2026-07-20_9a054ce7ced333df2006e45b1546d14e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_smoke-loader

General

Target
2026-07-20_9a054ce7ced333df2006e45b1546d14e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_smoke-loader
Size 410KB
Sample260720-dascmsc13m
SHA256 d77afaf17ec97eb1b5c6707386eeb17fa58399c94b529c90be1c82d9070ef841
MD5 9a054ce7ced333df2006e45b1546d14e
SHA1 3d8dce62befff813c2c54f3eb1438e0237388af5
SHA512 14a24810dd2c730619aa9001bbac391da07af18d45c2590915d49d44bc300f72a8f76f980d680a79d5b3ae5ecb804bfa0bed1698fbe6d265e88c7a12eaac5afd
SSDEEP 12288:k8LjBTqKObM/lj1FBghDXZEUArUAFQl7P7q7:kw8KH/B1FBgDXZUZt
TLSH
T190945BC87584C272E525263C19E0ACE08BA8B4D457B13ECFFAD438541A76BC1BC3A779
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_9a054ce7ced333df2006e45b1546d14e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_smoke-loader

File Explorer

2026-07-20_9a054ce7ced333df2006e45b1546d14e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_smoke-loader

.exe 410KB

2026-07-20_9a054ce7ced333df2006e45b1546d14e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_smoke-loader

SHA256 d77afaf17ec97eb1b5c6707386eeb17fa58399c94b529c90be1c82d9070ef841
MD5 9a054ce7ced333df2006e45b1546d14e
SHA1 3d8dce62befff813c2c54f3eb1438e0237388af5
SHA512 14a24810dd2c730619aa9001bbac391da07af18d45c2590915d49d44bc300f72a8f76f980d680a79d5b3ae5ecb804bfa0bed1698fbe6d265e88c7a12eaac5afd
SSDEEP 12288:k8LjBTqKObM/lj1FBghDXZEUArUAFQl7P7q7:kw8KH/B1FBgDXZUZt
TLSH
T190945BC87584C272E525263C19E0ACE08BA8B4D457B13ECFFAD438541A76BC1BC3A779
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

199967

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

243KB

Virtual Size

243KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3B

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA

Name

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE

Name

�� !�L

Size

1830.5MB

Virtual Size

1669.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE

Name

DOS mode

Size

Virtual Size

160.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_9a054ce7ced333df2006e45b1546d14e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_smoke-loader

generic