2026-08-19_d81cbfa2950e54a327b2469b70f76ed7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_d81cbfa2950e54a327b2469b70f76ed7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat
Size 115KB
Sample260819-er17jsysbv
SHA256 ee4ee7532f9eba528980a8c369dfa1b4b4f0aba27545b86a8e352728728dd9ae
MD5 d81cbfa2950e54a327b2469b70f76ed7
SHA1 49ab1d314e375e807dde593e0b35eefebd232b96
SHA512 25a8b6b2192086f6020ac03d660a3c1538d0b7df41806b238824a1a84e790b1f1c0fa72d9cc6692469078f7ae867c6da4797da40cf51bdffc79dcf6bf9c4efaf
SSDEEP 3072:YPInuiujyXNdiByPCrZ2BKZpQaVBXWvFRz0XLitcC71w1LP0Q:LuUoSBNapcZw14Q
TLSH
T101C37C4075D1D032E9615E3948A0D9725A3EFE316F609AEB6358067D8F303E09A39F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-19_d81cbfa2950e54a327b2469b70f76ed7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

.exe 115KB

2026-08-19_d81cbfa2950e54a327b2469b70f76ed7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

IMPHASH 6d03ff5946c9af90dc52aa74b97dd855
SHA256 ee4ee7532f9eba528980a8c369dfa1b4b4f0aba27545b86a8e352728728dd9ae
MD5 d81cbfa2950e54a327b2469b70f76ed7
SHA1 49ab1d314e375e807dde593e0b35eefebd232b96
SHA512 25a8b6b2192086f6020ac03d660a3c1538d0b7df41806b238824a1a84e790b1f1c0fa72d9cc6692469078f7ae867c6da4797da40cf51bdffc79dcf6bf9c4efaf
SSDEEP 3072:YPInuiujyXNdiByPCrZ2BKZpQaVBXWvFRz0XLitcC71w1LP0Q:LuUoSBNapcZw14Q
TLSH
T101C37C4075D1D032E9615E3948A0D9725A3EFE316F609AEB6358067D8F303E09A39F7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

31:bb:2b:00:da:c9:5d:c7:2f:f3:cc:58:c3:2f:ce:1b:e2:09:bf:ca:f5:40:ee:ab:8a:8f:d8:2c:a8:03:7c:f2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Magnet Forensics Inc,O=Magnet Forensics Inc,L=Waterloo,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c176a6164406d61676e6574666f72656e736963732e636f6d

Chains

Jan 17, 2023

CN=Magnet Forensics Inc,O=Magnet Forensics Inc,L=Waterloo,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c176a6164406d61676e6574666f72656e736963732e636f6d

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=Magnet Forensics Inc,O=Magnet Forensics Inc,L=Waterloo,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c176a6164406d61676e6574666f72656e736963732e636f6d

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=Magnet Forensics Inc,O=Magnet Forensics Inc,L=Waterloo,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c176a6164406d61676e6574666f72656e736963732e636f6d

Serial Number

63:71:1f:fc:5a:f4:10:0d:3f:08:d5:11

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 12, 2021 - Oct 22, 2024

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

6224

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z2Dmp.pdb

2026-08-19_d81cbfa2950e54a327b2469b70f76ed7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

kernel32

generic