2026-11-01_a84a8541a764778217e4d19fce2ecff2_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_a84a8541a764778217e4d19fce2ecff2_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat
Size 4.2MB
Sample261102-plr2sstthv
SHA256 e8c6f90a2b227d248784e59744b7aaeca36bf0704ffc160af1ba6948f9aa6511
MD5 a84a8541a764778217e4d19fce2ecff2
SHA1 f2c6f4efc34f36c619aef6fb3788961eb4fc192c
SHA512 861a90ca913de780229e2a67e1eab18ec860fb78eac0a3cbc20d359890d7d0592c4e7ab44cc6eebab7d3e0c309656561b4374e6d12b8fe2a7b465f4b036ba55e
SSDEEP 49152:PPBiJFTSey2ubvRoYnR/VukqwxDAPAVAQcQhzWkN8YTp3FH7sygmwwOul/Edkky:PJSImyICxkPAVAQcQhzWkOYT/b
TLSH
T109268DA03686C131E555527A9DBDBFBE881DA8382BB540C792C44B6E38351C32F35F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_a84a8541a764778217e4d19fce2ecff2_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

File Explorer

2026-11-01_a84a8541a764778217e4d19fce2ecff2_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

.exe 4.2MB

2026-11-01_a84a8541a764778217e4d19fce2ecff2_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

IMPHASH 36c640a6ebc54bb322c74d52efae7ca5
SHA256 e8c6f90a2b227d248784e59744b7aaeca36bf0704ffc160af1ba6948f9aa6511
MD5 a84a8541a764778217e4d19fce2ecff2
SHA1 f2c6f4efc34f36c619aef6fb3788961eb4fc192c
SHA512 861a90ca913de780229e2a67e1eab18ec860fb78eac0a3cbc20d359890d7d0592c4e7ab44cc6eebab7d3e0c309656561b4374e6d12b8fe2a7b465f4b036ba55e
SSDEEP 49152:PPBiJFTSey2ubvRoYnR/VukqwxDAPAVAQcQhzWkN8YTp3FH7sygmwwOul/Edkky:PJSImyICxkPAVAQcQhzWkOYT/b
TLSH
T109268DA03686C131E555527A9DBDBFBE881DA8382BB540C792C44B6E38351C32F35F6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2006832

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\home\jenkins\agent\workspace\sfip\BAAS\code\services\AMTSW\Release\UNS\Release\lms.pdb

kernel32

FindResourceW SizeofResource WriteConsoleW LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW SetEnvironmentVariableW SetStdHandle GetModuleFileNameW FreeLibrary LocalAlloc LocalFree FormatMessageW GetCurrentThreadId GetFullPathNameW FreeLibraryAndExitThread ExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW VirtualQuery VirtualProtect GetCurrentThread VirtualAlloc GetModuleHandleExW FreeEnvironmentStringsW RtlUnwind GetCommandLineA GetOEMCP GetCurrentDirectoryW SetConsoleCtrlHandler GetConsoleMode ReadConsoleW GetConsoleOutputCP lstrcmpiW HeapSize HeapReAlloc GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage FindFirstFileExW OutputDebugStringW CreateThread IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo LCMapStringEx EncodePointer WaitForSingleObjectEx GetStringTypeW AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock ExpandEnvironmentStringsW GetComputerNameExW WideCharToMultiByte CreateFileW GetFinalPathNameByHandleW LoadLibraryW GetCurrentProcess CreateEventW WaitForSingleObject lstrlenW SetEvent DeleteCriticalSection InitializeCriticalSectionEx IsWow64Process OutputDebugStringA GetSystemPowerStatus GetFileInformationByHandle GetACP GetCurrentProcessId LeaveCriticalSection EnterCriticalSection GetLastError WaitForMultipleObjectsEx QueryPerformanceFrequency HeapAlloc HeapFree GetProcessHeap GetSystemDefaultLCID GetSystemTime GetFileSizeEx MultiByteToWideChar CreateFileA CancelIoEx WaitForMultipleObjects ReadFile WriteFile DeviceIoControl GetOverlappedResult InitializeCriticalSectionAndSpinCount GetTimeZoneInformation QueryPerformanceCounter SetLastError InitializeCriticalSection TryEnterCriticalSection SetThreadPriority ResumeThread GetComputerNameA GetSystemInfo DuplicateHandle TlsAlloc TlsGetValue TlsSetValue TlsFree RegisterWaitForSingleObject UnregisterWait InitOnceExecuteOnce TerminateProcess GetStdHandle RaiseException CloseHandle DecodePointer GetCommandLineW ResetEvent ReleaseSemaphore ReleaseMutex CreateMutexW CreateEventA CreateSemaphoreW GetExitCodeThread SuspendThread GetThreadId GetSystemTimeAsFileTime FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetEnvironmentStringsW ExitProcess GetVersionExW LockFileEx SetFilePointerEx UnlockFileEx SetDllDirectoryW GetStartupInfoW Sleep GlobalAlloc GlobalFree FlushFileBuffers SetEndOfFile SetFilePointer LoadLibraryExA

advapi32

RegCreateKeyW InitiateSystemShutdownExW LookupPrivilegeValueW AdjustTokenPrivileges SetEntriesInAclW RegSetKeySecurity RegDeleteKeyExW SetSecurityDescriptorDacl FreeSid AllocateAndInitializeSid ConvertSidToStringSidW LookupAccountSidW OpenProcessToken OpenThreadToken EqualSid CreateWellKnownSid StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW OpenServiceW OpenSCManagerW DeleteService CreateServiceW CopySid GetLengthSid GetTokenInformation InitializeSecurityDescriptor IsValidSid SetSecurityDescriptorGroup SetSecurityDescriptorOwner ControlService DeregisterEventSource RegisterEventSourceW ReportEventW CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey

user32

PostThreadMessageW UnregisterDeviceNotification CharNextW RegisterDeviceNotificationW DispatchMessageW GetMessageW TranslateMessage MessageBoxW LoadStringW CharUpperW

ole32

CoCreateInstance StringFromGUID2 CoTaskMemAlloc CoInitializeEx CoTaskMemFree CoImpersonateClient CoRevertToSelf CoUninitialize CoRegisterClassObject CoRevokeClassObject CoResumeClassObjects CoAddRefServerProcess CoReleaseServerProcess CoTaskMemRealloc CoSetProxyBlanket CoInitializeSecurity

oleaut32

VarBstrCat VariantClear SysAllocStringByteLen SysStringByteLen VariantInit SafeArrayCreateVector SafeArrayPutElement SysAllocString SysFreeString SysStringLen VarUI4FromStr LoadTypeLi RegisterTypeLi UnRegisterTypeLi SysAllocStringLen LoadRegTypeLi SafeArrayUnlock SafeArrayLock SafeArrayGetLBound SafeArrayDestroy SafeArrayCreate VariantChangeType SafeArrayGetUBound

iphlpapi

GetInterfaceInfo GetPerAdapterInfo GetAdaptersInfo GetIpAddrTable CancelIPChangeNotify NotifyRouteChange CancelMibChangeNotify2 NotifyIpInterfaceChange GetAdaptersAddresses SetTcpEntry GetExtendedTcpTable IpRenewAddress

cfgmgr32

CM_Get_DevNode_PropertyW CM_Get_Device_Interface_ListA CM_Get_Device_Interface_List_SizeA CM_Get_Device_Interface_PropertyW CM_Locate_DevNodeW

crypt32

CertFindCertificateInStore CertCloseStore CryptMsgGetParam CryptMsgClose CertFreeCertificateContext CertGetNameStringW CryptQueryObject CertOpenStore CertGetNameStringA

ws2_32

getaddrinfo WSAAddressToStringA WSAAccept WSAGetLastError socket shutdown setsockopt send select recv ntohs listen htons getsockname getpeername freeaddrinfo connect closesocket bind __WSAFDIsSet ntohl htonl getnameinfo inet_ntoa getservbyname inet_addr WSACloseEvent WSACreateEvent WSAEventSelect WSAEnumNetworkEvents WSASend WSACleanup WSAStartup getsockopt accept gethostname ioctlsocket

wintrust

WinVerifyTrust

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpSendRequest WinHttpSetCredentials WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpQueryAuthSchemes WinHttpQueryHeaders WinHttpReceiveResponse WinHttpAddRequestHeaders

api-ms-win-power-setting-l1-1-0

PowerReadACValue PowerReadDCValue

api-ms-win-power-base-l1-1-0

GetPwrCapabilities

powrprof

SetSuspendState

rpcrt4

UuidToStringA UuidCreate RpcStringFreeA

bcrypt

BCryptGenRandom

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

773KB

Virtual Size

772KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

169KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

847KB

Virtual Size

848KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=22, id=259, version=29395,

count=253, id=261, version=29395,

count=5, id=253, version=28518,

count=19, id=260, version=29804,

count=26, id=259, version=29804,

count=115, id=261, version=30154,

count=34, id=260, version=30158,

count=16, id=257, version=29395,

count=101, id=261, version=29804,

count=432, id=1, productName=Unmarked objects,

count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=29, id=260, version=29395,

count=386, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,

count=31, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,

count=1, id=256, productName=VS2019 v16.9.2 build 29913, version=29913,

count=1, id=255, productName=VS2019 v16.9.2 build 29913, version=29913,

count=2, id=151,

count=1, id=258, productName=VS2019 v16.9.2 build 29913, version=29913,