2026-08-04_3688c5d0f6da1bfc6be9af224ef6dbb6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_lynx_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_3688c5d0f6da1bfc6be9af224ef6dbb6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_lynx_njrat_remcos
Size 800KB
Sample260804-25hnpasfng
SHA256 66937efe4f46d18cf6134364ead4b7d0c2e706a5ab3275401b4c30be86373e10
MD5 3688c5d0f6da1bfc6be9af224ef6dbb6
SHA1 330250754d42c7122d94a054a66ef92c9303e085
SHA512 2fd71962f37b53fae1a9f57ab277a0400cb9c575da9132bbaad8d6a314b0593a8b1ce48c1b6df7b31d53e6b43ded640c4839985dafcf2721467f3bebc952e181
SSDEEP 24576:usbOGusTWMxj0XRfJ4yL/tNCJPXUQrPs:usbOGlTR0XRfJ4klKXn0
TLSH
T14305021630C0C4F2C82245B00DE6F7319A2FBD6F0F259EDB6F872A655EB82A1563525F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_3688c5d0f6da1bfc6be9af224ef6dbb6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_lynx_njrat_remcos

File Explorer

2026-08-04_3688c5d0f6da1bfc6be9af224ef6dbb6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_lynx_njrat_remcos

.exe 800KB

2026-08-04_3688c5d0f6da1bfc6be9af224ef6dbb6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_lynx_njrat_remcos

IMPHASH ca7f6ccd09ca8beb86a1a3192aa66446
SHA256 66937efe4f46d18cf6134364ead4b7d0c2e706a5ab3275401b4c30be86373e10
MD5 3688c5d0f6da1bfc6be9af224ef6dbb6
SHA1 330250754d42c7122d94a054a66ef92c9303e085
SHA512 2fd71962f37b53fae1a9f57ab277a0400cb9c575da9132bbaad8d6a314b0593a8b1ce48c1b6df7b31d53e6b43ded640c4839985dafcf2721467f3bebc952e181
SSDEEP 24576:usbOGusTWMxj0XRfJ4yL/tNCJPXUQrPs:usbOGlTR0XRfJ4klKXn0
TLSH
T14305021630C0C4F2C82245B00DE6F7319A2FBD6F0F259EDB6F872A655EB82A1563525F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

34033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\jaimeli\wechatCoding\Tools\WeChatExt\Release\WeChatExt.pdb

kernel32

CloseHandle GetLocalTime DeleteCriticalSection FlushFileBuffers MultiByteToWideChar WideCharToMultiByte CreateDirectoryW GetCurrentProcess GetLastError GetModuleFileNameW GetTimeZoneInformation DeleteFileW CreateMutexW ReleaseMutex OpenMutexW WriteConsoleW HeapSize SetStdHandle GetCurrentThreadId CreateFileW FindClose SetFilePointer InitializeCriticalSection LeaveCriticalSection OutputDebugStringA WriteFile FindNextFileW EnterCriticalSection GetShortPathNameW FindFirstFileW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW HeapReAlloc SetFilePointerEx GetConsoleMode GetConsoleOutputCP LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetFileType HeapAlloc HeapFree InitializeCriticalSectionEx EncodePointer DecodePointer GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle

shell32

SHGetPathFromIDListW SHGetSpecialFolderLocation

ole32

CoUninitialize CoInitializeEx CoCreateInstance

oleaut32

SysAllocString VariantInit SysStringLen VariantClear SysFreeString

shlwapi

PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_3688c5d0f6da1bfc6be9af224ef6dbb6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_lynx_njrat_remcos

kernel32

shell32

ole32

oleaut32

shlwapi

generic