2026-10-25_7f61a29dcce4670a8742836959cf429c_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-25_7f61a29dcce4670a8742836959cf429c_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat
Size 2.3MB
Sample261026-2b4dashx7p
SHA256 6b834fdc3ab6df07af5c8ec1fc46c45026e6142fe43809b7d2b382c4dc829ca6
MD5 7f61a29dcce4670a8742836959cf429c
SHA1 0c78dc656d13cf5b599c9bc1f2eb27eecd3cb981
SHA512 f1aaaeb9a310f91c21cebae5b8dd12e119d5f258917c67a4911d45a66ae2b0b868806621a023699fb812b9ed57bb20d7dab60c9179485f86455963684c7cc50b
SSDEEP 49152:mEqOCC51AOR7jYS7fcUqkqTluWXarSj8RoTCCW:m4CC51Ag7BZSJTy
TLSH
T1C0B5E1217983C032CAA121B1493CEB6E459EAB311F2565CBA3E41B7EDE305D39E3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-25_7f61a29dcce4670a8742836959cf429c_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat

File Explorer

2026-10-25_7f61a29dcce4670a8742836959cf429c_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat

.exe 2.3MB

2026-10-25_7f61a29dcce4670a8742836959cf429c_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat

IMPHASH 65faa4b7a6df1037fc0ebd2dc6641d99
SHA256 6b834fdc3ab6df07af5c8ec1fc46c45026e6142fe43809b7d2b382c4dc829ca6
MD5 7f61a29dcce4670a8742836959cf429c
SHA1 0c78dc656d13cf5b599c9bc1f2eb27eecd3cb981
SHA512 f1aaaeb9a310f91c21cebae5b8dd12e119d5f258917c67a4911d45a66ae2b0b868806621a023699fb812b9ed57bb20d7dab60c9179485f86455963684c7cc50b
SSDEEP 49152:mEqOCC51AOR7jYS7fcUqkqTluWXarSj8RoTCCW:m4CC51Ag7BZSJTy
TLSH
T1C0B5E1217983C032CAA121B1493CEB6E459EAB311F2565CBA3E41B7EDE305D39E3571B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

203530

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\jenkins\.jenkins\workspace\group_clean\winopt_assistant_group\install_uninstall\install_uninstall\Release\uninst.pdb

kernel32

LockResource LoadResource FindResourceExW UnlockFile ReadFile LockFile GetFileSize GetModuleFileNameW CreateMutexW LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetLastError UnmapViewOfFile MapViewOfFile CreateFileMappingW GetProcessHeap WideCharToMultiByte LocalFree VerSetConditionMask RaiseException FormatMessageW ReleaseMutex WriteConsoleW SetEndOfFile ReadConsoleW InitializeCriticalSectionAndSpinCount DeleteCriticalSection VerifyVersionInfoW SetLastError GetCurrentThreadId DecodePointer SetCurrentDirectoryW ResetEvent WaitForSingleObjectEx GetTimeZoneInformation GetCurrentDirectoryW GetTempPathW Sleep SizeofResource HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy CloseHandle FindResourceW GetFileAttributesExW GetSystemDirectoryW SetFilePointerEx GetStringTypeW SetStdHandle SetConsoleCtrlHandler SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetFileType GetCurrentThread FreeLibrary GetModuleHandleW GetProcAddress GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread InterlockedFlushSList RtlUnwind lstrcmpiA lstrcmpA DeviceIoControl GetVersionExW GetSystemWindowsDirectoryW FreeResource SetFilePointer MultiByteToWideChar LoadLibraryExW lstrcmpiW InterlockedCompareExchange FindNextFileA FindFirstFileA InitializeCriticalSectionEx GetFileSizeEx GetLocalTime DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFullPathNameW RemoveDirectoryW SetFileAttributesW WaitForSingleObject GetCurrentProcess CreateProcessW GetStartupInfoW lstrlenW MoveFileExW OutputDebugStringW SetEvent OutputDebugStringA GetWindowsDirectoryW MoveFileW CreateFileA DeleteFileA WriteFile GetTempPathA GetTempFileNameA LoadLibraryW CreateEventW WaitForMultipleObjects GetTickCount GetLogicalDriveStringsW GetLongPathNameW QueryDosDeviceW GetCurrentProcessId TerminateProcess GetExitCodeProcess OpenProcess IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA QueryPerformanceCounter QueryPerformanceFrequency SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GlobalAlloc GlobalLock GlobalUnlock GlobalFree UnhandledExceptionFilter SetUnhandledExceptionFilter OpenFileMappingW LocalAlloc CopyFileW CreateFileW

user32

GetClassInfoExW RegisterClassExW RegisterWindowMessageW SendMessageTimeoutW SendNotifyMessageW FindWindowW CopyRect OffsetRect UnionRect EqualRect ShowWindow DrawFocusRect SetCursor DestroyCursor MoveWindow WaitForInputIdle GetShellWindow UnregisterClassA PeekMessageW DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW GetActiveWindow EndDialog DialogBoxParamW GetMonitorInfoW MonitorFromWindow LoadImageW GetWindow CharNextW SetWindowLongW GetWindowLongW MapWindowPoints ScreenToClient GetWindowRect GetClientRect SetWindowTextW InvalidateRect EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow GetSystemMetrics KillTimer SetTimer ReleaseCapture SetCapture GetAsyncKeyState IsIconic IsWindowVisible SetWindowPos DestroyWindow IsWindow LoadCursorW CreateWindowExW UnregisterClassW CallWindowProcW PostQuitMessage DefWindowProcW SendMessageW GetWindowThreadProcessId GetParent UpdateLayeredWindow FindWindowExW PostMessageW wsprintfW PtInRect

gdi32

SaveDC SelectObject GetObjectW SetViewportOrgEx CreateDIBSection SelectClipRgn RestoreDC DeleteObject DeleteDC CreateRectRgnIndirect CreateCompatibleDC CreateCompatibleBitmap BitBlt RectVisible OffsetViewportOrgEx CreateFontW EnumFontFamiliesW

advapi32

CryptContextAddRef RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey RegQueryValueExW GetUserNameW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW RegEnumValueW CreateWellKnownSid DuplicateTokenEx GetLengthSid GetTokenInformation SetTokenInformation RegGetValueW ChangeServiceConfigW ChangeServiceConfig2W CloseServiceHandle ControlService CreateServiceW DeleteService LockServiceDatabase OpenSCManagerW OpenServiceW QueryServiceConfigW QueryServiceConfig2W QueryServiceLockStatusW QueryServiceStatus QueryServiceStatusEx StartServiceW UnlockServiceDatabase RegEnumKeyExA RegOpenKeyExA RegQueryValueExA CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetKeyParam CryptGenRandom CryptImportKey CryptEncrypt CryptDecrypt

shell32

ShellExecuteW SHCreateDirectoryExW SHGetSpecialFolderPathW CommandLineToArgvW ord165 ShellExecuteExW

ole32

CoInitialize CoInitializeEx CreateStreamOnHGlobal CoInitializeSecurity CoTaskMemFree CoTaskMemRealloc CoCreateGuid CoTaskMemAlloc CoCreateInstance CoUninitialize CoSetProxyBlanket

oleaut32

SysFreeString SysAllocString VariantClear VariantInit VarUI4FromStr

shlwapi

SHDeleteValueW PathRenameExtensionA PathFindFileNameA StrCmpNIW SHDeleteKeyW ord158 PathCombineW PathFileExistsW PathRemoveFileSpecW PathAppendW SHSetValueW SHGetValueW PathFindFileNameW PathIsRootW PathIsRelativeW PathIsDirectoryW StrStrIA StrCmpIW PathAppendA StrStrIW SHSetValueA SHGetValueA StrToIntExW StrTrimA AssocQueryStringW PathFindExtensionW

comctl32

InitCommonControlsEx _TrackMouseEvent

gdiplus

GdipFree GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipGetImageWidth GdipGetImageHeight GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipCreateFromHDC GdipDeleteGraphics GdipSetTextRenderingHint GdipAlloc GdipFillRectangleI GdipDrawImagePointRectI GdipDrawImageRectRect GdipDrawImageRectRectI GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString GdipMeasureString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipCloneImage GdipDisposeImage GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFileICM GdipDrawRectangleI GdiplusShutdown GdiplusStartup

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

psapi

GetModuleFileNameExW EnumProcesses GetProcessImageFileNameW

secur32

GetUserNameExW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

crypt32

CertGetNameStringW CryptStringToBinaryA CryptStringToBinaryW CryptBinaryToStringA CryptBinaryToStringW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

generic

count=17, id=259, version=30795,

count=188, id=261, version=30795,

count=2, id=264, version=27051,

count=1, productName=Unmarked objects (old),

count=10, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=3, id=261, version=27031,

count=1, id=262, version=30795,

count=2, id=199, version=41118,

count=23, id=259, version=26706,

count=15, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=6, id=261, version=27032,

count=36, id=260, version=26706,

count=74, id=261, version=26706,

count=25, id=260, version=30795,

count=37, id=257, version=30795,

count=409, id=1, productName=Unmarked objects,

count=49, id=261, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,