112c5542f213b1b74b5492
MD5 b17f6b9bf9b447f5f2d6cca9d8c3c7e0
SHA1 f765422198cd0bd615ae29d5ab075c200d2c27de
SHA512 952a551d78bc21fe24f84719cd03c9225a40fd97f14e95638544fafc8ac75eefdc32a89c8934f38ed4ada68e0d115ebcecbaa94db7d60987a5992a9ee13419dd
SSDEEP 49152:bFtoM1s0eh4gmUt857TC9NE80xIn8sfHXUjFqpU3Gulld90EGJ/5D3EKnv/9:bfL8ZrsIn80HXUjsW3XMR5D3
TLSH
T18FF57C11B681C1E5E59201F1C5BCAFA68429BD305BB490C7A7C41EE91DB05E3AA3EF37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-22_b17f6b9bf9b447f5f2d6cca9d8c3c7e0_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

.exe 3.2MB

2026-10-22_b17f6b9bf9b447f5f2d6cca9d8c3c7e0_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

IMPHASH a26c2b8b8ea119336fdba8fd84f3f564
SHA256 95fd72830838500a9f37114db84309f6a8f3f3f442112c5542f213b1b74b5492
MD5 b17f6b9bf9b447f5f2d6cca9d8c3c7e0
SHA1 f765422198cd0bd615ae29d5ab075c200d2c27de
SHA512 952a551d78bc21fe24f84719cd03c9225a40fd97f14e95638544fafc8ac75eefdc32a89c8934f38ed4ada68e0d115ebcecbaa94db7d60987a5992a9ee13419dd
SSDEEP 49152:bFtoM1s0eh4gmUt857TC9NE80xIn8sfHXUjFqpU3Gulld90EGJ/5D3EKnv/9:bfL8ZrsIn80HXUjsW3XMR5D3
TLSH
T18FF57C11B681C1E5E59201F1C5BCAFA68429BD305BB490C7A7C41EE91DB05E3AA3EF37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

b1:11:5e:30:ef:6f:32:36:c0:b5:ec:c6:fd:74:30:a9:4f:ef:ad:f0:c9:b9:ea:04:fc:f5:66:25:7b:59:9d:c6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=天津中思明达科技有限公司,O=天津中思明达科技有限公司,ST=天津市,C=CN

Chains

Aug 26, 2026

CN=天津中思明达科技有限公司,O=天津中思明达科技有限公司,ST=天津市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=天津中思明达科技有限公司,O=天津中思明达科技有限公司,ST=天津市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=天津中思明达科技有限公司,O=天津中思明达科技有限公司,ST=天津市,C=CN

Serial Number

0b:44:52:82:d0:6a:1d:7f:c0:6c:f7:d6:2d:a3:a0:11

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 12, 2026 - Apr 6, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1139001

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\jenkins\.jenkins\workspace\group_clean_external\sysopt_expert_group\client\client\Release\sysopt_expert_ui.pdb

wevtapi

EvtNext EvtRender EvtClose EvtQuery

kernel32

GetDiskFreeSpaceExW GetFileAttributesW GetFileSizeEx ReleaseSemaphore GetCurrentProcess TerminateProcess GetStartupInfoW GetSystemDirectoryW GetModuleFileNameW LocalFree FormatMessageW GetEnvironmentVariableW GetFullPathNameW GetTempPathW SetLastError DeviceIoControl lstrlenW SystemTimeToFileTime lstrcmpiW DeleteFileW GetCurrentThreadId ReadDirectoryChangesW SetUnhandledExceptionFilter SetErrorMode HeapSetInformation SetPriorityClass VirtualProtect GetCommandLineW OpenEventW GetPrivateProfileStringW CreateMutexW OutputDebugStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeZoneInformation GetFileType GetConsoleMode GetConsoleOutputCP ExitProcess ExitThread RtlUnwind QueryDepthSList InterlockedFlushSList FreeLibraryAndExitThread GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber ChangeTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SignalObjectAndWait CreateTimerQueue FindNextFileW DeleteTimerQueueTimer CreateTimerQueueTimer lstrcmpA CreateSemaphoreW WaitForMultipleObjectsEx WaitNamedPipeW LoadLibraryExW MapViewOfFileEx WritePrivateProfileStringW CreateFileW CreateProcessW Sleep FindFirstFileW FormatMessageA ExpandEnvironmentStringsW Process32NextW Process32FirstW CreateToolhelp32Snapshot K32GetProcessMemoryInfo K32GetModuleFileNameExW GetWindowsDirectoryW GetSystemTimes GetCurrentProcessId GetProcessTimes OpenProcess RegisterWaitForSingleObject UnregisterWaitEx GlobalMemoryStatusEx GetModuleHandleW WideCharToMultiByte LoadLibraryW GetProcAddress CopyFileW MultiByteToWideChar FindResourceW SizeofResource LockResource LoadResource FreeLibrary FindResourceExW WaitForMultipleObjects CreateEventW WaitForSingleObject SetEvent DeleteCriticalSection AreFileApisANSI HeapCreate GetDiskFreeSpaceW GetFullPathNameA UnlockFileEx UnmapViewOfFile HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW FlushViewOfFile CreateFileA LoadLibraryA GetVersionExA DeleteFileA GetSystemInfo HeapCompact CreateFileMappingA LockFileEx GetSystemTime EncodePointer InitializeSListHead CreateFileMappingW MapViewOfFile InitializeCriticalSectionEx LeaveCriticalSection InterlockedPopEntrySList FindClose InterlockedPushEntrySList FlushInstructionCache UnhandledExceptionFilter GetTickCount64 GetFileSize GetVersionExW OutputDebugStringA GetModuleHandleExW GetModuleHandleExA GetModuleHandleA SetFilePointerEx SetFilePointer SetEndOfFile FlushFileBuffers WriteConsoleW EnterCriticalSection InitializeCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException ReadFile WriteFile GetStdHandle UnlockFile LockFile ReleaseMutex ResetEvent PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort SetThreadPriority CreateThread InterlockedCompareExchange InterlockedExchange GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetNativeSystemInfo GetCurrentThread WaitForSingleObjectEx DuplicateHandle GetTickCount GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread InitializeCriticalSectionAndSpinCount QueryPerformanceFrequency QueryPerformanceCounter TryEnterCriticalSection GetStringTypeW LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent CloseHandle DecodePointer SetEnvironmentVariableW IsDebuggerPresent

user32

LoadCursorW LoadIconW PostMessageW RemovePropW FindWindowW MonitorFromPoint GetMonitorInfoW GetPropW SetPropW EndPaint BeginPaint DestroyWindow IsWindow CreateWindowExW CallMsgFilterW WaitMessage PeekMessageW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetQueueStatus MsgWaitForMultipleObjectsEx SetTimer PostThreadMessageW DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW GetIconInfo DestroyIcon UnregisterClassW KillTimer wsprintfW SendMessageTimeoutW CharNextW ExitWindowsEx GetParent GetCursorPos TrackPopupMenu GetSubMenu DestroyMenu LoadMenuW PostQuitMessage GetWindowLongW SetWindowLongW GetClassInfoExW RegisterClassExW UnregisterPowerSettingNotification RegisterPowerSettingNotification SetForegroundWindow ShowWindow SendMessageW

gdi32

GetStockObject GetObjectW DeleteObject

advapi32

InitializeSecurityDescriptor RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegDeleteKeyExW RegDeleteValueW RegEnumKeyExW SetSecurityDescriptorDacl RegEnumValueW GetTokenInformation RegDeleteKeyW GetUserNameW RegGetValueW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken QueryServiceConfigW OpenServiceW OpenSCManagerW CloseServiceHandle ChangeServiceConfigW RegSetValueExW RegQueryInfoKeyW RegNotifyChangeKeyValue RegCloseKey

shell32

SHGetSpecialFolderPathW ShellExecuteW ShellExecuteExW SHGetSpecialFolderLocation Shell_NotifyIconW SHCreateDirectoryExW CommandLineToArgvW SHGetPathFromIDListW ord165 SHGetFolderPathW SHGetFileInfoW

ole32

CoCreateFreeThreadedMarshaler CoUninitialize CoInitialize CoInitializeEx CoCreateInstance CoTaskMemFree CoInitializeSecurity CoCreateGuid CreateStreamOnHGlobal CoTaskMemAlloc CoTaskMemRealloc

oleaut32

VariantClear VariantInit SetErrorInfo SysFreeString VarUI4FromStr SysStringLen SysAllocString SysAllocStringLen GetErrorInfo

shlwapi

StrTrimA SHCreateStreamOnFileEx StrStrIA StrCmpIW StrCmpNIW PathIsRootW PathIsRelativeW StrStrIW PathFileExistsW PathRemoveFileSpecW SHGetValueW SHSetValueW PathAppendW PathFindExtensionW PathFindFileNameW PathIsDirectoryW PathCombineW PathStripToRootW PathMatchSpecW StrToIntW StrToInt64ExW ord158

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

pdh

PdhOpenQueryW PdhAddCounterW PdhCollectQueryData PdhCloseQuery PdhGetFormattedCounterValue PdhAddEnglishCounterW PdhRemoveCounter PdhExpandWildCardPathW

gdiplus

GdipSaveImageToFile GdipCloneImage GdipFree GdipAlloc GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipCreateBitmapFromScan0 GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipCreateBitmapFromHICON GdipBitmapLockBits GdipBitmapUnlockBits GdipGetImageEncodersSize GdipGetImageEncoders GdiplusStartup GdiplusShutdown

powrprof

PowerGetActiveScheme PowerSetActiveScheme PowerReadFriendlyName

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSetCredentials WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen

winmm

timeGetTime timeEndPeriod timeBeginPeriod

crypt32

CryptStringToBinaryW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

secur32

GetUserNameExW

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_b17f6b9bf9b447f5f2d6cca9d8c3c7e0_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat

wevtapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

pdh

gdiplus

powrprof

winhttp

winmm

crypt32

wininet

iphlpapi

secur32

urlmon

generic