2026-08-06_7dac4527bcc5201432e7d7746859670f_amadey_elex_hellokitty_luca-stealer_lynx_njrat

General

Target
2026-08-06_7dac4527bcc5201432e7d7746859670f_amadey_elex_hellokitty_luca-stealer_lynx_njrat
Size 1.5MB
Sample260806-l2pd3aycph
SHA256 e7786f5440820e491c66dcbf3a4d3f836fcd9c4b3f68a7b638574726396c515a
MD5 7dac4527bcc5201432e7d7746859670f
SHA1 c8de954744fd15039c80e04245a5bf4b300489e4
SHA512 dd87cd1565b2a85fb7d26e4b0e08acac760dab65100f4bf719ded82967ba5c023cb76cb9cfebb7c377f9cc01c0f872fdfd11103015fdb666bd52cc7eda2bee76
SSDEEP 24576:3tanAdsfJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3y:3tanAGfEb5+Pl6bJTIZ5jdgpo
TLSH
T10775120275C190B2D4B71A3189E4DB60AD7DFE308E556FABC7E8093BDB342C1692661F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-06_7dac4527bcc5201432e7d7746859670f_amadey_elex_hellokitty_luca-stealer_lynx_njrat

File Explorer

2026-08-06_7dac4527bcc5201432e7d7746859670f_amadey_elex_hellokitty_luca-stealer_lynx_njrat

.exe 1.5MB

2026-08-06_7dac4527bcc5201432e7d7746859670f_amadey_elex_hellokitty_luca-stealer_lynx_njrat

IMPHASH 21555dbba5e44628481d6d725b2e2175
SHA256 e7786f5440820e491c66dcbf3a4d3f836fcd9c4b3f68a7b638574726396c515a
MD5 7dac4527bcc5201432e7d7746859670f
SHA1 c8de954744fd15039c80e04245a5bf4b300489e4
SHA512 dd87cd1565b2a85fb7d26e4b0e08acac760dab65100f4bf719ded82967ba5c023cb76cb9cfebb7c377f9cc01c0f872fdfd11103015fdb666bd52cc7eda2bee76
SSDEEP 24576:3tanAdsfJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3y:3tanAGfEb5+Pl6bJTIZ5jdgpo
TLSH
T10775120275C190B2D4B71A3189E4DB60AD7DFE308E556FABC7E8093BDB342C1692661F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6086

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\1\s\build32\plugins\win-capture\inject-helper\RelWithDebInfo\inject-helper32.pdb

kernel32

Sleep GetExitCodeThread GetModuleHandleW GetProcAddress LoadLibraryExW LoadLibraryW GetCommandLineW WaitForSingleObject GetCurrentProcess GetModuleFileNameW LocalFree WriteConsoleW CreateFileW HeapReAlloc SetLastError GetLastError SetErrorMode CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary EncodePointer RaiseException GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA HeapAlloc HeapFree CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize DecodePointer

user32

PostThreadMessageW

shell32

CommandLineToArgvW

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_7dac4527bcc5201432e7d7746859670f_amadey_elex_hellokitty_luca-stealer_lynx_njrat

kernel32

user32

shell32

advapi32

generic