2026-11-11_67ffbff1b2c8109b167fa276c62bc39e_amadey_darkgate_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-11_67ffbff1b2c8109b167fa276c62bc39e_amadey_darkgate_elex_luca-stealer_lynx_njrat
Size 2.3MB
Sample261113-mt33xsav2x
SHA256 0c0a8eb4673d6bcbf76c47324e85849a335d8d6762f7f7f83af86a96e3a9e679
MD5 67ffbff1b2c8109b167fa276c62bc39e
SHA1 37ed8ee57f431fe122afe80e4819e6574b185cf9
SHA512 b1246d89822d2f5c33e42949fd45b8e4fffa30fa985e493fe60e2e058ad3ff670c6caf57984aa023d27f947e89dc69ad08b32afc9b0cb4cd806310631ce6b7f8
SSDEEP 49152:mgfkcQ366Xf8Oszc/rZAhXTuiqhJ8WYOlrcNcsxq6ERTjqTvDEF1Y1c7gfIKcEK1:aB66XfX+KiqhvYOJcNcMC/SvDAqqE0Eu
TLSH
T1FCB5E0313586C132D5B101F04D69ABAED47F6E285B3119CFA3C41E6997333E26A31EE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-11_67ffbff1b2c8109b167fa276c62bc39e_amadey_darkgate_elex_luca-stealer_lynx_njrat

File Explorer

2026-11-11_67ffbff1b2c8109b167fa276c62bc39e_amadey_darkgate_elex_luca-stealer_lynx_njrat

.exe 2.3MB

2026-11-11_67ffbff1b2c8109b167fa276c62bc39e_amadey_darkgate_elex_luca-stealer_lynx_njrat

IMPHASH 107c89b80c6cfc49f0270838fe536552
SHA256 0c0a8eb4673d6bcbf76c47324e85849a335d8d6762f7f7f83af86a96e3a9e679
MD5 67ffbff1b2c8109b167fa276c62bc39e
SHA1 37ed8ee57f431fe122afe80e4819e6574b185cf9
SHA512 b1246d89822d2f5c33e42949fd45b8e4fffa30fa985e493fe60e2e058ad3ff670c6caf57984aa023d27f947e89dc69ad08b32afc9b0cb4cd806310631ce6b7f8
SSDEEP 49152:mgfkcQ366Xf8Oszc/rZAhXTuiqhJ8WYOlrcNcsxq6ERTjqTvDEF1Y1c7gfIKcEK1:aB66XfX+KiqhvYOJcNcMC/SvDAqqE0Eu
TLSH
T1FCB5E0313586C132D5B101F04D69ABAED47F6E285B3119CFA3C41E6997333E26A31EE6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

308576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FreeLibrary GetSystemTimeAsFileTime GetEnvironmentStringsW CompareStringEx GetLocaleInfoEx LCMapStringEx GetComputerNameW GetProcAddress GetTimeZoneInformation GetLocalTime FileTimeToSystemTime WritePrivateProfileStringW GetCurrentProcessId CreateThread WaitForSingleObject CreateMutexW TerminateProcess lstrcmpiW lstrcmpiA CopyFileW DeleteFileW Sleep FindClose RemoveDirectoryW FindNextFileW FindFirstFileW lstrcpyW GetModuleHandleW GetProcessHeap DeleteCriticalSection LoadLibraryW DecodePointer WriteConsoleW GetConsoleOutputCP GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetTimeFormatW GetDateFormatW QueryPerformanceFrequency GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer RtlUnwind CreateHardLinkW GetShortPathNameW GetLongPathNameW GetConsoleMode TerminateThread GetTickCount64 GetPrivateProfileStringW CreateEventW OutputDebugStringA GetSystemTime SystemTimeToFileTime MoveFileExW HeapAlloc RaiseException CloseHandle HeapReAlloc GetLastError GetCommandLineA HeapSize lstrlenA InitializeCriticalSectionEx lstrlenW GetCommandLineW HeapFree SetFilePointer SetEndOfFile GetFileType FlushFileBuffers MoveFileW DeviceIoControl SetFileTime SetFileAttributesW GetFileAttributesW GetProcessAffinityMask CreateSemaphoreW ReleaseSemaphore InitializeCriticalSection GetVersionExW SetThreadExecutionState IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection WideCharToMultiByte MultiByteToWideChar GetModuleFileNameW GetTempPathW LocalFree FileTimeToLocalFileTime ReadFile WriteFile FindResourceW LoadResource SizeofResource LockResource GlobalSize GlobalLock GlobalAlloc GlobalUnlock GlobalFree CreateFileW GetCurrentThreadId GetFileSizeEx SetFilePointerEx GetWindowsDirectoryA lstrcpyA GetNativeSystemInfo GetStartupInfoW CreateProcessW GetStdHandle GetFileSize GetTickCount OpenProcess CreateDirectoryW K32GetModuleFileNameExW QueryFullProcessImageNameW lstrcmpW GetSystemDirectoryW lstrcatW SetLastError CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessTimes SetEvent GetCurrentProcess InitializeCriticalSectionAndSpinCount ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead AreFileApisANSI CompareStringW GetCPInfo IsDBCSLeadByte LocalFileTimeToFileTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime GetCurrentDirectoryW GetFullPathNameW FoldStringW SetThreadPriority

user32

GetSystemMetrics SetWindowTextW RegisterClassExW LoadAcceleratorsW GetWindowThreadProcessId OpenClipboard EnumClipboardFormats GetClipboardData EmptyClipboard SetClipboardData CloseClipboard GetClassNameW EnumChildWindows EnumWindows GetClassLongW SendInput keybd_event GetKeyState mouse_event IsIconic SetLayeredWindowAttributes SendMessageW OemToCharA OemToCharBuffA CharUpperW CharLowerW CharToOemBuffW LoadStringW ShowWindow IsWindow DispatchMessageW SetTimer IsDialogMessageW CreateWindowExW SendDlgItemMessageW MoveWindow SetFocus TranslateAcceleratorW TranslateMessage LoadIconW LoadCursorW SetWindowLongW GetClientRect GetDlgItem PostQuitMessage GetDesktopWindow MessageBoxW SetWindowPos GetDC DestroyWindow GetWindowRect DefWindowProcW CreateDialogParamW GetMessageW GetWindowTextW EndPaint BeginPaint ReleaseDC GetWindowLongW FindWindowW IsWindowVisible PostMessageW SetForegroundWindow wsprintfW SetCapture ClientToScreen CharToOemA UpdateWindow LoadImageW InvalidateRect ChildWindowFromPoint SetDlgItemTextW

gdi32

SelectObject GetDeviceCaps SetTextColor SetBkMode LineTo CreatePen MoveToEx DeleteObject CreateSolidBrush CreateFontIndirectW

advapi32

RegCloseKey RegSetValueExW RegOpenKeyExW RegGetValueW LookupAccountNameW ConvertSidToStringSidA RegCreateKeyExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken AllocateAndInitializeSid CheckTokenMembership FreeSid SetFileSecurityW

shell32

SHGetSpecialFolderPathW ShellExecuteW ShellExecuteExW SHCreateDirectoryExW

ole32

CoCreateGuid CoUninitialize CoInitializeEx CoCreateInstance CoSetProxyBlanket

oleaut32

SysFreeString VariantClear VariantInit SysAllocString

shlwapi

PathFileExistsA PathAppendA StrStrA PathAppendW PathIsDirectoryW PathFindExtensionW PathFindFileNameW StrStrW SHGetValueW StrStrIW SHSetValueW StrStrIA PathFileExistsW

iphlpapi

GetAdaptersAddresses

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

winhttp

WinHttpSetOption WinHttpConnect WinHttpOpenRequest WinHttpQueryOption WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpSendRequest WinHttpWriteData WinHttpReceiveResponse WinHttpCloseHandle WinHttpReadData WinHttpCrackUrl WinHttpOpen WinHttpQueryDataAvailable

ws2_32

inet_ntop

_cJSON_AddArrayToObject@8 _cJSON_AddBoolToObject@12 _cJSON_AddFalseToObject@8 _cJSON_AddItemReferenceToArray@8 _cJSON_AddItemReferenceToObject@12 _cJSON_AddItemToArray@8 _cJSON_AddItemToObject@12 _cJSON_AddItemToObjectCS@12 _cJSON_AddNullToObject@8 _cJSON_AddNumberToObject@16 _cJSON_AddObjectToObject@8 _cJSON_AddRawToObject@12 _cJSON_AddStringToObject@12 _cJSON_AddTrueToObject@8 _cJSON_Compare@12 _cJSON_CreateArray@0 _cJSON_CreateArrayReference@4 _cJSON_CreateBool@4 _cJSON_CreateDoubleArray@8 _cJSON_CreateFalse@0 _cJSON_CreateFloatArray@8 _cJSON_CreateIntArray@8 _cJSON_CreateNull@0 _cJSON_CreateNumber@8 _cJSON_CreateObject@0 _cJSON_CreateObjectReference@4 _cJSON_CreateRaw@4 _cJSON_CreateString@4 _cJSON_CreateStringArray@8 _cJSON_CreateStringReference@4 _cJSON_CreateTrue@0 _cJSON_Delete@4 _cJSON_DeleteItemFromArray@8 _cJSON_DeleteItemFromObject@8 _cJSON_DeleteItemFromObjectCaseSensitive@8 _cJSON_DetachItemFromArray@8 _cJSON_DetachItemFromObject@8 _cJSON_DetachItemFromObjectCaseSensitive@8 _cJSON_DetachItemViaPointer@8 _cJSON_Duplicate@8 _cJSON_GetArrayItem@8 _cJSON_GetArraySize@4 _cJSON_GetErrorPtr@0 _cJSON_GetNumberValue@4 _cJSON_GetObjectItem@8 _cJSON_GetObjectItemCaseSensitive@8 _cJSON_GetStringValue@4 _cJSON_HasObjectItem@8 _cJSON_InitHooks@4 _cJSON_InsertItemInArray@12 _cJSON_IsArray@4 _cJSON_IsBool@4 _cJSON_IsFalse@4 _cJSON_IsInvalid@4 _cJSON_IsNull@4 _cJSON_IsNumber@4 _cJSON_IsObject@4 _cJSON_IsRaw@4 _cJSON_IsString@4 _cJSON_IsTrue@4 _cJSON_Minify@4 _cJSON_Parse@4 _cJSON_ParseWithLength@8 _cJSON_ParseWithLengthOpts@16 _cJSON_ParseWithOpts@12 _cJSON_Print@4 _cJSON_PrintBuffered@12 _cJSON_PrintPreallocated@16 _cJSON_PrintUnformatted@4 _cJSON_ReplaceItemInArray@12 _cJSON_ReplaceItemInObject@12 _cJSON_ReplaceItemInObjectCaseSensitive@12 _cJSON_ReplaceItemViaPointer@12 _cJSON_SetNumberHelper@12 _cJSON_SetValuestring@8 _cJSON_Version@0 _cJSON_free@4 _cJSON_malloc@4

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_67ffbff1b2c8109b167fa276c62bc39e_amadey_darkgate_elex_luca-stealer_lynx_njrat

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

iphlpapi

version

winhttp

ws2_32

generic