2026-08-16_f0422b03912f64c02866d532c9acdf73_amadey_elex_floxif_hellokitty_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-16_f0422b03912f64c02866d532c9acdf73_amadey_elex_floxif_hellokitty_njrat_remcos
Size 1.3MB
Sample260816-tztvrssvhs
SHA256 697bf751d11fc60851eea1cd00ab6a307a8ccea048fa82be3ada03e56658a1d3
MD5 f0422b03912f64c02866d532c9acdf73
SHA1 293bd38f9a4d9c8669dd9ee30261efd8b37258ba
SHA512 381a394abe8164acfaf958f363284fca037cf2d6a5a198c33b1dd5cfcb882a7892fb75978f3d0c897543b75e712e8347093cf74db0ac72d0f89995a2f0a91fab
SSDEEP 24576:KvGoPM9jkPd17jwfYl7jy0hslMQwKQnjr51uTiZxv879kENIdLwN4ZASFDPrEH7U:8M9QPdxwfE7WlFwKAfzuTiDFUFkp
TLSH
T13F55120136E043E4F8B61E3035B899600EF1FC7C0979DA5F5391A9A94E7C9A3E935B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-16_f0422b03912f64c02866d532c9acdf73_amadey_elex_floxif_hellokitty_njrat_remcos

File Explorer

2026-08-16_f0422b03912f64c02866d532c9acdf73_amadey_elex_floxif_hellokitty_njrat_remcos

.exe 1.3MB

2026-08-16_f0422b03912f64c02866d532c9acdf73_amadey_elex_floxif_hellokitty_njrat_remcos

IMPHASH 0ffb0c1b03081ee555711ca0c1201c9d
SHA256 697bf751d11fc60851eea1cd00ab6a307a8ccea048fa82be3ada03e56658a1d3
MD5 f0422b03912f64c02866d532c9acdf73
SHA1 293bd38f9a4d9c8669dd9ee30261efd8b37258ba
SHA512 381a394abe8164acfaf958f363284fca037cf2d6a5a198c33b1dd5cfcb882a7892fb75978f3d0c897543b75e712e8347093cf74db0ac72d0f89995a2f0a91fab
SSDEEP 24576:KvGoPM9jkPd17jwfYl7jy0hslMQwKQnjr51uTiZxv879kENIdLwN4ZASFDPrEH7U:8M9QPdxwfE7WlFwKAfzuTiDFUFkp
TLSH
T13F55120136E043E4F8B61E3035B899600EF1FC7C0979DA5F5391A9A94E7C9A3E935B27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

7a:ab:78:75:ec:7e:66:25:1d:1c:60:b2:64:08:8f:d3:93:3a:b5:c9:d2:be:5e:09:ee:d2:05:72:d3:b7:f8:26

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Google LLC,O=Google LLC,L=Mountain View,ST=ca,C=US

Chains

Apr 13, 2021

CN=Google LLC,O=Google LLC,L=Mountain View,ST=ca,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

de:01:03:f9:fc:1e:a3:c6:56:ef:dd:82:db:7a:d4:da:3a:58:2f:aa

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Chains

Apr 13, 2021

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Serial Number

06:ae:a7:6b:ac:46:a9:e8:cf:e6:d2:9e:45:aa:f0:33

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 8, 2019 - Nov 16, 2022

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=Dummy certificate

Serial Number

Issuer

CN=Unknown issuer

Key Usages

KeyUsageCertSign

Ext Key Usages

Timespan

Jan 1, 2013 - Apr 1, 2013

Subject

CN=Google LLC,O=Google LLC,L=Mountain View,ST=ca,C=US

Serial Number

0c:15:be:4a:15:bb:09:03:c9:01:b1:d6:c2:65:30:2f

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 7, 2018 - Nov 17, 2021

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Minor OS version

Major OS version

Entry point

20247

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

TEST_mi_exe_stub.pdb

kernel32

QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException GetStdHandle WriteFile GetModuleFileNameW GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP OutputDebugStringW CloseHandle HeapAlloc HeapFree FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetFileType GetStringTypeW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW DecodePointer CreateFileW GetExitCodeProcess CreateProcessW WaitForSingleObject SetFilePointer CreateDirectoryW SizeofResource RemoveDirectoryW GetTempPathW FormatMessageW LockResource DeleteFileW FindResourceExW LoadResource FindResourceW HeapDestroy LocalFree VerSetConditionMask CopyFileW VerifyVersionInfoW GetTempFileNameW lstrcmpiW UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualQuery ReadFile

shlwapi

PathQuoteSpacesW PathAppendW

ole32

CoUninitialize CoInitializeEx

shell32

SHGetFolderPathW ord680

user32

MessageBoxW CharLowerBuffW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_f0422b03912f64c02866d532c9acdf73_amadey_elex_floxif_hellokitty_njrat_remcos

PE Signature issue

PE Signature issue

kernel32

shlwapi

ole32

shell32

user32

generic