General
- Target 2026-08-04_43eb06af848d2586d34ecf6bf35b012e_amadey_cobalt-strike_hellokitty_hijackloader_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc
- Size 7.5MB
- Sample260804-jcpmesyzf1
- SHA256 ae33c3d10d71396fec28a462848119431338ac04d6a42f85c1c6688c7a0a9ebd
- MD5 43eb06af848d2586d34ecf6bf35b012e
- SHA1 c6b8397c64a3ce05ec106fc71169f5e34e3e4500
- SHA512 3d4bd633a2b6640bc2ae54b4c2596100060611577a1990ece5cea9e3edec095ce48310015b9484ab021f0e393ce4d6e71e7b9c3e0cf60dea89c57bf503e07031
- SSDEEP 98304:SSoKVCrmaCPkNBCvanOulxFFeKfGKjKWQckVgtev5mnlNL3:SSrkrw8rcNCFVfLKWQc0gEYnvL3
- TLSH T17C86D01AB3B401FCC0B7D5B889175A23EA72785503729ADB57E08A552F27AF09F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-04_43eb06af848d2586d34ecf6bf35b012e_amadey_cobalt-strike_hellokitty_hijackloader_icedid_luca.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_43eb06af848d2586d34ecf6bf35b012e_amadey_cobalt-strike_hellokitty_hijackloader_icedid_luca.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-04_43eb06af848d2586d34ecf6bf35b012e_amadey_cobalt-strike_hellokitty_hijackloader_icedid_luca-stealer_njrat_satacom_smoke-loader_stealc
- Size 7.5MB
- SHA256 ae33c3d10d71396fec28a462848119431338ac04d6a42f85c1c6688c7a0a9ebd
- MD5 43eb06af848d2586d34ecf6bf35b012e
- SHA1 c6b8397c64a3ce05ec106fc71169f5e34e3e4500
- SHA512 3d4bd633a2b6640bc2ae54b4c2596100060611577a1990ece5cea9e3edec095ce48310015b9484ab021f0e393ce4d6e71e7b9c3e0cf60dea89c57bf503e07031
- SSDEEP 98304:SSoKVCrmaCPkNBCvanOulxFFeKfGKjKWQckVgtev5mnlNL3:SSrkrw8rcNCFVfLKWQc0gEYnvL3
- TLSH T17C86D01AB3B401FCC0B7D5B889175A23EA72785503729ADB57E08A552F27AF09F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks whether UAC is enabled