2026-08-06_35815ed40749e794968c545726826c46_amadey_elex_hellokitty_luca-stealer_lynx_njrat

General

Target
2026-08-06_35815ed40749e794968c545726826c46_amadey_elex_hellokitty_luca-stealer_lynx_njrat
Size 1.5MB
Sample260806-l79beshn51
SHA256 5780df7f872f17b4dd68f8f15ea44a12713d9e410255decec7bb412e761a7f86
MD5 35815ed40749e794968c545726826c46
SHA1 9993cbe346d0f9e0d583950ea3e307504088ab62
SHA512 b68ce01e0898955b7147b17b05476fdf12df27d5963e056146e06aa0f52981fe6dffa3a2720b67c4bbc3187b7050171b65e7ce4a0e73cd80987124acfcf17613
SSDEEP 24576:quex6umb57GBiOl6a8JTth/RWZvR6wQQ92pN3T:quex6Rb5+Pl6bJTIZ5jdgpB
TLSH
T12975120176C1D072D5B71A3588D4DB60EE7DFE308E556AFB43A8097BAF303C16926A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-06_35815ed40749e794968c545726826c46_amadey_elex_hellokitty_luca-stealer_lynx_njrat

File Explorer

2026-08-06_35815ed40749e794968c545726826c46_amadey_elex_hellokitty_luca-stealer_lynx_njrat

.exe 1.5MB

2026-08-06_35815ed40749e794968c545726826c46_amadey_elex_hellokitty_luca-stealer_lynx_njrat

IMPHASH e3e9f38319c353ff0336c249f87bdef4
SHA256 5780df7f872f17b4dd68f8f15ea44a12713d9e410255decec7bb412e761a7f86
MD5 35815ed40749e794968c545726826c46
SHA1 9993cbe346d0f9e0d583950ea3e307504088ab62
SHA512 b68ce01e0898955b7147b17b05476fdf12df27d5963e056146e06aa0f52981fe6dffa3a2720b67c4bbc3187b7050171b65e7ce4a0e73cd80987124acfcf17613
SSDEEP 24576:quex6umb57GBiOl6a8JTth/RWZvR6wQQ92pN3T:quex6Rb5+Pl6bJTIZ5jdgpB
TLSH
T12975120176C1D072D5B71A3588D4DB60EE7DFE308E556AFB43A8097BAF303C16926A1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6824

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Builds\.tmp\obs\liv-558\build32\plugins\win-capture\get-graphics-offsets\RelWithDebInfo\get-graphics-offsets32.pdb

kernel32

SetErrorMode GetModuleHandleA VerSetConditionMask GetProcAddress LoadLibraryA VerifyVersionInfoW WriteConsoleW CreateFileW CloseHandle HeapReAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize DecodePointer

user32

RegisterClassA DefWindowProcA CreateWindowExA DestroyWindow

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_35815ed40749e794968c545726826c46_amadey_elex_hellokitty_luca-stealer_lynx_njrat

kernel32

user32

generic