2026-05-28_e397d30eba359bad2914fe0ee960f75d_amadey_elex_hellokitty_luca-stealer_njrat

General

Target
2026-05-28_e397d30eba359bad2914fe0ee960f75d_amadey_elex_hellokitty_luca-stealer_njrat
Size 1.5MB
Sample260528-e98dksfv3k
SHA256 cba545fd80872913bbdcc4db4d05507e2b3bb6f6d45359ea2d0f0e0e723013f4
MD5 e397d30eba359bad2914fe0ee960f75d
SHA1 497cb7f457784d7a22d1de5d4edb78598c46c2d6
SHA512 394877117f2bef7edfa5f64b76f75c59ea7cece94e78e6631e40db4428cee2ef44061f9909a57d55c9c4258528ce470705e64ae1901356bdbb405c98ea619d81
SSDEEP 12288:w8D4/M+hcg+GXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:w8DcMIn3nQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1D675122076C4D466E5731D391874C7A5AA7EECB00F69D7DB77883B7D8F382C06A90A42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-28_e397d30eba359bad2914fe0ee960f75d_amadey_elex_hellokitty_luca-stealer_njrat

File Explorer

2026-05-28_e397d30eba359bad2914fe0ee960f75d_amadey_elex_hellokitty_luca-stealer_njrat

.exe 1.5MB

2026-05-28_e397d30eba359bad2914fe0ee960f75d_amadey_elex_hellokitty_luca-stealer_njrat

IMPHASH 125985a02fd94a34532e62f509a5d6ef
SHA256 cba545fd80872913bbdcc4db4d05507e2b3bb6f6d45359ea2d0f0e0e723013f4
MD5 e397d30eba359bad2914fe0ee960f75d
SHA1 497cb7f457784d7a22d1de5d4edb78598c46c2d6
SHA512 394877117f2bef7edfa5f64b76f75c59ea7cece94e78e6631e40db4428cee2ef44061f9909a57d55c9c4258528ce470705e64ae1901356bdbb405c98ea619d81
SSDEEP 12288:w8D4/M+hcg+GXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:w8DcMIn3nQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1D675122076C4D466E5731D391874C7A5AA7EECB00F69D7DB77883B7D8F382C06A90A42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

20843

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\JenkinsWorkspace\workspace\client_build_installer\client\build\working_directory\RelWithDebInfo\UpcElevationService.pdb

kernel32

DebugBreak CloseHandle GetLastError SetLastError HeapAlloc HeapSize GetProcessHeap HeapReAlloc TerminateProcess GetCurrentThreadId GetModuleFileNameA GetModuleFileNameW GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW WideCharToMultiByte ExitProcess GetConsoleMode IsDebuggerPresent GetCurrentProcess DecodePointer HeapFree CreateFileW FindClose FindFirstFileExW FindNextFileW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency Sleep WriteConsoleW GetSystemTimeAsFileTime IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId InitializeSListHead RaiseException RtlUnwind EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetCPInfo GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetFileType CompareStringW LCMapStringW GetStringTypeW SetFilePointerEx IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP

advapi32

SetServiceStatus RegisterServiceCtrlHandlerExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken StartServiceCtrlDispatcherW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-28_e397d30eba359bad2914fe0ee960f75d_amadey_elex_hellokitty_luca-stealer_njrat

kernel32

advapi32

generic