General
- Target 2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader
- Size 744KB
- Sample260803-c6aa9sbj31
- SHA256 5d01557a4d340b9a0ed6c7bb9c4d2d299280edca1e6b92fbafb249c24492a683
- MD5 573026b6d3e840b91c8aee1a580e27c7
- SHA1 b67eb2a477c9d79dc7ae48f70bbd5b7b40b59a87
- SHA512 b1cac19835504beadbd39e3bd28b4523cf1d16dc033127df558bf5a2548b4cdedc7bfe086e3c5a2aaa252ab65a43fabfd1737d9321453152941d47622602767c
- SSDEEP 12288:P9CG6vHzOASubviBNDYa3iVedmuQ552RRFVOZR4YnEWJCZH9rB+jPSeMddiMmqTC:PoGGTWBZyVeEGRBOZRTnE7/N+x6diMg7
- TLSH T180F41211B2C0C0B3FAB3193446B4EA705A7DFD305F658AAB7785275E4E706D29A38363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_573026b6d3e840b91c8aee1a580e27c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader
- Size 744KB
- SHA256 5d01557a4d340b9a0ed6c7bb9c4d2d299280edca1e6b92fbafb249c24492a683
- MD5 573026b6d3e840b91c8aee1a580e27c7
- SHA1 b67eb2a477c9d79dc7ae48f70bbd5b7b40b59a87
- SHA512 b1cac19835504beadbd39e3bd28b4523cf1d16dc033127df558bf5a2548b4cdedc7bfe086e3c5a2aaa252ab65a43fabfd1737d9321453152941d47622602767c
- SSDEEP 12288:P9CG6vHzOASubviBNDYa3iVedmuQ552RRFVOZR4YnEWJCZH9rB+jPSeMddiMmqTC:PoGGTWBZyVeEGRBOZRTnE7/N+x6diMg7
- TLSH T180F41211B2C0C0B3FAB3193446B4EA705A7DFD305F658AAB7785275E4E706D29A38363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1