toneshell | 2026-08-05_5cd4b061af6a81519fa31927d05eab97_amadey_elex_hellokitty_luca-stealer_lynx_manuscrypt_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-05_5cd4b061af6a81519fa31927d05eab97_amadey_elex_hellokitty_luca-stealer_lynx_manuscrypt_njrat
Size 4.1MB
Sample260805-dlmljace66
SHA256 16b4b30d4499dfd183b2c733d5dcce3d26d50c008f5cbb183bbafbbfa9ed324a
MD5 5cd4b061af6a81519fa31927d05eab97
SHA1 50126c4dad436a04c0e328118a084d489de675a9
SHA512 2bbb68f5ff8b93e1e910492831a623284480ede1dbbc22cae080eee56e6b590e3b9a33a38bc7e3bea24f2a7b8bb1f53a388dc5a4ecf4368a2935461f122884b1
SSDEEP 24576:kPqN8uQ+0EAVj21SRMQEMvwQ+AJuplwAi6qAu2j:kSN8uQqAI1/CwQDd
TLSH
T17016FC62A96021DBC21B07710E325CA00A1DD239B77FD89BAB874FF5D5B366304FD85A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor apt mustang_panda earth_preta toneshell

Malware Config

Signatures

Family: TONESHELL
TONESHELL is a Windows backdoor used by Earth Preta aka MUSTANG PANDA APT group.
backdoor toneshell

Detects TONESHELL Backdoor - persistence component 1 IoCs

backdoor apt mustang_panda earth_preta

resource	yara_rule
sample	family_toneshell_v2_persis_component

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-05_5cd4b061af6a81519fa31927d05eab97_amadey_elex_hellokitty_luca-stealer_lynx_manuscrypt_njrat

File Explorer

2026-08-05_5cd4b061af6a81519fa31927d05eab97_amadey_elex_hellokitty_luca-stealer_lynx_manuscrypt_njrat

.exe 4.1MB

2026-08-05_5cd4b061af6a81519fa31927d05eab97_amadey_elex_hellokitty_luca-stealer_lynx_manuscrypt_njrat

IMPHASH 32bedc5101920e7f51069b91650d54c1
SHA256 16b4b30d4499dfd183b2c733d5dcce3d26d50c008f5cbb183bbafbbfa9ed324a
MD5 5cd4b061af6a81519fa31927d05eab97
SHA1 50126c4dad436a04c0e328118a084d489de675a9
SHA512 2bbb68f5ff8b93e1e910492831a623284480ede1dbbc22cae080eee56e6b590e3b9a33a38bc7e3bea24f2a7b8bb1f53a388dc5a4ecf4368a2935461f122884b1
SSDEEP 24576:kPqN8uQ+0EAVj21SRMQEMvwQ+AJuplwAi6qAu2j:kSN8uQqAI1/CwQDd
TLSH
T17016FC62A96021DBC21B07710E325CA00A1DD239B77FD89BAB874FF5D5B366304FD85A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects TONESHELL Backdoor - persistence component

backdoor apt mustang_panda earth_preta
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12833

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateMutexA ReleaseMutex lstrcpyA GetCommandLineW ExitProcess CreateProcessW Process32First GetCurrentProcess TerminateProcess LocalAlloc OpenProcess lstrcmpW ProcessIdToSessionId GetCurrentThread Process32Next LocalFree GetCurrentProcessId WinExec CreateThread WriteConsoleW HeapReAlloc lstrcpyW SetFilePointerEx lstrcatW GetLastError Sleep CreateFileW FindClose GetModuleFileNameW lstrlenW FindNextFileW FindFirstFileW CloseHandle lstrcatA GetModuleFileNameA LeaveCriticalSection WriteFile EnterCriticalSection CreateToolhelp32Snapshot HeapSize GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind RaiseException SetLastError EncodePointer DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle GetModuleHandleExW GetCommandLineA HeapAlloc HeapFree CompareStringW LCMapStringW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap DecodePointer

user32

wsprintfW

advapi32

SetSecurityDescriptorDacl SetServiceStatus RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW RevertToSelf CreateServiceW RegCloseKey AccessCheck SetSecurityDescriptorOwner CloseServiceHandle OpenSCManagerW AllocateAndInitializeSid GetUserNameA ImpersonateSelf RegSetValueExW IsValidSecurityDescriptor OpenProcessToken FreeSid StartServiceW InitializeSecurityDescriptor InitializeAcl RegOpenKeyExW OpenServiceW GetLengthSid AddAccessAllowedAce OpenThreadToken SetSecurityDescriptorGroup

shell32

CommandLineToArgvW SHCreateDirectoryExW

shlwapi

SHSetValueW

Name

.text

Size

82KB

Virtual Size

47.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

30KB

Virtual Size

47.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

47.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Config

Size

4KB

Virtual Size

47.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Net

Size

2.0MB

Virtual Size

47.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Fun

Size

2.0MB

Virtual Size

49.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

5KB

Virtual Size

51.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_5cd4b061af6a81519fa31927d05eab97_amadey_elex_hellokitty_luca-stealer_lynx_manuscrypt_njrat

kernel32

user32

advapi32

shell32

shlwapi

generic