2026-05-27_3f946179f6c06d4e85a1e8490b62fe89_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-27_3f946179f6c06d4e85a1e8490b62fe89_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat
Size 688KB
Sample260527-sd87wsaz8v
SHA256 fccb1d0b74e8e6c9df9a72ac7a245843ecadb7dc3bb418643f98468e196c8587
MD5 3f946179f6c06d4e85a1e8490b62fe89
SHA1 9e3662cee0bc992ebf2768ea84b5a401d14b7349
SHA512 163b0441584d5f02a046100f9b9db619931784de023f8e3391c657c2628ee097baaeac167c84c2b585d8e37d09a841d2f3af7c83cc63f3c4049719f8e2036f20
SSDEEP 12288:mvV7u/5iVpw1t8XyR/g28OXy/xghofRto8ZLlNnhIN0:Oa/awvUAI28R/xtno8Z7nKi
TLSH
T1DFE4120076C4C873D9B2543188B496658B2EFDB44B20AE9F73D869371F34AD1A932B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-27_3f946179f6c06d4e85a1e8490b62fe89_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

File Explorer

2026-05-27_3f946179f6c06d4e85a1e8490b62fe89_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

.exe 688KB

2026-05-27_3f946179f6c06d4e85a1e8490b62fe89_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

IMPHASH a47085e8acf72a5536a475c07003df65
SHA256 fccb1d0b74e8e6c9df9a72ac7a245843ecadb7dc3bb418643f98468e196c8587
MD5 3f946179f6c06d4e85a1e8490b62fe89
SHA1 9e3662cee0bc992ebf2768ea84b5a401d14b7349
SHA512 163b0441584d5f02a046100f9b9db619931784de023f8e3391c657c2628ee097baaeac167c84c2b585d8e37d09a841d2f3af7c83cc63f3c4049719f8e2036f20
SSDEEP 12288:mvV7u/5iVpw1t8XyR/g28OXy/xghofRto8ZLlNnhIN0:Oa/awvUAI28R/xtno8Z7nKi
TLSH
T1DFE4120076C4C873D9B2543188B496658B2EFDB44B20AE9F73D869371F34AD1A932B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10896

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Intel\Developer\8819\p4\989747040\services\AMTSW\Release\MEWMIProv\WMIRegistrationService\Release\WMIRegistrationService.pdb

shlwapi

PathFileExistsW

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec

kernel32

SetEvent WaitForSingleObject CreateEventW GetExitCodeProcess QueueUserWorkItem GetModuleFileNameW SetDefaultDllDirectories GetLastError UnregisterWait GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize CloseHandle OutputDebugStringW DecodePointer CreateFileW RegisterWaitForSingleObject TlsAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RaiseException RtlUnwind SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount WriteConsoleW TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW CompareStringW LCMapStringW GetProcessHeap SetFilePointerEx

shell32

SHGetKnownFolderPath ShellExecuteExW

ole32

CoTaskMemFree

advapi32

SetServiceStatus RegisterServiceCtrlHandlerExW ReportEventW RegisterEventSourceW DeregisterEventSource StartServiceCtrlDispatcherW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-27_3f946179f6c06d4e85a1e8490b62fe89_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

shlwapi

api-ms-win-core-path-l1-1-0

kernel32

shell32

ole32

advapi32

generic