2026-08-03_2bfc7803e5c1afece3130da0a22d43db_amadey_elex_hellokitty_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_2bfc7803e5c1afece3130da0a22d43db_amadey_elex_hellokitty_luca-stealer_njrat
Size 1.3MB
Sample260804-dmz81sca97
SHA256 6554305ee92aa19f553008081cbf33bcf79e7f20227c5f618e6a9302f9c5457e
MD5 2bfc7803e5c1afece3130da0a22d43db
SHA1 6bc72c27cd43613551c931bf7f76c3b452e4f58e
SHA512 791aff8939ff8c40374456b7695e4ddfa3b3d43d2a6a3b23081ded854920c7d58defb27016d29aff5cc196609c249736525080d4143bf9cca9c00bf47be87b09
SSDEEP 12288:mvV7ue0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:OaXgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1FA55125179C088B2E1A7463044F0CBB19A7DFDB01B108EEF93D46AB74E749D19A34E7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_2bfc7803e5c1afece3130da0a22d43db_amadey_elex_hellokitty_luca-stealer_njrat

File Explorer

2026-08-03_2bfc7803e5c1afece3130da0a22d43db_amadey_elex_hellokitty_luca-stealer_njrat

.exe 1.3MB

2026-08-03_2bfc7803e5c1afece3130da0a22d43db_amadey_elex_hellokitty_luca-stealer_njrat

IMPHASH a47085e8acf72a5536a475c07003df65
SHA256 6554305ee92aa19f553008081cbf33bcf79e7f20227c5f618e6a9302f9c5457e
MD5 2bfc7803e5c1afece3130da0a22d43db
SHA1 6bc72c27cd43613551c931bf7f76c3b452e4f58e
SHA512 791aff8939ff8c40374456b7695e4ddfa3b3d43d2a6a3b23081ded854920c7d58defb27016d29aff5cc196609c249736525080d4143bf9cca9c00bf47be87b09
SSDEEP 12288:mvV7ue0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:OaXgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1FA55125179C088B2E1A7463044F0CBB19A7DFDB01B108EEF93D46AB74E749D19A34E7A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10896

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Intel\Developer\8819\p4\989747040\services\AMTSW\Release\MEWMIProv\WMIRegistrationService\Release\WMIRegistrationService.pdb

shlwapi

PathFileExistsW

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec

kernel32

SetEvent WaitForSingleObject CreateEventW GetExitCodeProcess QueueUserWorkItem GetModuleFileNameW SetDefaultDllDirectories GetLastError UnregisterWait GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize CloseHandle OutputDebugStringW DecodePointer CreateFileW RegisterWaitForSingleObject TlsAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RaiseException RtlUnwind SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount WriteConsoleW TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW CompareStringW LCMapStringW GetProcessHeap SetFilePointerEx

shell32

SHGetKnownFolderPath ShellExecuteExW

ole32

CoTaskMemFree

advapi32

SetServiceStatus RegisterServiceCtrlHandlerExW ReportEventW RegisterEventSourceW DeregisterEventSource StartServiceCtrlDispatcherW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_2bfc7803e5c1afece3130da0a22d43db_amadey_elex_hellokitty_luca-stealer_njrat

shlwapi

api-ms-win-core-path-l1-1-0

kernel32

shell32

ole32

advapi32

generic