2026-03-16_dcd8b0f3b6694a835833d5006658b073_amadey_elex_hellokitty_luca-stealer_njrat_play

General

Target
2026-03-16_dcd8b0f3b6694a835833d5006658b073_amadey_elex_hellokitty_luca-stealer_njrat_play
Size 2.7MB
Sample260316-gcwpmaft5p
SHA256 6ad67bf29071c03de3b0d4ec8c0e05f637aa2bf5b9624d28ef8c9c0e8a572c90
MD5 dcd8b0f3b6694a835833d5006658b073
SHA1 7ec7213d22a5490193a32ce1a6ff9e40d9f41d49
SHA512 2c903e1bc87cce15d6b5e86496dbfa25817964713290a3d69ca31b542716c996ea2bc67ac94a3b492e8dcfaa1787d2a35cf9591a3260d8d18d3d55a3cdb77d29
SSDEEP 49152:RfDbaCgPpVne2IUS3Xr9aI6BB6GwyvZNVeA4i:R7uzPW1wwSA
TLSH
T113D50939BFE9C9A0EDAF56749C78E3D42A6BF8611D24A11F155A33CE0F366409C50B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-03-16_dcd8b0f3b6694a835833d5006658b073_amadey_elex_hellokitty_luca-stealer_njrat_play

File Explorer

2026-03-16_dcd8b0f3b6694a835833d5006658b073_amadey_elex_hellokitty_luca-stealer_njrat_play

.exe 2.7MB

2026-03-16_dcd8b0f3b6694a835833d5006658b073_amadey_elex_hellokitty_luca-stealer_njrat_play

IMPHASH 0342305287526630b0692bf1d3350409
SHA256 6ad67bf29071c03de3b0d4ec8c0e05f637aa2bf5b9624d28ef8c9c0e8a572c90
MD5 dcd8b0f3b6694a835833d5006658b073
SHA1 7ec7213d22a5490193a32ce1a6ff9e40d9f41d49
SHA512 2c903e1bc87cce15d6b5e86496dbfa25817964713290a3d69ca31b542716c996ea2bc67ac94a3b492e8dcfaa1787d2a35cf9591a3260d8d18d3d55a3cdb77d29
SSDEEP 49152:RfDbaCgPpVne2IUS3Xr9aI6BB6GwyvZNVeA4i:R7uzPW1wwSA
TLSH
T113D50939BFE9C9A0EDAF56749C78E3D42A6BF8611D24A11F155A33CE0F366409C50B32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

49002

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetSystemDirectoryA GetProcAddress ExitProcess FreeLibrary GetEnvironmentStrings SleepEx GetTickCount VirtualAlloc GetCommandLineA GetTickCount64 CreateDirectoryA GetModuleFileNameA FindFirstFileW SetHandleCount VirtualProtect GetCurrentProcess GetConsoleOutputCP lstrlenW GetStdHandle WriteConsoleA DeviceIoControl GetConsoleCP LeaveCriticalSection lstrlenA LocalAlloc CreateFileW GetFileAttributesW GetCurrentThreadId lstrcmpA GetSystemDirectoryW GetCurrentDirectoryA GetModuleHandleA SetFileAttributesW GetFileInformationByHandle LocalFileTimeToFileTime GetFileAttributesA FindClose GetCurrentThread LoadLibraryA TlsAlloc FindResourceExW GetWindowsDirectoryA LoadResource FindResourceW SetStdHandle SystemTimeToFileTime GetModuleHandleW TlsGetValue TlsFree QueryPerformanceCounter SetUnhandledExceptionFilter WriteConsoleW CloseHandle SetFilePointerEx GetConsoleMode FlushFileBuffers HeapReAlloc HeapSize GetStringTypeW GetFileType GetProcessHeap DecodePointer LCMapStringW FindNextFileA LoadLibraryExA CreateFileA FindFirstFileA FreeEnvironmentStringsW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead TerminateProcess RtlUnwind RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsSetValue LoadLibraryExW GetModuleHandleExW GetModuleFileNameW WriteFile HeapAlloc HeapFree FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW

user32

GetFocus GetCaretPos MessageBoxW GetClipboardOwner GetOpenClipboardWindow GetActiveWindow GetInputState MessageBoxA GetMessageTime SetWindowsHookExW GetDesktopWindow GetProcessWindowStation GetCursorPos CloseWindow DestroyWindow SendMessageTimeoutA DefWindowProcA CreateDialogParamA PostQuitMessage FindWindowA GetClipboardViewer

advapi32

RegCloseKey RegOpenKeyA RegEnumKeyA

shlwapi

PathAppendA PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-03-16_dcd8b0f3b6694a835833d5006658b073_amadey_elex_hellokitty_luca-stealer_njrat_play

kernel32

user32

advapi32

shlwapi

generic