2026-11-09_2f824b3cac5fb2c75f18e18e445838f1_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_2f824b3cac5fb2c75f18e18e445838f1_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat
Size 6.5MB
Sample261110-3gfd4acd63
SHA256 f406620b257c82d3758ae645ad2eeb26483664ef3dd7be27ffac2653695d0887
MD5 2f824b3cac5fb2c75f18e18e445838f1
SHA1 5741e77f37196892053111b224f219f820a72f44
SHA512 0d684c33c52d229653b3d3a6277ae176cea5b32aa83ac232ad6f44bee51d9225998764212183a3dd40a15f67bcbb4362abbaa53775c5aba4d9f5f6fd93c3f820
SSDEEP 196608:jykAhfDYWhGxDV/I0M0LaLj95zZRRFokc:/AhfDYW8xVdcnzZRRmkc
TLSH
T186669D327A06C135EDA112715A7DDFBA502DAB311FB340CBB2C62E5E1D70AC22635E5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_2f824b3cac5fb2c75f18e18e445838f1_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

File Explorer

2026-11-09_2f824b3cac5fb2c75f18e18e445838f1_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

.exe 6.5MB

2026-11-09_2f824b3cac5fb2c75f18e18e445838f1_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat

IMPHASH 805779ddf86a6df030c291346d1e95d8
SHA256 f406620b257c82d3758ae645ad2eeb26483664ef3dd7be27ffac2653695d0887
MD5 2f824b3cac5fb2c75f18e18e445838f1
SHA1 5741e77f37196892053111b224f219f820a72f44
SHA512 0d684c33c52d229653b3d3a6277ae176cea5b32aa83ac232ad6f44bee51d9225998764212183a3dd40a15f67bcbb4362abbaa53775c5aba4d9f5f6fd93c3f820
SSDEEP 196608:jykAhfDYWhGxDV/I0M0LaLj95zZRRFokc:/AhfDYW8xVdcnzZRRmkc
TLSH
T186669D327A06C135EDA112715A7DDFBA502DAB311FB340CBB2C62E5E1D70AC22635E5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3508812

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\986529\out\Release\SoftMgr.pdb

kernel32

OpenMutexW CreateNamedPipeW CreateIoCompletionPort PostQueuedCompletionStatus ConnectNamedPipe GetVolumeInformationW SetThreadLocale lstrlenA TerminateThread GetWindowsDirectoryA SuspendThread GetModuleHandleExW lstrcpyW SetFilePointerEx CreateFileA GetModuleFileNameA ExpandEnvironmentStringsA GetSystemDirectoryA GetFileAttributesA GetFileTime MoveFileA GetDiskFreeSpaceExA GetDriveTypeA GetLogicalDriveStringsA lstrcmpiA GetPrivateProfileStringA WritePrivateProfileStringA EnumResourceNamesW FindResourceExA BeginUpdateResourceA UpdateResourceA UpdateResourceW EndUpdateResourceW SetThreadPriority OpenEventA DeleteFileA RemoveDirectoryA FormatMessageA SetFileTime GetFileAttributesExW GetStdHandle GetModuleHandleA ProcessIdToSessionId GetBinaryTypeW FileTimeToSystemTime lstrcmpA GetFileSize CreateJobObjectW GetVersion GetLocalTime DeviceIoControl GetConsoleWindow GetFileAttributesW GetEnvironmentVariableW FindNextFileA SystemTimeToFileTime WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage SetStdHandle CreatePipe FlushFileBuffers GetConsoleOutputCP ReadConsoleW GetConsoleMode IsValidLocale MoveFileW ExitProcess FreeLibraryAndExitThread ExitThread RtlUnwind SetUnhandledExceptionFilter UnhandledExceptionFilter TlsFree TlsSetValue TlsGetValue TlsAlloc HeapWalk HeapUnlock HeapLock InterlockedDecrement InterlockedIncrement GetACP FormatMessageW VerifyVersionInfoW VerSetConditionMask FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent GetCPInfo QueryPerformanceFrequency InitializeCriticalSection GetCommandLineW lstrlenW SetFileAttributesW MoveFileExW DeleteFileW GetFileSizeEx GetPrivateProfileIntW GetPrivateProfileStringW SetFilePointer OutputDebugStringW DeleteCriticalSection FindResourceExW FindResourceW LoadResource LockResource SizeofResource lstrcpynW SearchPathW GetFullPathNameW GetDriveTypeW GetLogicalDriveStringsW GetProcessHeap HeapDestroy OutputDebugStringA QueryInformationJobObject LocalFileTimeToFileTime ResumeThread OpenEventW AssignProcessToJobObject GetStartupInfoW EnumSystemLocalesW GetUserDefaultLCID GetSystemDefaultLCID GetSystemDefaultLangID GetUserDefaultLangID GetThreadLocale GetLocaleInfoW LCMapStringW WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetTimeFormatW GetDateFormatW GetTimeZoneInformation SystemTimeToTzSpecificLocalTime MulDiv LocalFree LocalAlloc GlobalFree GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary UnmapViewOfFile VirtualFreeEx GetDiskFreeSpaceExW FreeResource CopyFileW CreateToolhelp32Snapshot Process32FirstW Process32NextW FindNextFileW FindClose RemoveDirectoryW CreateDirectoryW GetExitCodeProcess GlobalSize SetEndOfFile FlushViewOfFile WritePrivateProfileStringW GetTempFileNameW lstrcmpW lstrcmpiW GlobalUnlock GlobalLock GetFileType GlobalAlloc MapViewOfFileEx MapViewOfFile OpenFileMappingW CreateFileMappingW WriteProcessMemory ReadProcessMemory VirtualAllocEx VirtualQuery VirtualFree VirtualProtect VirtualAlloc GetNativeSystemInfo GetVersionExW GetWindowsDirectoryW GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GlobalMemoryStatusEx IsProcessorFeaturePresent CreateProcessW GetExitCodeThread GetCurrentThreadId CreateRemoteThread CreateThread TerminateProcess GetCurrentProcessId GetCurrentProcess WaitForMultipleObjects Sleep CreateEventW CreateEventA CreateMutexW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GetQueuedCompletionStatus HeapSize HeapFree HeapReAlloc HeapAlloc QueryPerformanceCounter SetErrorMode SetLastError GetLastError RaiseException AreFileApisANSI GetTempPathW GetLongPathNameW FindFirstFileW FindFirstFileA CreateFileW GetCurrentDirectoryW ExpandEnvironmentStringsW

user32

EndPaint GetFocus GetWindow GetClassNameW GetSysColor EnumWindows GetWindowThreadProcessId LoadImageW MonitorFromWindow GetMonitorInfoW UnregisterClassW CopyRect DialogBoxParamW IsWindow EqualRect OffsetRect InflateRect LoadCursorW GetActiveWindow ClientToScreen RegisterClassExW FindWindowExW GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW GetClassInfoExW CallWindowProcW KillTimer GetDlgItem SendMessageTimeoutW DefWindowProcW PostQuitMessage RegisterClassW CreateWindowExW DestroyWindow UpdateLayeredWindow SetTimer GetSystemMetrics GetDC ReleaseDC DrawTextW MapVirtualKeyW GetKeyNameTextW IsClipboardFormatAvailable GetClipboardData UnionRect DestroyCursor GetCursorPos CharNextW keybd_event GetCursorInfo SetCursorPos ShowCursor mouse_event LoadStringA GetLastInputInfo MsgWaitForMultipleObjects EnumDesktopWindows GetClassNameA FindWindowA MessageBoxA ReplyMessage AllowSetForegroundWindow SetWindowRgn GetAsyncKeyState GetWindowTextA SendMessageA SetLayeredWindowAttributes ExitWindowsEx UpdateWindow IsWindowEnabled CreateIconIndirect SetCursor IsRectEmpty IntersectRect MessageBoxW GetClassInfoW GetIconInfo CreateIcon GetWindowPlacement LoadIconW EnableWindow EndDialog SetClipboardData CloseClipboard EmptyClipboard OpenClipboard PtInRect wsprintfW SetParent PeekMessageW RegisterWindowMessageW GetWindowTextLengthW GetWindowTextW BeginPaint GetCursor GetUpdateRect GetKeyState RedrawWindow CreateAcceleratorTableW ScreenToClient GetParent ShowWindow WaitForInputIdle GetForegroundWindow AttachThreadInput SetForegroundWindow BringWindowToTop SetActiveWindow SetWindowTextW SetWindowPos IsWindowVisible DestroyIcon FindWindowW SetWindowLongW GetWindowLongW WindowFromPoint IsZoomed AppendMenuW MapWindowPoints GetWindowRect TrackPopupMenu CreatePopupMenu MonitorFromPoint DestroyMenu IsChild GetClientRect MoveWindow SetFocus DestroyAcceleratorTable GetDesktopWindow InvalidateRect InvalidateRgn FillRect ReleaseCapture SetCapture IsIconic

gdi32

CreateRoundRectRgn SetTextColor GetBitmapBits DPtoLP CreateFontIndirectW GetDIBits CreateDIBSection SetDIBColorTable SetBkMode SetStretchBltMode CreateSolidBrush CreateCompatibleDC CreateCompatibleBitmap SelectObject DeleteObject BitBlt GetStockObject GetObjectW DeleteDC GetDeviceCaps CreateBitmap GetObjectA CreateRectRgnIndirect GetWindowOrgEx RestoreDC SaveDC ExtSelectClipRgn SetBkColor StretchBlt SetWindowOrgEx

advapi32

RegQueryInfoKeyW RegCreateKeyExW RegDeleteKeyA RegDeleteKeyW RegDeleteValueA RegDeleteValueW RegEnumKeyW RegOpenKeyW RegQueryInfoKeyA RegEnumValueA RegEnumKeyExA BuildExplicitAccessWithNameW SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW FreeSid CheckTokenMembership AllocateAndInitializeSid DuplicateToken AdjustTokenPrivileges LookupPrivilegeValueW GetSidSubAuthority GetSidSubAuthorityCount GetSidIdentifierAuthority IsValidSid LookupAccountNameW RegEnumValueW LookupAccountSidW RegEnumKeyExW RegOpenKeyExA ConvertSidToStringSidW OpenProcessToken GetUserNameW CryptGenRandom CryptReleaseContext CryptAcquireContextW RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegCreateKeyExA

shell32

ord155 SHGetFolderPathW SHCreateDirectoryExA SHChangeNotify ord190 SHGetSpecialFolderPathA SHGetSpecialFolderPathW SHGetPathFromIDListW SHBrowseForFolderW Shell_NotifyIconW ShellExecuteExW SHCreateDirectoryExW ord165 ShellExecuteW

ole32

CLSIDFromProgID CoLoadLibrary StringFromCLSID CoUninitialize CoInitializeEx CoTaskMemAlloc CoTaskMemFree CreateStreamOnHGlobal OleUninitialize StringFromGUID2 CoTaskMemRealloc CoCreateInstance CoGetClassObject OleLockRunning CLSIDFromString OleInitialize PropVariantClear CoInitialize

oleaut32

VarBstrCmp SysAllocStringLen LoadTypeLi LoadRegTypeLi SysStringLen DispCallFunc SysAllocStringByteLen SysStringByteLen VariantInit SysFreeString VariantCopy SafeArrayGetElement SafeArrayGetLBound SafeArrayGetUBound VarUI4FromStr VariantTimeToSystemTime SystemTimeToVariantTime SafeArrayGetVartype SafeArrayLock SafeArrayUnlock SafeArrayCreate OleCreateFontIndirect VariantClear SafeArrayPutElement SafeArrayCreateVector SafeArrayGetElemsize SysAllocString SafeArrayDestroy SafeArrayCopy VariantChangeType

shlwapi

PathUnquoteSpacesW ord176 PathCanonicalizeW StrRChrW UrlIsW StrStrW StrToInt64ExA PathRemoveFileSpecA PathBuildRootW PathGetDriveNumberW StrChrW PathRemoveExtensionW PathStripPathW PathIsPrefixW StrCpyNW UrlGetPartW SHGetValueA PathFileExistsA PathFindFileNameA PathRemoveExtensionA StrCmpNIA StrRStrIA StrRStrIW StrFormatByteSizeA PathIsDirectoryA PathIsRelativeW PathAddBackslashA ord12 StrStrA PathIsRelativeA SHStrDupW SHSetValueA StrCmpW SHDeleteKeyW SHGetValueW PathFileExistsW StrCmpIW PathAppendW PathCombineW PathFindFileNameW PathRemoveFileSpecW StrFormatByteSizeW StrToIntW PathIsDirectoryW StrStrIA SHDeleteValueW StrStrIW StrCmpNIW PathIsRootW PathFindExtensionW SHSetValueW PathAppendA PathAddBackslashW PathRemoveBackslashW

ws2_32

gethostbyname inet_ntoa WSAStartup

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

psapi

EnumProcessModules GetModuleBaseNameW GetProcessImageFileNameW GetModuleFileNameExW

setupapi

SetupIterateCabinetW

iphlpapi

GetAdaptersInfo GetNetworkParams

gdiplus

GdipAddPathRectangle GdipAddPathEllipse GdipCreateLineBrushFromRectI GdipSetPenDashStyle GdipSetPenDashArray GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipTranslateWorldTransform GdipRotateWorldTransform GdipGetWorldTransform GdipDrawLineI GdipDrawRectangleI GdipDrawEllipse GdipDrawPath GdipFillEllipse GdipFillPath GdipDrawImageRectI GdipSetClipPath GdipResetClip GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipMeasureString GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipCloneStringFormat GdipCreatePathGradientFromPath GdipDeleteRegion GdipCreateRegionPath GdipSetSmoothingMode GdipLoadImageFromStream GdipAddPathPath GdipCloneBitmapAreaI GdipCreateHICONFromBitmap GdipCreateBitmapFromHBITMAP GdipDrawImageRectRectI GdipDeleteGraphics GdipCreateFromHDC GdipCreateBitmapFromFile GdipAddPathLine GdipDeletePath GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetImageFlags GdipGetImageRawFormat GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageHorizontalResolution GdipGetImageVerticalResolution GdipGetPropertySize GdipCreatePath GdipDrawImageRect GdipSetWorldTransform GdipImageRotateFlip GdipCreatePen2 GdipSetLineBlend GdipCreateLineBrushFromRect GdipRotateMatrix GdipTranslateMatrix GdipDeleteMatrix GdipCreateMatrix GdipClosePathFigure GdipFillRegion GdipSetPixelOffsetMode GdipGetAllPropertyItems GdipGetImageEncodersSize GdipGetImageEncoders GdipCreateBitmapFromScan0 GdipSetImagePalette GdipBitmapLockBits GdipBitmapUnlockBits GdipCloneImage GdipAlloc GdipDisposeImage GdipFree GdipBitmapSetResolution GdipSetPropertyItem GdipSaveImageToFile GdiplusShutdown GdiplusStartup GdipDrawArc GdipDeletePen GdipCreatePen1 GdipCreateHBITMAPFromBitmap GdipAddPathArc GdipSetPathGradientFocusScales GdipSetPathGradientWrapMode GdipCreateBitmapFromStreamICM GdipSetPathGradientPresetBlend GdipGetPropertyItem GdipGetPropertyItemSize GdipDrawImageRectRect GdipGetImageGraphicsContext GdipLoadImageFromFile GdipDrawString GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipSetStringFormatFlags GdipSaveImageToStream GdipSetStringFormatAlign GdipSetTextRenderingHint GdipCreateBitmapFromStream

msimg32

AlphaBlend

winmm

timeSetEvent timeKillEvent

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext

crypt32

CryptStringToBinaryW CryptStringToBinaryA CertGetNameStringW

comctl32

_TrackMouseEvent ord17 InitCommonControlsEx

urlmon

UrlMkSetSessionOption ObtainUserAgentString

wininet

InternetCrackUrlW

wintrust

WinVerifyTrust WTHelperProvDataFromStateData

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

msi

ord173 ord217

generic

count=39, id=259, version=30795,

count=253, id=261, version=30795,

count=4, id=261, version=30148,

count=6, id=253, version=34918,

count=30, id=259, version=34918,

count=24, id=260, version=34918,

count=3, id=261, version=27045,

count=10, id=260, version=27045,

count=1, id=263, version=30795,

count=77, id=261, version=27051,

count=109, id=261, version=34918,

count=48, id=260, version=30795,

count=63, id=257, version=30795,

count=994, id=1, productName=Unmarked objects,

count=45, id=260, version=35207,

count=141, id=261, version=35207,

count=1, id=261, version=35219,

count=220, id=265, version=35207,

count=1, id=256, version=35207,

count=1, id=255, version=35207,

count=1, id=151,

count=1, id=258, version=35207,