2026-07-20_75be7bc9229ac53e239c9cbbaa683f9a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

General

Target
2026-07-20_75be7bc9229ac53e239c9cbbaa683f9a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat
Size 134KB
Sample260720-dgl47sds9k
SHA256 50b9a32895ecfa5056e2d7f8e198f7113251a48d9c832961cc21a44bc032c228
MD5 75be7bc9229ac53e239c9cbbaa683f9a
SHA1 cb35fd69405a2d8ed002133c5eb983632da455f7
SHA512 1138ed7b1e377a9a07538301b4861bd1cec3add7e9746d21c262c335528ebd2c1501721c49ff8ecd4966e5471e38888d96b1d4debbd85b55c8672c4886895068
SSDEEP 3072:gq5IrPp4AgNnWOrKqxL+Zyz2GspmIPbDspBhqRH19ck0pfOa+bc:gq5IrB4AggispXD4kFLDVb
TLSH
T124D37C00B5C0C072E5B6147516A4D6B18A3CFD300F548EDBB7885EBAAF746E0A639E67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_75be7bc9229ac53e239c9cbbaa683f9a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

File Explorer

2026-07-20_75be7bc9229ac53e239c9cbbaa683f9a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

.exe 134KB

2026-07-20_75be7bc9229ac53e239c9cbbaa683f9a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

IMPHASH 3a244253e81bd8eb773044aacf74dd6e
SHA256 50b9a32895ecfa5056e2d7f8e198f7113251a48d9c832961cc21a44bc032c228
MD5 75be7bc9229ac53e239c9cbbaa683f9a
SHA1 cb35fd69405a2d8ed002133c5eb983632da455f7
SHA512 1138ed7b1e377a9a07538301b4861bd1cec3add7e9746d21c262c335528ebd2c1501721c49ff8ecd4966e5471e38888d96b1d4debbd85b55c8672c4886895068
SSDEEP 3072:gq5IrPp4AgNnWOrKqxL+Zyz2GspmIPbDspBhqRH19ck0pfOa+bc:gq5IrB4AggispXD4kFLDVb
TLSH
T124D37C00B5C0C072E5B6147516A4D6B18A3CFD300F548EDBB7885EBAAF746E0A639E67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

20198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW WriteConsoleW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc CloseHandle CreateFileW DecodePointer

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_75be7bc9229ac53e239c9cbbaa683f9a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

kernel32

generic