2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat

General

Target
2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat
Size 1.5MB
Sample260730-vrabtswxev
SHA256 98fe2ee47e24d87b168f0a6eab3256b02bd4daa381e01a38f133d5cc72088474
MD5 a7f967f27870fee9b9f291d31f393236
SHA1 f398545922dd05d90b2d6c8d157876c75a2cd714
SHA512 aa99e1de603f141fda51e17b9c46fbaa2eeac33ac7cd1a353c9d339615105877135a58fa74eeaefb2313e9d4280e7d0afc93da15d58d2dfecaf6527cfe12b9ce
SSDEEP 12288:qZmdbex678tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:quex686mctvE/BT76+1NCE
TLSH
T11375120174C280B2DAB71A710560E3B1DA7CFEB01DA51DD773550A7F9F302D29A2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat

File Explorer

2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat

.exe 1.5MB

2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat

IMPHASH e3e9f38319c353ff0336c249f87bdef4
SHA256 98fe2ee47e24d87b168f0a6eab3256b02bd4daa381e01a38f133d5cc72088474
MD5 a7f967f27870fee9b9f291d31f393236
SHA1 f398545922dd05d90b2d6c8d157876c75a2cd714
SHA512 aa99e1de603f141fda51e17b9c46fbaa2eeac33ac7cd1a353c9d339615105877135a58fa74eeaefb2313e9d4280e7d0afc93da15d58d2dfecaf6527cfe12b9ce
SSDEEP 12288:qZmdbex678tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:quex686mctvE/BT76+1NCE
TLSH
T11375120174C280B2DAB71A710560E3B1DA7CFEB01DA51DD773550A7F9F302D29A2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6824

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Builds\.tmp\obs\liv-558\build32\plugins\win-capture\get-graphics-offsets\RelWithDebInfo\get-graphics-offsets32.pdb

kernel32

SetErrorMode GetModuleHandleA VerSetConditionMask GetProcAddress LoadLibraryA VerifyVersionInfoW WriteConsoleW CreateFileW CloseHandle HeapReAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize DecodePointer

user32

RegisterClassA DefWindowProcA CreateWindowExA DestroyWindow

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat

kernel32

user32

generic