General
- Target 2026-08-18_e88fc0c9cc89d0e85eb790c17a4465b4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_smoke-loader
- Size 302KB
- Sample260818-t2pc3axte1
- SHA256 9c3841dd36bd0d7dcc7925bd5a3bbc9fe19aecd825126142d83d5398f3fae386
- MD5 e88fc0c9cc89d0e85eb790c17a4465b4
- SHA1 80d5297a047429ef707747c553e302d836b28901
- SHA512 ebb51774269fe52daeaf4f3ad959039834a1e46cfd32d171631af9c243cee0c866186c3f5033175a268bb2e72a38c516bedf673937178a4b98a09f07a33c10dc
- SSDEEP 6144:nROJgEDImGUcsvZZvUmubv7vDHAll3uJA9Z7Vt4xIvE2CMkgzMyPQ:jIImGUcsvZZdubv7vql3ui/8IFmy
- TLSH T1A864AFC976E94072CABF0A344EA0D9AC8539F9701B27CDDF2350AAA91D311E64F35673
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-18_e88fc0c9cc89d0e85eb790c17a4465b4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-18_e88fc0c9cc89d0e85eb790c17a4465b4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-18_e88fc0c9cc89d0e85eb790c17a4465b4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_smoke-loader
- Size 302KB
- SHA256 9c3841dd36bd0d7dcc7925bd5a3bbc9fe19aecd825126142d83d5398f3fae386
- MD5 e88fc0c9cc89d0e85eb790c17a4465b4
- SHA1 80d5297a047429ef707747c553e302d836b28901
- SHA512 ebb51774269fe52daeaf4f3ad959039834a1e46cfd32d171631af9c243cee0c866186c3f5033175a268bb2e72a38c516bedf673937178a4b98a09f07a33c10dc
- SSDEEP 6144:nROJgEDImGUcsvZZvUmubv7vDHAll3uJA9Z7Vt4xIvE2CMkgzMyPQ:jIImGUcsvZZdubv7vql3ui/8IFmy
- TLSH T1A864AFC976E94072CABF0A344EA0D9AC8539F9701B27CDDF2350AAA91D311E64F35673
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2