General
- Target 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader
- Size 749KB
- Sample260702-ne4xcagy6v
- SHA256 5f7af5cb29119b4f7a10870b0d515d063685389352375bb1f6de4b158ea3a536
- MD5 8d1775f7859bfbd8f25132a2207aca17
- SHA1 853463c571f2278c1be140f1cc78b046e781136d
- SHA512 6b0431ab2021072b300a46c82efb7f3fe250cd12c9cda8a335c5b6905f4e80f2eb3f7da67aa938237e2654d423e9ad8726fc6e22611e2b43b7271a8707857986
- SSDEEP 12288:393G6vH9/AHubviBNDYa3uKNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9X:3VGGdWBZ+KlnOHKVnrsaGBgW59tET9sw
- TLSH T165F4021132C080B6EDB3153459718AB1957DFE301F62499F73D8272A6DB47C28E3A76B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win11ltsc2024-20260629-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader
- Size 749KB
- SHA256 5f7af5cb29119b4f7a10870b0d515d063685389352375bb1f6de4b158ea3a536
- MD5 8d1775f7859bfbd8f25132a2207aca17
- SHA1 853463c571f2278c1be140f1cc78b046e781136d
- SHA512 6b0431ab2021072b300a46c82efb7f3fe250cd12c9cda8a335c5b6905f4e80f2eb3f7da67aa938237e2654d423e9ad8726fc6e22611e2b43b7271a8707857986
- SSDEEP 12288:393G6vH9/AHubviBNDYa3uKNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9X:3VGGdWBZ+KlnOHKVnrsaGBgW59tET9sw
- TLSH T165F4021132C080B6EDB3153459718AB1957DFE301F62499F73D8272A6DB47C28E3A76B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1