2026-07-20_57605f6e5f292eefb02146059b9e1ae4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_57605f6e5f292eefb02146059b9e1ae4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat
Size 865KB
Sample260720-rxprxsft2w
SHA256 97f17d79b0d3aa16c57cf9d0f6ffd7c7a106466361b013c6627d7036f010c0b3
MD5 57605f6e5f292eefb02146059b9e1ae4
SHA1 0f1e19d3f76c504fc19b0c5a86010c11811a92bb
SHA512 a3013f763ec9bbcfe94e9a41daabe85983aa26ea129d67700ef43576d37645a5c3dc37b96f4ffb39d480bd766b59d1b7b6a14780cdaecd48e7442d163ff13dd2
SSDEEP 6144:AOogZjM7oB12to2h2MWla+TQe9UP6b+X1e:JogZ4KS2L0q5UPcU1e
TLSH
T1D515F9B6F9CC88A8DEA00AF9377CCDE0652ABA70CEB044DA534461751D2B6B0C571DDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_57605f6e5f292eefb02146059b9e1ae4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

File Explorer

2026-07-20_57605f6e5f292eefb02146059b9e1ae4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

.exe 865KB

2026-07-20_57605f6e5f292eefb02146059b9e1ae4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

IMPHASH 19f72e30429683ac5de8d6a39ee8095b
SHA256 97f17d79b0d3aa16c57cf9d0f6ffd7c7a106466361b013c6627d7036f010c0b3
MD5 57605f6e5f292eefb02146059b9e1ae4
SHA1 0f1e19d3f76c504fc19b0c5a86010c11811a92bb
SHA512 a3013f763ec9bbcfe94e9a41daabe85983aa26ea129d67700ef43576d37645a5c3dc37b96f4ffb39d480bd766b59d1b7b6a14780cdaecd48e7442d163ff13dd2
SSDEEP 6144:AOogZjM7oB12to2h2MWla+TQe9UP6b+X1e:JogZ4KS2L0q5UPcU1e
TLSH
T1D515F9B6F9CC88A8DEA00AF9377CCDE0652ABA70CEB044DA534461751D2B6B0C571DDB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11431

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\workspace\memu-service\Release\MemuService.pdb

kernel32

CloseHandle GetLogicalDriveStringsA SetConsoleCtrlHandler CreateMutexW WaitForSingleObject GetLastError SetEvent CreateEventA GetCurrentThreadId ProcessIdToSessionId Sleep LoadLibraryA DeleteFileA WritePrivateProfileStringA Process32Next GetProcAddress WTSGetActiveConsoleSessionId FreeLibrary WinExec CreateFileW DecodePointer HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx CreateToolhelp32Snapshot OpenProcess QueryDosDeviceA K32GetProcessImageFileNameA SetLastError Process32First GetModuleHandleA CreateThread GetModuleFileNameA GetFileSizeEx GetStringTypeW SetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap WriteConsoleW

user32

GetProcessWindowStation SetProcessWindowStation OpenDesktopA CloseWindowStation SetThreadDesktop GetThreadDesktop CloseDesktop OpenWindowStationA

advapi32

CreateProcessAsUserA SetTokenInformation LookupPrivilegeValueA DuplicateTokenEx OpenProcessToken AdjustTokenPrivileges

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock

Name

.text

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

179KB

Virtual Size

179KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_57605f6e5f292eefb02146059b9e1ae4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

kernel32

user32

advapi32

wtsapi32

userenv

generic