2026-08-06_ed3f7bbb34730837116f820fc211ac84_amadey_elex_hellokitty_luca-stealer_lynx_njrat

General

Target
2026-08-06_ed3f7bbb34730837116f820fc211ac84_amadey_elex_hellokitty_luca-stealer_lynx_njrat
Size 1.5MB
Sample260806-lp8beagh87
SHA256 4ba9b817a8bfcdc90060fc00cc828d7d136ef042aeeda3f21a240ccb057f19df
MD5 ed3f7bbb34730837116f820fc211ac84
SHA1 cbfa9dcba0219a00e3aff38fbde12b9aa3f81421
SHA512 ace4023471133ef27e7f77474d1ef4b23e3958371211a69da9936cddf38394a6be695a62fcfb5866823efbd1c7f8ecb1fb8038ddccb87e7a8a730c83988c3ba3
SSDEEP 24576:utanAdsfJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3q:utanAGfEb5+Pl6bJTIZ5jdgpE
TLSH
T1E475120275C190B2D4B71A3189E4DB60AD7DFE308E556FABC7E8093BDB342C1692661F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-06_ed3f7bbb34730837116f820fc211ac84_amadey_elex_hellokitty_luca-stealer_lynx_njrat

File Explorer

2026-08-06_ed3f7bbb34730837116f820fc211ac84_amadey_elex_hellokitty_luca-stealer_lynx_njrat

.exe 1.5MB

2026-08-06_ed3f7bbb34730837116f820fc211ac84_amadey_elex_hellokitty_luca-stealer_lynx_njrat

IMPHASH 21555dbba5e44628481d6d725b2e2175
SHA256 4ba9b817a8bfcdc90060fc00cc828d7d136ef042aeeda3f21a240ccb057f19df
MD5 ed3f7bbb34730837116f820fc211ac84
SHA1 cbfa9dcba0219a00e3aff38fbde12b9aa3f81421
SHA512 ace4023471133ef27e7f77474d1ef4b23e3958371211a69da9936cddf38394a6be695a62fcfb5866823efbd1c7f8ecb1fb8038ddccb87e7a8a730c83988c3ba3
SSDEEP 24576:utanAdsfJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3q:utanAGfEb5+Pl6bJTIZ5jdgpE
TLSH
T1E475120275C190B2D4B71A3189E4DB60AD7DFE308E556FABC7E8093BDB342C1692661F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6086

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\1\s\build32\plugins\win-capture\inject-helper\RelWithDebInfo\inject-helper32.pdb

kernel32

Sleep GetExitCodeThread GetModuleHandleW GetProcAddress LoadLibraryExW LoadLibraryW GetCommandLineW WaitForSingleObject GetCurrentProcess GetModuleFileNameW LocalFree WriteConsoleW CreateFileW HeapReAlloc SetLastError GetLastError SetErrorMode CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary EncodePointer RaiseException GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA HeapAlloc HeapFree CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize DecodePointer

user32

PostThreadMessageW

shell32

CommandLineToArgvW

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_ed3f7bbb34730837116f820fc211ac84_amadey_elex_hellokitty_luca-stealer_lynx_njrat

kernel32

user32

shell32

advapi32

generic