f9081d4df2757b7edc6dd8f4a8a08d42b6706f28da292c4c50c0e3a95bb6b93b | Triage™

Login
Reports

Overview

overview

6

Static

static

1

2026-07-19...-s.exe

windows10-2004-x64

6

2026-07-19...-s.exe

windows11-ltsc_2024-x64

6

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-19_4428b2729145e81462075c09f4e93208_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-stealer_manuscrypt_njrat_play
Size 212KB
Sample260719-2tt8caex9j
SHA256 f9081d4df2757b7edc6dd8f4a8a08d42b6706f28da292c4c50c0e3a95bb6b93b
MD5 4428b2729145e81462075c09f4e93208
SHA1 969615d65c90f7ad1525ab58a24ec71010eaa94c
SHA512 ee47bdb7cbb90512d4befab76bdbf8b2dc6cf4c07f4f72321b2e2cf7ff265f13cba9af8d6c46d498554939094275852c6ac00a02024e3f4615dc9751cc0dd3f9
SSDEEP 3072:0A2kZD7HMdVvGedfdtWPfjLAhajrWjKT9Onzel/BvFQa7C4erI/cj:0r83szpd16jXWjZMQaO8kj
TLSH
T16E24B213A6DC7CE2D039173137BB97E0CB2EED6045A1C95F62C402A5DA7C1937622BE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution persistence privilege_escalation

Static task

static1

Behavioral task

behavioral1

Sample

2026-07-19_4428b2729145e81462075c09f4e93208_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

7 signatures

150 seconds

defense_evasion discovery execution persistence privilege_escalation

Behavioral task

behavioral2

Sample

2026-07-19_4428b2729145e81462075c09f4e93208_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe

Resource

win11ltsc2024-20260710-en

windows11-ltsc_2024-x64

6 signatures

150 seconds

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Targets

- Target
  2026-07-19_4428b2729145e81462075c09f4e93208_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-stealer_manuscrypt_njrat_play
- Size 212KB
- SHA256 f9081d4df2757b7edc6dd8f4a8a08d42b6706f28da292c4c50c0e3a95bb6b93b
- MD5 4428b2729145e81462075c09f4e93208
- SHA1 969615d65c90f7ad1525ab58a24ec71010eaa94c
- SHA512 ee47bdb7cbb90512d4befab76bdbf8b2dc6cf4c07f4f72321b2e2cf7ff265f13cba9af8d6c46d498554939094275852c6ac00a02024e3f4615dc9751cc0dd3f9
- SSDEEP 3072:0A2kZD7HMdVvGedfdtWPfjLAhajrWjKT9Onzel/BvFQa7C4erI/cj:0r83szpd16jXWjZMQaO8kj
- TLSH
  T16E24B213A6DC7CE2D039173137BB97E0CB2EED6045A1C95F62C402A5DA7C1937622BE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

behavioral2

defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

© 2018-2026

Terms | Privacy