2026-08-04_b5065271ca911766494b71688bfd2272_amadey_elex_hellokitty_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_b5065271ca911766494b71688bfd2272_amadey_elex_hellokitty_remcos
Size 21.3MB
Sample260804-2ca35szsb1
SHA256 179577efc14d0b1ec0b0ee44208d336bb00b3d3d9d00cdd965de1213cb0b3f62
MD5 b5065271ca911766494b71688bfd2272
SHA1 92087134703b386a8582eb17e9e58523105be639
SHA512 c3d0a3dec308c2ff4c3ddff162e99f707cc5414181d9a815a9c707f7b8c39bab58d432d93034ba6594ff9277a7c11cacd343d7f92f2b2733ea060e01126b8ebc
SSDEEP 393216:H0mACMUtwQARxIwcv8Bce0BARmOsrTua9eBEqA8Qied2Gp2yFB2N2:H0mStRC94SS8p8l5Qiegq2y1
TLSH
T17F273345BC2D9CF3C2F9443AC7EB0A600375FC832A8286539B5BF49D6921597E836DB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-04_b5065271ca911766494b71688bfd2272_amadey_elex_hellokitty_remcos

File Explorer

2026-08-04_b5065271ca911766494b71688bfd2272_amadey_elex_hellokitty_remcos

.exe 21.3MB

2026-08-04_b5065271ca911766494b71688bfd2272_amadey_elex_hellokitty_remcos

IMPHASH 9da7641a251ed4e6f1102b982119761f
SHA256 179577efc14d0b1ec0b0ee44208d336bb00b3d3d9d00cdd965de1213cb0b3f62
MD5 b5065271ca911766494b71688bfd2272
SHA1 92087134703b386a8582eb17e9e58523105be639
SHA512 c3d0a3dec308c2ff4c3ddff162e99f707cc5414181d9a815a9c707f7b8c39bab58d432d93034ba6594ff9277a7c11cacd343d7f92f2b2733ea060e01126b8ebc
SSDEEP 393216:H0mACMUtwQARxIwcv8Bce0BARmOsrTua9eBEqA8Qied2Gp2yFB2N2:H0mStRC94SS8p8l5Qiegq2y1
TLSH
T17F273345BC2D9CF3C2F9443AC7EB0A600375FC832A8286539B5BF49D6921597E836DB1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

bf:69:df:c8:3a:e3:c7:a4:12:fe:0b:67:9e:f5:3e:a4:31:3d:f4:48:50:33:38:eb:a1:f1:27:a1:21:6f:4b:76

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=HHD SOFTWARE LIMITED,O=HHD SOFTWARE LIMITED,L=London,ST=London,C=GB,1.2.840.113549.1.9.1=#0c17636f6e7461637440686864736f6674776172652e636f6d

Chains

Sep 6, 2023

CN=HHD SOFTWARE LIMITED,O=HHD SOFTWARE LIMITED,L=London,ST=London,C=GB,1.2.840.113549.1.9.1=#0c17636f6e7461637440686864736f6674776172652e636f6d

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=HHD SOFTWARE LIMITED,O=HHD SOFTWARE LIMITED,L=London,ST=London,C=GB,1.2.840.113549.1.9.1=#0c17636f6e7461637440686864736f6674776172652e636f6d

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=HHD SOFTWARE LIMITED,O=HHD SOFTWARE LIMITED,L=London,ST=London,C=GB,1.2.840.113549.1.9.1=#0c17636f6e7461637440686864736f6674776172652e636f6d

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=HHD SOFTWARE LIMITED,O=HHD SOFTWARE LIMITED,L=London,ST=London,C=GB,1.2.840.113549.1.9.1=#0c17636f6e7461637440686864736f6674776172652e636f6d

Serial Number

04:f3:0e:3d:a6:cd:84:cd:8f:88:f6:c8

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 27, 2023 - Jun 23, 2026

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

32224

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\MyProjects\Elizabeth3\out\SfxSetup.pdb

user32

MessageBoxA

shell32

ShellExecuteW

kernel32

EnterCriticalSection WriteConsoleW SetFilePointerEx GetConsoleMode GetLastError CreateFileW CloseHandle ReadFile WriteFile SetFilePointer IsProcessorFeaturePresent GetProcAddress GetModuleHandleW LoadLibraryExW FindFirstFileW FindClose SetFileAttributesW DeleteFileW FindNextFileW RemoveDirectoryW GetModuleFileNameW GetCommandLineW GetTempPathW GetTickCount GetCurrentThreadId GetCurrentProcessId CreateDirectoryW IsWow64Process GetCurrentProcess SetFileTime GetCurrentDirectoryW SetCurrentDirectoryW GetVersionExW SetEnvironmentVariableW CreateProcessW WaitForSingleObject GetExitCodeProcess QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW TerminateProcess GetConsoleCP RtlUnwind SetLastError DecodePointer LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary RaiseException GetStdHandle GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP HeapAlloc HeapFree FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA LCMapStringW SetStdHandle GetFileType GetStringTypeW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_b5065271ca911766494b71688bfd2272_amadey_elex_hellokitty_remcos

PE Signature issue

user32

shell32

kernel32

generic