File name:

2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx

Full analysis: https://app.any.run/tasks/beba7e6e-ed20-40c4-b744-269b73863178
Verdict: Malicious activity
Analysis date: June 04, 2025, 19:42:34
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
m0yv
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

E715760EBDB96F2941EF94763E1280E7

SHA1:

157F5FFE4CAC7168E67C75CDFE062FEBA2A32569

SHA256:

0E1344D58F6B5EB5C32E56E22253B7D652984A5C087EC8205DCD1DE26B724FA5

SSDEEP:

98304:70PKfpT5f7CM4MU91UI22IT1PD2222222721vFdGBeQN0aFvGSSRkrlcfABLqI1d:6X4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • M0YV has been detected (YARA)

      • 2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exe (PID: 7128)

  • SUSPICIOUS

    • Searches for installed software

      • 2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exe (PID: 7128)

    • Reads the BIOS version

      • 2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exe (PID: 7128)

    • Creates files in the driver directory

      • 2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exe (PID: 7128)

  • INFO

    • Reads the computer name

      • 2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exe (PID: 7128)

    • The sample compiled with english language support

      • 2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exe (PID: 7128)

    • Create files in a temporary directory

      • 2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exe (PID: 7128)

    • Checks supported languages

      • 2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exe (PID: 7128)

    • Reads the machine GUID from the registry

      • 2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exe (PID: 7128)

    • Creates files in the program directory

      • 2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exe (PID: 7128)

    • Reads the software policy settings

      • 2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exe (PID: 7128)
      • slui.exe (PID: 8072)

    • Checks proxy server information

      • slui.exe (PID: 8072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:30 16:19:50+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 752640
InitializedDataSize: 1798144
UninitializedDataSize: -
EntryPoint: 0x6f66d
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 5.1.8.108
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Malwarebytes
FileDescription: Malwarebytes Setup
FileVersion: 5.1.8.108
LegalCopyright: Copyright (C) 2017 - 2024 Malwarebytes, Inc. All rights reserved.
InternalName: MBSetup.exe
OriginalFileName: MBSetup.exe
ProductName: Malwarebytes
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #M0YV 2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exe slui.exe 2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
7128"C:\Users\admin\Desktop\2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exe" C:\Users\admin\Desktop\2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exe
explorer.exe
User:
admin
Company:
Malwarebytes
Integrity Level:
HIGH
Description:
Malwarebytes Setup
Version:
5.1.8.108
Modules
Images
c:\users\admin\desktop\2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\crypt32.dll
7680"C:\Users\admin\Desktop\2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exe" C:\Users\admin\Desktop\2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exe—explorer.exe
User:
admin
Company:
Malwarebytes
Integrity Level:
MEDIUM
Description:
Malwarebytes Setup
Exit code:
3221226540
Version:
5.1.8.108
Modules
Images
c:\users\admin\desktop\2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
8072C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
6 857
Read events
6 854
Write events
2
Delete events
1

Modification events

(PID) Process:(7128) 2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\mbamtestkey
Operation:delete keyName:(default)
Value:
(PID) Process:(7128) 2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Malwarebytes
Operation:writeName:id
Value:
13664f485aec4d0cb55cf8d3a7f4839c
(PID) Process:(7128) 2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Malwarebytes
Operation:writeName:id
Value:
13664f485aec4d0cb55cf8d3a7f4839c
Executable files
0
Suspicious files
0
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
71282025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exeC:\Program Files (x86)\mbamtestfile.dattext
MD5:9F06243ABCB89C70E0C331C61D871FA7
SHA256:837CCB607E312B170FAC7383D7CCFD61FA5072793F19A25E75FBACB56539B86B
71282025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exeC:\ProgramData\mbamtestfile.dattext
MD5:9F06243ABCB89C70E0C331C61D871FA7
SHA256:837CCB607E312B170FAC7383D7CCFD61FA5072793F19A25E75FBACB56539B86B
71282025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exeC:\Windows\SysWOW64\drivers\mbamtestfile.dattext
MD5:9F06243ABCB89C70E0C331C61D871FA7
SHA256:837CCB607E312B170FAC7383D7CCFD61FA5072793F19A25E75FBACB56539B86B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
41
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
200
52.26.224.144:443
https://api2.amplitude.com/batch
unknown
binary
92 b
whitelisted
7628
svchost.exe
GET
200
184.25.50.8:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7628
svchost.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7556
RUXIMICS.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7556
RUXIMICS.exe
GET
200
184.25.50.8:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
40.126.31.131:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
—
—
POST
200
40.126.32.68:443
https://login.live.com/RST2.srf
unknown
xml
11.0 Kb
whitelisted
—
—
GET
200
4.245.163.56:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
compressed
23.9 Kb
whitelisted
—
—
GET
304
4.245.163.56:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
7628
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
7556
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
7128
2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx.exe
52.26.224.144:443
api2.amplitude.com
AMAZON-02
US
whitelisted
7628
svchost.exe
184.25.50.8:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
7556
RUXIMICS.exe
184.25.50.8:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
7628
svchost.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
7556
RUXIMICS.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
api2.amplitude.com
  • 52.26.224.144
  • 52.41.50.69
  • 54.69.121.6
  • 52.26.137.184
  • 52.41.141.196
  • 52.42.150.35
  • 34.213.11.131
  • 35.86.44.227
whitelisted
crl.microsoft.com
  • 184.25.50.8
  • 184.25.50.10
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
login.live.com
  • 20.190.159.73
  • 40.126.31.69
  • 20.190.159.68
  • 20.190.159.2
  • 20.190.159.75
  • 20.190.159.64
  • 40.126.31.129
  • 20.190.159.0
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-06-04_e715760ebdb96f2941ef94763e1280e7_amadey_black-basta_darkgate_elex_luca-stealer_lynx