2026-05-29_40cc7db830e268bcdaf7751c33db4ef7_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-29_40cc7db830e268bcdaf7751c33db4ef7_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop_vidar_wannacry
Size 881KB
Sample260529-vbvmtsbz8j
SHA256 29126ead0b7ac84ef26d4e0312aa011bbbe86414ba228a9a2d24eb896108047c
MD5 40cc7db830e268bcdaf7751c33db4ef7
SHA1 943bb3f9b5e0d7732053269324439c1ca357f74f
SHA512 a0bd817b4df3fc825a47752970c7e163dd06ae7f200c59236ff8909a308d1b7b3203e346d553cd37c2e41f6f2f844ed6f092636ccace6ed23162a342295e732e
SSDEEP 12288:3jHwMgsHyMqLHFZlx22CGD3JeU7vinrmlNU+aKghLh:3jQMFHDUT22CGD5TvinrmlCVKgJh
TLSH
T1E6155B4172D48FB2D6AF11308C5AC776A637BD624F214BEB23947F6A7E312C06925633
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-29_40cc7db830e268bcdaf7751c33db4ef7_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop_vidar_wannacry

File Explorer

2026-05-29_40cc7db830e268bcdaf7751c33db4ef7_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop_vidar_wannacry

.exe 881KB

2026-05-29_40cc7db830e268bcdaf7751c33db4ef7_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop_vidar_wannacry

IMPHASH 7c7594c33e26c22c9e3e6d0e07fabaf5
SHA256 29126ead0b7ac84ef26d4e0312aa011bbbe86414ba228a9a2d24eb896108047c
MD5 40cc7db830e268bcdaf7751c33db4ef7
SHA1 943bb3f9b5e0d7732053269324439c1ca357f74f
SHA512 a0bd817b4df3fc825a47752970c7e163dd06ae7f200c59236ff8909a308d1b7b3203e346d553cd37c2e41f6f2f844ed6f092636ccace6ed23162a342295e732e
SSDEEP 12288:3jHwMgsHyMqLHFZlx22CGD3JeU7vinrmlNU+aKghLh:3jQMFHDUT22CGD5TvinrmlCVKgJh
TLSH
T1E6155B4172D48FB2D6AF11308C5AC776A637BD624F214BEB23947F6A7E312C06925633
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

54832

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\B\T\BuildResults\bin\Release\Eula.pdb

kernel32

FindResourceW LoadLibraryA GlobalAlloc GlobalUnlock GlobalLock GlobalHandle GlobalFree MulDiv lstrcmpW lstrcpynW lstrcpyW lstrcatW lstrlenW GetPrivateProfileIntW GetPrivateProfileStringW CopyFileW MultiByteToWideChar DecodePointer VirtualFree VirtualAlloc FlushInstructionCache LoadResource InterlockedPopEntrySList GetProcessHeap HeapFree HeapAlloc EncodePointer OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent SetEvent GetCurrentThreadId CloseHandle LeaveCriticalSection EnterCriticalSection GetFullPathNameW FindFirstFileW FindClose LoadLibraryW GetProcAddress GetModuleHandleW LockResource GetModuleHandleA GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount SetLastError GetLastError RaiseException OutputDebugStringA GetCurrentProcess InterlockedPushEntrySList LoadLibraryExA

user32

SetWindowContextHelpId GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW RedrawWindow InvalidateRgn InvalidateRect EndPaint BeginPaint ReleaseDC GetDC GetSystemMetrics DestroyAcceleratorTable CreateAcceleratorTableW ClientToScreen EnableWindow ReleaseCapture SetCapture UnregisterClassW RegisterWindowMessageW SendMessageW DefWindowProcW CallWindowProcW RegisterClassExW GetClassInfoExW CreateWindowExW IsWindow IsChild DestroyWindow MoveWindow SetWindowPos DialogBoxIndirectParamW ScreenToClient MapDialogRect LoadCursorW GetWindow GetClassNameW GetParent GetDesktopWindow SetWindowLongW GetWindowLongW FillRect IsWindowEnabled EndDialog GetDlgItem SetDlgItemTextW GetDlgItemTextW SendDlgItemMessageW CharNextW SetFocus GetActiveWindow GetFocus GetSysColor

gdi32

SelectObject GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateSolidBrush CreateCompatibleDC CreateCompatibleBitmap GetObjectW BitBlt

advapi32

RegSetValueExW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey

ole32

OleUninitialize OleLockRunning CoTaskMemFree CoTaskMemAlloc StringFromGUID2 CLSIDFromProgID CLSIDFromString CoCreateInstance CoReleaseServerProcess CoAddRefServerProcess CoGetClassObject CreateStreamOnHGlobal OleInitialize

oleaut32

DispCallFunc LoadRegTypeLi LoadTypeLi OleCreateFontIndirect VariantInit SysStringLen SysAllocStringLen SysAllocString VariantClear SysFreeString

vcruntime140

_CxxThrowException __current_exception __std_exception_copy _except_handler4_common __current_exception_context memcpy memcmp __CxxFrameHandler3 memset __std_exception_destroy __std_terminate

api-ms-win-crt-heap-l1-1-0

_recalloc free _set_new_mode calloc malloc _callnewh

api-ms-win-crt-runtime-l1-1-0

_set_app_type _seh_filter_exe _crt_atexit _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _invalid_parameter_noinfo _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_onexit_table _controlfp_s terminate _errno _cexit

api-ms-win-crt-convert-l1-1-0

_wtoi _wtoi64

api-ms-win-crt-string-l1-1-0

wcslen wcscspn wcsncpy_s wcscpy_s strlen

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s __p__commode _set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-29_40cc7db830e268bcdaf7751c33db4ef7_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop_vidar_wannacry

kernel32

user32

gdi32

advapi32

ole32

oleaut32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic