General
- Target 2026-05-23_50b65241f32d43dc5e306eb86a0d1aed_amadey_cobalt-strike_hellokitty_hijackloader_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc
- Size 7.3MB
- Sample260523-a4pbascs2v
- SHA256 e16f7582b4909b24f30478a6fee4e21f40cd4199c779fc3a99dabc316ce52c74
- MD5 50b65241f32d43dc5e306eb86a0d1aed
- SHA1 0af6ea620ff6c90e6ca579a384735f9ae9f3caec
- SHA512 109fc64df6504058796475139a02640efbb92c7dc521dd91bd0613bf07e4dc5486649cb9deaa12e0b8063ac218390175c9a77575cc3ef9d1d7d1e94bbb16c932
- SSDEEP 98304:ciGV4qqiyavV6MsWHqBmKjKWQckVgtev5mnlNL3:cii4biyavI75rKWQc0gEYnvL3
- TLSH T11076D01AB7A401E8C0E7D9B8CA175D13EAB2781513369BEB17E089555F23AF05F3E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-05-23_50b65241f32d43dc5e306eb86a0d1aed_amadey_cobalt-strike_hellokitty_hijackloader_icedid_luca.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-23_50b65241f32d43dc5e306eb86a0d1aed_amadey_cobalt-strike_hellokitty_hijackloader_icedid_luca.exe
Resource
win11-20260513-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-23_50b65241f32d43dc5e306eb86a0d1aed_amadey_cobalt-strike_hellokitty_hijackloader_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc
- Size 7.3MB
- SHA256 e16f7582b4909b24f30478a6fee4e21f40cd4199c779fc3a99dabc316ce52c74
- MD5 50b65241f32d43dc5e306eb86a0d1aed
- SHA1 0af6ea620ff6c90e6ca579a384735f9ae9f3caec
- SHA512 109fc64df6504058796475139a02640efbb92c7dc521dd91bd0613bf07e4dc5486649cb9deaa12e0b8063ac218390175c9a77575cc3ef9d1d7d1e94bbb16c932
- SSDEEP 98304:ciGV4qqiyavV6MsWHqBmKjKWQckVgtev5mnlNL3:cii4biyavI75rKWQc0gEYnvL3
- TLSH T11076D01AB7A401E8C0E7D9B8CA175D13EAB2781513369BEB17E089555F23AF05F3E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Checks whether UAC is enabled