2026-08-15_36a0793fd5886c6e6cbdcc2bf7cde639_amadey_elex_hellokitty_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_36a0793fd5886c6e6cbdcc2bf7cde639_amadey_elex_hellokitty_luca-stealer_njrat
Size 1.4MB
Sample260816-a3d4yaxvb1
SHA256 df565b637d7cabffa1ed1024e77f657bde766dc4ccf4dee7ceaf7fa8cb5776e6
MD5 36a0793fd5886c6e6cbdcc2bf7cde639
SHA1 89b68af312457437937c08774f21ffff6bd5bd5e
SHA512 0e2ce40b95750f129b11e6bdae1c69f2bd4b96a670776c1491a5a9737d88d73ab5700eb157edff9545c31c102eb0cb63d215240dcb363a0e290cb53f1c3883bf
SSDEEP 24576:0as/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0asLNiXicJFFRGNzj3
TLSH
T1BC65125171C08472E9B6043549B4DA70AA6DFD344F205DE7A3883A7E9E34BD28F35A3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-15_36a0793fd5886c6e6cbdcc2bf7cde639_amadey_elex_hellokitty_luca-stealer_njrat

File Explorer

2026-08-15_36a0793fd5886c6e6cbdcc2bf7cde639_amadey_elex_hellokitty_luca-stealer_njrat

.exe 1.4MB

2026-08-15_36a0793fd5886c6e6cbdcc2bf7cde639_amadey_elex_hellokitty_luca-stealer_njrat

IMPHASH a47085e8acf72a5536a475c07003df65
SHA256 df565b637d7cabffa1ed1024e77f657bde766dc4ccf4dee7ceaf7fa8cb5776e6
MD5 36a0793fd5886c6e6cbdcc2bf7cde639
SHA1 89b68af312457437937c08774f21ffff6bd5bd5e
SHA512 0e2ce40b95750f129b11e6bdae1c69f2bd4b96a670776c1491a5a9737d88d73ab5700eb157edff9545c31c102eb0cb63d215240dcb363a0e290cb53f1c3883bf
SSDEEP 24576:0as/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0asLNiXicJFFRGNzj3
TLSH
T1BC65125171C08472E9B6043549B4DA70AA6DFD344F205DE7A3883A7E9E34BD28F35A3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10896

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Intel\Developer\8819\p4\989747040\services\AMTSW\Release\MEWMIProv\WMIRegistrationService\Release\WMIRegistrationService.pdb

shlwapi

PathFileExistsW

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec

kernel32

SetEvent WaitForSingleObject CreateEventW GetExitCodeProcess QueueUserWorkItem GetModuleFileNameW SetDefaultDllDirectories GetLastError UnregisterWait GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize CloseHandle OutputDebugStringW DecodePointer CreateFileW RegisterWaitForSingleObject TlsAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RaiseException RtlUnwind SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount WriteConsoleW TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW CompareStringW LCMapStringW GetProcessHeap SetFilePointerEx

shell32

SHGetKnownFolderPath ShellExecuteExW

ole32

CoTaskMemFree

advapi32

SetServiceStatus RegisterServiceCtrlHandlerExW ReportEventW RegisterEventSourceW DeregisterEventSource StartServiceCtrlDispatcherW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_36a0793fd5886c6e6cbdcc2bf7cde639_amadey_elex_hellokitty_luca-stealer_njrat

shlwapi

api-ms-win-core-path-l1-1-0

kernel32

shell32

ole32

advapi32

generic