General
- Target 2026-08-08_83aaf318d43b1058272c39ab7af9dc36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader
- Size 749KB
- Sample260808-dscd5sssgt
- SHA256 d04674e22c8fdd079576818a9181474ee51c560af847fdc1fd2a114a367ac997
- MD5 83aaf318d43b1058272c39ab7af9dc36
- SHA1 5a4c746f71bb7a94deddb39da58bd7dda0ab9f68
- SHA512 4ee41781ab4a155b39255280daef01c7a011bc5e00b6d819a061daa2d116b58c1ac93a35860f1f78160cd92aca78c919b1132e91d7c60b5e1ba75fee03f99fd0
- SSDEEP 12288:F93G6vHzOASubviBNDYa3vijCnkH79iF71xmrGcMQTWQRp07S75pSCjFNEySOgO/:FVGGTWBZmPH79S1xyGvQhH88LjFGpKnj
- TLSH T138F4015172D08477E263193009B0AAB2593EFE311FB499AF3391276E9F706D18D39B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_83aaf318d43b1058272c39ab7af9dc36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_83aaf318d43b1058272c39ab7af9dc36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-08_83aaf318d43b1058272c39ab7af9dc36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader
- Size 749KB
- SHA256 d04674e22c8fdd079576818a9181474ee51c560af847fdc1fd2a114a367ac997
- MD5 83aaf318d43b1058272c39ab7af9dc36
- SHA1 5a4c746f71bb7a94deddb39da58bd7dda0ab9f68
- SHA512 4ee41781ab4a155b39255280daef01c7a011bc5e00b6d819a061daa2d116b58c1ac93a35860f1f78160cd92aca78c919b1132e91d7c60b5e1ba75fee03f99fd0
- SSDEEP 12288:F93G6vHzOASubviBNDYa3vijCnkH79iF71xmrGcMQTWQRp07S75pSCjFNEySOgO/:FVGGTWBZmPH79S1xyGvQhH88LjFGpKnj
- TLSH T138F4015172D08477E263193009B0AAB2593EFE311FB499AF3391276E9F706D18D39B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1