2026-11-01_f3f046882c47652c971d6afa9faff2cc_amadey_darkgate_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_f3f046882c47652c971d6afa9faff2cc_amadey_darkgate_elex_luca-stealer_lynx_njrat
Size 1.8MB
Sample261102-dpyszass8k
SHA256 211f364bc59e8ef8af2a745e0974cb514a3688ab4221614b7e76a84719c143d8
MD5 f3f046882c47652c971d6afa9faff2cc
SHA1 d0c6a641b84e6eb5164db4e7f7cd3113eae1fa53
SHA512 b67e3ab376e9a45cddc9408eb4325d8f989960b36b28271197516a8b977677a44d3cae791f194ca23639d1c5d58593e79501f25d80f48b3e78bff81bd9a4ae21
SSDEEP 49152:NWDTBNAHvipS9xTDE+gOfjzQgilV995S1V0:AD9NAHvipS1gkjI
TLSH
T19285CF22F7C380F3ECD611B241FBABF79C383615472998D792C01D6999205E3763EA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_f3f046882c47652c971d6afa9faff2cc_amadey_darkgate_elex_luca-stealer_lynx_njrat

File Explorer

2026-11-01_f3f046882c47652c971d6afa9faff2cc_amadey_darkgate_elex_luca-stealer_lynx_njrat

.exe 1.8MB

2026-11-01_f3f046882c47652c971d6afa9faff2cc_amadey_darkgate_elex_luca-stealer_lynx_njrat

IMPHASH 81acc3fc5dc9ca4eae3dce245ab6d891
SHA256 211f364bc59e8ef8af2a745e0974cb514a3688ab4221614b7e76a84719c143d8
MD5 f3f046882c47652c971d6afa9faff2cc
SHA1 d0c6a641b84e6eb5164db4e7f7cd3113eae1fa53
SHA512 b67e3ab376e9a45cddc9408eb4325d8f989960b36b28271197516a8b977677a44d3cae791f194ca23639d1c5d58593e79501f25d80f48b3e78bff81bd9a4ae21
SSDEEP 49152:NWDTBNAHvipS9xTDE+gOfjzQgilV995S1V0:AD9NAHvipS1gkjI
TLSH
T19285CF22F7C380F3ECD611B241FBABF79C383615472998D792C01D6999205E3763EA5A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

919888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\ccd-hyperdrive\nightly\build\win32\build\msvs_win32_x86\Release\x86\sym\HDBoxCustomHook\HDBoxCustomHook\HDCoreCustomHook.pdb

kernel32

ReadFile GetVersionExW GetCurrentProcess lstrcmpW MoveFileExW CloseHandle DeleteFileW FormatMessageW SetFileAttributesW GetFileAttributesW CreateFileW FindClose GetTempPathW GetModuleFileNameW FindNextFileW SetLastError FindFirstFileW WaitForSingleObject SetDllDirectoryW GetProcessHeap LocalFree GetProcAddress HeapAlloc LoadLibraryW GetSystemDirectoryW LocalAlloc HeapFree DeleteCriticalSection DecodePointer GetLastError GetModuleHandleW InitializeCriticalSectionEx WriteConsoleW GetConsoleOutputCP SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetFilePointerEx ReadConsoleW GetConsoleMode SetStdHandle EnumSystemLocalesW IsValidLocale GetLocaleInfoW CompareStringW GetCommandLineW GetCommandLineA GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread GetTimeZoneInformation GetFileType LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetFileSizeEx GetFullPathNameW WriteFile GetFileSize FlushFileBuffers MultiByteToWideChar WideCharToMultiByte GetCurrentProcessId SetFilePointer GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetFileInformationByHandle CreateEventW VerSetConditionMask VerifyVersionInfoW FileTimeToSystemTime GetLocalTime GetTimeFormatW SystemTimeToFileTime GetDateFormatW CreateMutexW ReleaseMutex OpenMutexW TerminateProcess HeapSize Sleep SetEvent HeapReAlloc CreateThread ResetEvent HeapDestroy GetUserDefaultLangID GetUserDefaultUILanguage FreeLibrary LoadLibraryA LCMapStringW GetUserDefaultLCID AreFileApisANSI TryEnterCriticalSection HeapCreate GetDiskFreeSpaceW OutputDebugStringA LockFile GetFullPathNameA SetEndOfFile UnlockFileEx UnmapViewOfFile HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA WaitForSingleObjectEx DeleteFileA GetSystemInfo HeapCompact UnlockFile LockFileEx GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount GetStringTypeW EncodePointer LCMapStringEx GetCPInfo IsDebuggerPresent RaiseException InitializeCriticalSectionAndSpinCount

advapi32

SetSecurityDescriptorDacl GetSecurityDescriptorDacl RegGetKeySecurity RegCloseKey RegQueryInfoKeyW RegDeleteKeyW SetEntriesInAclW CreateWellKnownSid RegCreateKeyExW RegEnumKeyExW RegSetKeySecurity RegSetValueExW InitializeSecurityDescriptor RegOpenKeyExW RegDeleteValueW RegQueryValueExW

shell32

SHGetFolderPathW SHGetPathFromIDListW SHGetFolderLocation SHCreateDirectoryExW SHGetSpecialFolderPathW

ole32

StringFromGUID2 CLSIDFromString OleRun CLSIDFromProgID CoCreateInstance CoUninitialize CoInitialize CoTaskMemFree CoCreateGuid

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

shlwapi

PathAppendW PathIsDirectoryW PathFindFileNameW PathRemoveFileSpecW PathRenameExtensionW PathRemoveExtensionW PathFileExistsW PathAddExtensionW PathIsFileSpecW PathFileExistsA

oleaut32

VariantCopy VariantClear SysAllocString SysFreeString VariantInit GetErrorInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_f3f046882c47652c971d6afa9faff2cc_amadey_darkgate_elex_luca-stealer_lynx_njrat

kernel32

advapi32

shell32

ole32

version

shlwapi

oleaut32

generic