2026-07-22_368ea1e451bf81a8ceba495a93802f4a_amadey_elex_hellokitty_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_368ea1e451bf81a8ceba495a93802f4a_amadey_elex_hellokitty_luca-stealer_njrat
Size 1.3MB
Sample260723-cchqjsfb53
SHA256 ba85f145dea204292344efe487e0a02dd7692cadac19b13c1e30bc0e95a7ca04
MD5 368ea1e451bf81a8ceba495a93802f4a
SHA1 bd6d33ed4f30ea3941a0c27387af5f0f48331de9
SHA512 7d3262327bfaa32b2615f0b5a79b57146c2bf10c009e905c30040848c8ea6d17aa55eadef29c247456cbe0d68784d311924673e9da18ae96f9e644c4c5eeeb4d
SSDEEP 12288:G0u7c6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2A6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A55122571C4C0B2E972093445B4EAA59C3FFD704F205DDBA39929BE9E705D08A39E3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_368ea1e451bf81a8ceba495a93802f4a_amadey_elex_hellokitty_luca-stealer_njrat

File Explorer

2026-07-22_368ea1e451bf81a8ceba495a93802f4a_amadey_elex_hellokitty_luca-stealer_njrat

.exe 1.3MB

2026-07-22_368ea1e451bf81a8ceba495a93802f4a_amadey_elex_hellokitty_luca-stealer_njrat

IMPHASH da25ce0361884e3f489a2a04f7d3a139
SHA256 ba85f145dea204292344efe487e0a02dd7692cadac19b13c1e30bc0e95a7ca04
MD5 368ea1e451bf81a8ceba495a93802f4a
SHA1 bd6d33ed4f30ea3941a0c27387af5f0f48331de9
SHA512 7d3262327bfaa32b2615f0b5a79b57146c2bf10c009e905c30040848c8ea6d17aa55eadef29c247456cbe0d68784d311924673e9da18ae96f9e644c4c5eeeb4d
SSDEEP 12288:G0u7c6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2A6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A55122571C4C0B2E972093445B4EAA59C3FFD704F205DDBA39929BE9E705D08A39E3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10896

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\home\jenkins\agent\workspace\sfip\BAAS\code\services\AMTSW\Release\MEWMIProv\WMIRegistrationService\Release\WMIRegistrationService.pdb

advapi32

RegisterEventSourceW ReportEventW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW DeregisterEventSource

kernel32

WaitForSingleObject CreateEventW GetExitCodeProcess QueueUserWorkItem GetModuleFileNameW SetEvent RegisterWaitForSingleObject UnregisterWait CreateFileW DecodePointer GetLastError CloseHandle OutputDebugStringW GetConsoleMode SetDefaultDllDirectories GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RaiseException RtlUnwind SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW CompareStringW LCMapStringW GetProcessHeap WriteConsoleW

shell32

SHGetKnownFolderPath ShellExecuteExW

ole32

CoTaskMemFree

shlwapi

PathFileExistsW

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_368ea1e451bf81a8ceba495a93802f4a_amadey_elex_hellokitty_luca-stealer_njrat

advapi32

kernel32

shell32

ole32

shlwapi

api-ms-win-core-path-l1-1-0

generic