2026-07-28_b6b3ac70450acbd58db7f284482c5ffd_amadey_elex_hellokitty_luca-stealer_metamorfo_njrat_play

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_b6b3ac70450acbd58db7f284482c5ffd_amadey_elex_hellokitty_luca-stealer_metamorfo_njrat_play
Size 1.4MB
Sample260729-avarjsdl2w
SHA256 2036db94182cbad7fe7bfe70d3fae47af998b133604b14db0596aecefe246b3d
MD5 b6b3ac70450acbd58db7f284482c5ffd
SHA1 3144d854bd9f7e7e2acf77090e060a7bc55afc64
SHA512 9325ea58306692bdd9ace30ed14f1e759a74741c7f351c50fcd9019eca76d6dfca3dc2e9e6bc74a7ff97b296f6d4e40b6854732f9bb489ed8e6927ee5e51144d
SSDEEP 24576:kaBu3A4xsuYgV0lde1tl31OBDTwlYnTekwp:vBNJutV0lM391OBAOn6kO
TLSH
T1F66502E37DC688B1F4B2153034689E30962DFD740A908957F34816279F386A5FEAB772
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-28_b6b3ac70450acbd58db7f284482c5ffd_amadey_elex_hellokitty_luca-stealer_metamorfo_njrat_play

File Explorer

2026-07-28_b6b3ac70450acbd58db7f284482c5ffd_amadey_elex_hellokitty_luca-stealer_metamorfo_njrat_play

.exe 1.4MB

2026-07-28_b6b3ac70450acbd58db7f284482c5ffd_amadey_elex_hellokitty_luca-stealer_metamorfo_njrat_play

IMPHASH 9206b5f200ed40cd6038d5fa52a4388d
SHA256 2036db94182cbad7fe7bfe70d3fae47af998b133604b14db0596aecefe246b3d
MD5 b6b3ac70450acbd58db7f284482c5ffd
SHA1 3144d854bd9f7e7e2acf77090e060a7bc55afc64
SHA512 9325ea58306692bdd9ace30ed14f1e759a74741c7f351c50fcd9019eca76d6dfca3dc2e9e6bc74a7ff97b296f6d4e40b6854732f9bb489ed8e6927ee5e51144d
SSDEEP 24576:kaBu3A4xsuYgV0lde1tl31OBDTwlYnTekwp:vBNJutV0lM391OBAOn6kO
TLSH
T1F66502E37DC688B1F4B2153034689E30962DFD740A908957F34816279F386A5FEAB772
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13290

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\cmder\cmder\launcher\Release\Cmder.pdb

kernel32

GetNativeSystemInfo LocalFree CreateProcessW GetModuleHandleW CopyFileW DecodePointer CloseHandle GetConsoleMode GetLastError FormatMessageW CreateFileW GetEnvironmentVariableW SetEnvironmentVariableW GetModuleFileNameW ExpandEnvironmentStringsW GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx GetCommandLineW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile HeapFree HeapAlloc GetFileType MultiByteToWideChar LCMapStringW MoveFileExW WideCharToMultiByte FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW GetProcessHeap WriteConsoleW

user32

LoadStringW MessageBoxW

advapi32

RegSetValueExW RegCloseKey RegDeleteKeyExW RegCreateKeyExW RegDeleteTreeW RegSetValueW

shell32

SHCreateDirectoryExW CommandLineToArgvW

shlwapi

PathRemoveFileSpecW PathFileExistsW PathCombineW

comctl32

ord345

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_b6b3ac70450acbd58db7f284482c5ffd_amadey_elex_hellokitty_luca-stealer_metamorfo_njrat_play

kernel32

user32

advapi32

shell32

shlwapi

comctl32

generic