General
- Target 2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader
- Size 749KB
- Sample260809-max3kawbje
- SHA256 1788757f553552dda059dcb9c8a49d2ab73304a401839dcc9f836173e5d8f884
- MD5 3ce9d4e8811e963a9975c2972cbd87f7
- SHA1 635aa039dcd654e45220c6421b22673bd4ceff61
- SHA512 342ee3242bd183e2be669e3aa02e6a731cadc3c2efa7c5041f83fc7b2aaff3db949cd7106d27866bcffe58018e96f98e1c0cdc4cc57a0ed09dd16570ecc2cc72
- SSDEEP 12288:m93G6vHzOASubviBNDYa37AcykP04oBYzx0e8P0Hj3kA0WEO7YwTY8KmkkFGYwQc:mVGGTWBZmyoBSx4Q0AREO0SW0AXgO
- TLSH T1FBF40221B2C0C872D673193409B4DAA0A97EFD301FA54EAF23545B6F5DB07E24A39727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-09_3ce9d4e8811e963a9975c2972cbd87f7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader
- Size 749KB
- SHA256 1788757f553552dda059dcb9c8a49d2ab73304a401839dcc9f836173e5d8f884
- MD5 3ce9d4e8811e963a9975c2972cbd87f7
- SHA1 635aa039dcd654e45220c6421b22673bd4ceff61
- SHA512 342ee3242bd183e2be669e3aa02e6a731cadc3c2efa7c5041f83fc7b2aaff3db949cd7106d27866bcffe58018e96f98e1c0cdc4cc57a0ed09dd16570ecc2cc72
- SSDEEP 12288:m93G6vHzOASubviBNDYa37AcykP04oBYzx0e8P0Hj3kA0WEO7YwTY8KmkkFGYwQc:mVGGTWBZmyoBSx4Q0AREO0SW0AXgO
- TLSH T1FBF40221B2C0C872D673193409B4DAA0A97EFD301FA54EAF23545B6F5DB07E24A39727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1