2026-08-16_5416687bdf652b3bfdf968a70bd483f3_amadey_elex_hellokitty_luca-stealer_njrat

General

Target
2026-08-16_5416687bdf652b3bfdf968a70bd483f3_amadey_elex_hellokitty_luca-stealer_njrat
Size 1.4MB
Sample260816-jqdr3sshld
SHA256 44b5c9cfeb2807a085371eeb9cb93e439f60d773597b3a86cf27fdd103af5087
MD5 5416687bdf652b3bfdf968a70bd483f3
SHA1 fedb67abec3f01b6f7b2f8737850bf17c3ffe879
SHA512 de8f9efc1d5325f32f75da300edcffed5026d676b03103d013a72c4d00f5ce7f739d601959196bf48ee2a9bc9b114138b83476e664b830470fd7227585997a05
SSDEEP 24576:ZBVqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:ZBy8D+rC9K159d9tq38/hL
TLSH
T1FA65120172C4D472E2B32A30667499A0573DFCB80D749DAFA398227A4E756D15A33FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_5416687bdf652b3bfdf968a70bd483f3_amadey_elex_hellokitty_luca-stealer_njrat

File Explorer

2026-08-16_5416687bdf652b3bfdf968a70bd483f3_amadey_elex_hellokitty_luca-stealer_njrat

.exe 1.4MB

2026-08-16_5416687bdf652b3bfdf968a70bd483f3_amadey_elex_hellokitty_luca-stealer_njrat

IMPHASH 30cf598f803065deb538206803e6bf38
SHA256 44b5c9cfeb2807a085371eeb9cb93e439f60d773597b3a86cf27fdd103af5087
MD5 5416687bdf652b3bfdf968a70bd483f3
SHA1 fedb67abec3f01b6f7b2f8737850bf17c3ffe879
SHA512 de8f9efc1d5325f32f75da300edcffed5026d676b03103d013a72c4d00f5ce7f739d601959196bf48ee2a9bc9b114138b83476e664b830470fd7227585997a05
SSDEEP 24576:ZBVqZ8DkOwCnpSC9K159d9Ciq9JL8/UyL:ZBy8D+rC9K159d9tq38/hL
TLSH
T1FA65120172C4D472E2B32A30667499A0573DFCB80D749DAFA398227A4E756D15A33FB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11810

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\GetDeviceVersion\GetDeviceVersion\Release\GetDeviceVersion.pdb

oleaut32

SysStringLen SysAllocString

kernel32

GetCommandLineA CreateFileW CloseHandle LoadLibraryW GetProcAddress GetModuleFileNameW GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary DeleteFileW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW DecodePointer RaiseException RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW WriteConsoleW GetCommandLineW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW CompareStringW LCMapStringW GetProcessHeap SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_5416687bdf652b3bfdf968a70bd483f3_amadey_elex_hellokitty_luca-stealer_njrat

oleaut32

kernel32

generic