2026-11-01_853ca2c43cf4c9225a224eb3885fce64_amadey_darkgate_elex_floxif_luca-stealer_lynx_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_853ca2c43cf4c9225a224eb3885fce64_amadey_darkgate_elex_floxif_luca-stealer_lynx_njrat_smoke-loader
Size 3.4MB
Sample261102-tkdv1adv7m
SHA256 35c6d027188d62c2dfc07f0b8712105fa4c773ea0ca2f863ad074bcb369a8351
MD5 853ca2c43cf4c9225a224eb3885fce64
SHA1 39035c4b57bf5f6ee616efaea7941377999bf84c
SHA512 e87db81928fa63c7880fd8b62445bec567512eb52b39e9531880fda82aaf0f40ec437433e50fb3fd257709e32f3da85f16c21dbf21ce13358c4e6f1b05278b8b
SSDEEP 49152:lvgJxIte8YWMfTUGghh4h348ffFcZKlBtvtMt3dp+1zwCyZSHPRX241kq7Cc:ZgJxIxMfY9b4148ffF
TLSH
T1EFF57F207607C03BD69311B25A2CAB9F863CAA241FB614D793E42F7D0D615C36B36E97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-01_853ca2c43cf4c9225a224eb3885fce64_amadey_darkgate_elex_floxif_luca-stealer_lynx_njrat_smoke-loader

File Explorer

2026-11-01_853ca2c43cf4c9225a224eb3885fce64_amadey_darkgate_elex_floxif_luca-stealer_lynx_njrat_smoke-loader

.exe 3.4MB

2026-11-01_853ca2c43cf4c9225a224eb3885fce64_amadey_darkgate_elex_floxif_luca-stealer_lynx_njrat_smoke-loader

IMPHASH 99e18a114a5695802ca34d0f2ef06bc7
SHA256 35c6d027188d62c2dfc07f0b8712105fa4c773ea0ca2f863ad074bcb369a8351
MD5 853ca2c43cf4c9225a224eb3885fce64
SHA1 39035c4b57bf5f6ee616efaea7941377999bf84c
SHA512 e87db81928fa63c7880fd8b62445bec567512eb52b39e9531880fda82aaf0f40ec437433e50fb3fd257709e32f3da85f16c21dbf21ce13358c4e6f1b05278b8b
SSDEEP 49152:lvgJxIte8YWMfTUGghh4h348ffFcZKlBtvtMt3dp+1zwCyZSHPRX241kq7Cc:ZgJxIxMfY9b4148ffF
TLSH
T1EFF57F207607C03BD69311B25A2CAB9F863CAA241FB614D793E42F7D0D615C36B36E97
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

08:39:e2:c1:4c:d3:64:02:68:e1:95:f3:76:40:79:98:1d:cf:f3:f6:e4:c9:e9:67:1d:94:57:3e:06:21:cf:df

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,L=Tempe,ST=Arizona,C=US

Chains

Jan 7, 2025

CN=Gen Digital Inc.,O=Gen Digital Inc.,L=Tempe,ST=Arizona,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,L=Tempe,ST=Arizona,C=US

Serial Number

07:a6:1e:cf:a7:4c:c7:b2:ce:b4:20:35:c7:72:be:1d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Sep 28, 2026

Timespan

May 22, 2024 - May 21, 2027

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 15, 2024 - Apr 14, 2035

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

1711104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BUILD\work\67d9289f94964a81\BUILDS\Release\x86\CCUpdate.pdb

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey RegCreateKeyExW RegSetValueExW ImpersonateLoggedOnUser RegOpenCurrentUser RevertToSelf CryptReleaseContext InitializeSecurityDescriptor SetSecurityDescriptorDacl DuplicateTokenEx AllocateAndInitializeSid CheckTokenMembership FreeSid OpenProcessToken GetTokenInformation EqualSid RegDeleteValueW RegEnumValueW OpenThreadToken ImpersonateSelf LookupPrivilegeValueW AdjustTokenPrivileges CreateProcessAsUserW OpenSCManagerW OpenServiceW QueryServiceStatus QueryServiceStatusEx ControlService StartServiceW CloseServiceHandle CryptGenRandom CryptAcquireContextW RegQueryMultipleValuesW RegDeleteTreeW RegDeleteKeyExW RegNotifyChangeKeyValue RegDeleteKeyW RegQueryInfoKeyW RegEnumKeyExW

ole32

CoInitializeEx CoCreateGuid CoCreateInstance CoUninitialize CoInitializeSecurity CoTaskMemFree

oleaut32

VariantClear SysStringLen SysFreeString SysAllocString VariantInit VariantCopy

user32

RegisterClassExW GetClassInfoExW SetWindowLongW SendMessageW PostMessageW RegisterWindowMessageW LoadStringW

rpcrt4

RpcIfInqId RpcStringBindingComposeW NdrAsyncServerCall NdrServerCall2 NdrClientCall2 NdrAsyncClientCall RpcAsyncCancelCall RpcBindingFromStringBindingW RpcAsyncInitializeHandle RpcAsyncCompleteCall RpcBindingToStringBindingW RpcEpUnregister RpcEpRegisterW RpcServerUseProtseqEpW RpcObjectSetType RpcServerRegisterIf2 RpcServerUnregisterIfEx RpcImpersonateClient RpcMgmtEpEltInqDone RpcStringBindingParseW RpcStringFreeW UuidToStringW UuidCreate UuidIsNil UuidFromStringW RpcRevertToSelf RpcBindingFree I_RpcBindingInqLocalClientPID RpcMgmtEpEltInqNextW RpcMgmtEpEltInqBegin

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsW

shell32

SHGetFolderPathW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

ws2_32

inet_ntoa

ntdll

RtlNtStatusToDosError VerSetConditionMask NtClose NtSetInformationThread NtSetInformationFile NtOpenKey RtlCaptureContext NtQueryKey NtDeleteKey RtlUnwind

kernel32

LCMapStringEx EncodePointer WakeConditionVariable GetLocaleInfoEx HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap GetLastError CreateMutexW SizeofResource LockResource LoadResource FindResourceExW FindResourceW CloseHandle SetErrorMode Sleep CreateFileW LoadLibraryW GetProcAddress FreeLibrary DuplicateHandle GetCurrentProcess SetEvent CreateEventW GetTempPathW CreateDirectoryW WaitForSingleObject MoveFileExW DeleteFileW MultiByteToWideChar ReadFile WriteFile SetFilePointer WideCharToMultiByte GetSystemTime SystemTimeToFileTime GetPrivateProfileStringW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleHandleW GetCommandLineW GetDateFormatW GetTimeFormatW GetVersionExW GetNativeSystemInfo GlobalMemoryStatusEx GetSystemDirectoryW GetModuleFileNameW GetFileAttributesExW GetPrivateProfileSectionW GetCurrentDirectoryW GetFileAttributesW CopyFileW GetCurrentProcessId GetFileSizeEx OutputDebugStringW SetConsoleCtrlHandler FreeConsole ReleaseMutex AttachConsole AllocConsole GetTickCount FindFirstFileW SetFileAttributesW FindNextFileW RemoveDirectoryW FindClose ExpandEnvironmentStringsW GetFileSize CreateFileMappingW MapViewOfFile UnmapViewOfFile GetLongPathNameW LocalFree GetCurrentThread CreateProcessW GetExitCodeProcess OpenProcess TerminateProcess K32EnumProcesses K32GetModuleFileNameExW K32GetProcessImageFileNameW TerminateThread VerifyVersionInfoW GetLocalTime FileTimeToSystemTime WritePrivateProfileStringW InitializeCriticalSectionEx DecodePointer GetFullPathNameW MoveFileW GlobalFree CreateWaitableTimerW SetWaitableTimer VirtualFree IsProcessorFeaturePresent GetVersion ResetEvent ReleaseSemaphore CreateSemaphoreW ResumeThread SetThreadAffinityMask GetModuleFileNameA GetModuleHandleExW GetCurrentThreadId GetFileTime CompareFileTime SetFilePointerEx UnlockFileEx LockFileEx QueryUnbiasedInterruptTime SetLastError CancelIoEx GetOverlappedResult ReadDirectoryChangesW UnregisterWaitEx ProcessIdToSessionId WaitForMultipleObjects InitializeCriticalSectionAndSpinCount GetThreadPriority RaiseException GetThreadTimes SetThreadPriority QueryPerformanceFrequency GetSystemTimeAsFileTime QueryPerformanceCounter QueryThreadCycleTime CompareStringW GetThreadId GetSystemInfo LoadLibraryExW DeviceIoControl GetEnvironmentVariableW GetExitCodeThread TlsAlloc TlsFree TlsSetValue TlsGetValue SetEndOfFile GetWindowsDirectoryW GetFileInformationByHandle FindFirstFileExW QueryDosDeviceW GetVolumePathNameW GetVolumeNameForVolumeMountPointW FlushFileBuffers OutputDebugStringA SetFileInformationByHandle GetDiskFreeSpaceExW K32GetMappedFileNameW VirtualQuery FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolWait WaitForThreadpoolWaitCallbacks GetSystemTimes GetTickCount64 WaitForSingleObjectEx SleepConditionVariableSRW WakeAllConditionVariable InitOnceComplete InitOnceBeginInitialize AcquireSRWLockShared ReleaseSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetStringTypeW FormatMessageA GetFileInformationByHandleEx AreFileApisANSI CompareStringEx GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeSListHead GetStartupInfoW InterlockedPushEntrySList GetCommandLineA GetConsoleCP GetFileType GetConsoleMode ReadConsoleW GetConsoleOutputCP CreateThread ExitThread FreeLibraryAndExitThread GetStdHandle ExitProcess LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetConsoleMode ReadConsoleInputW SetStdHandle GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW VirtualAlloc RegisterWaitForSingleObject

wininet

HttpEndRequestW InternetCrackUrlW HttpQueryInfoW InternetReadFile InternetWriteFile HttpSendRequestExW InternetConnectW InternetCanonicalizeUrlW InternetSetOptionW InternetOpenW HttpAddRequestHeadersW HttpSendRequestW HttpOpenRequestW FtpOpenFileW GopherOpenFileW InternetCloseHandle

winhttp

WinHttpOpenRequest WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpWriteData WinHttpSendRequest WinHttpAddRequestHeaders WinHttpSetCredentials WinHttpGetProxyForUrl WinHttpConnect WinHttpCrackUrl WinHttpSetOption WinHttpOpen

cabinet

ord22 ord23 ord20

dnsapi

DnsFree DnsQuery_W

powrprof

CallNtPowerInformation

generic

count=205, id=261, version=29395,

count=5, id=253, version=33030,

count=23, id=260, version=33030,

count=107, id=261, version=33030,

count=29, id=259, version=33030,

count=20, id=259, version=29395,

count=27, id=260, version=29395,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=260, version=30146,

count=6, productName=Unmarked objects (old),

count=1, id=263, version=29395,

count=1, id=262, version=29395,

count=4, id=261, version=30154,

count=28, id=257, version=29395,

count=9, id=257, version=30795,

count=496, id=1, productName=Unmarked objects,

count=10, id=260, version=30154,

count=242, id=265, version=33130,

count=1, id=256, version=33130,

count=1, id=255, version=33130,

count=2, id=151,

count=1, id=258, version=33130,