2026-08-24_ab9a8d44a94b60cda29297160b69d14a_amadey_elex_floxif_hellokitty_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-24_ab9a8d44a94b60cda29297160b69d14a_amadey_elex_floxif_hellokitty_luca-stealer_njrat_remcos_smoke-loader
Size 616KB
Sample260825-e927kasyas
SHA256 4946358820f30a4bef7775f3c22bb81d66ca1b6196bfe95987115f93da1997d5
MD5 ab9a8d44a94b60cda29297160b69d14a
SHA1 3e33db41f5cfaf40bf394130081bbcac4fc331cb
SHA512 3b2c6fe4fe919f6ebf2c8b650456ff15f5f13d5aaaa8ff65597839b949d4ed8ffe41900503be52903a3e00563b04dc3f950238439f995f8332a7b35e659d4f59
SSDEEP 12288:jDrJL3QCiSt7hMYVbInjPZrraUu4iPnOEAPiWTydl8BjvrEH7ABjvrEH7Y:jDrpQCpXfbCjY4MXlbGrEH7irEH7Y
TLSH
T165D4E00135C183F7D173093039AC6A61B9E9F93E073A0DEB97D416094EBC5C2767AE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-24_ab9a8d44a94b60cda29297160b69d14a_amadey_elex_floxif_hellokitty_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-08-24_ab9a8d44a94b60cda29297160b69d14a_amadey_elex_floxif_hellokitty_luca-stealer_njrat_remcos_smoke-loader

.exe 616KB

2026-08-24_ab9a8d44a94b60cda29297160b69d14a_amadey_elex_floxif_hellokitty_luca-stealer_njrat_remcos_smoke-loader

IMPHASH f0e8305f3a2a23ba622fa7f18bf7cd51
SHA256 4946358820f30a4bef7775f3c22bb81d66ca1b6196bfe95987115f93da1997d5
MD5 ab9a8d44a94b60cda29297160b69d14a
SHA1 3e33db41f5cfaf40bf394130081bbcac4fc331cb
SHA512 3b2c6fe4fe919f6ebf2c8b650456ff15f5f13d5aaaa8ff65597839b949d4ed8ffe41900503be52903a3e00563b04dc3f950238439f995f8332a7b35e659d4f59
SSDEEP 12288:jDrJL3QCiSt7hMYVbInjPZrraUu4iPnOEAPiWTydl8BjvrEH7ABjvrEH7Y:jDrpQCpXfbCjY4MXlbGrEH7irEH7Y
TLSH
T165D4E00135C183F7D173093039AC6A61B9E9F93E073A0DEB97D416094EBC5C2767AE6A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

6f:81:32:d1:23:2d:4e:6d:b9:0a:8b:b3:e4:40:e4:f8:42:84:fb:1e:d4:58:ac:1a:21:5d:bf:8e:1a:1e:57:8b

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Chains

Oct 3, 2018

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

PE Signature issue

Digest

8d:0c:19:bf:b9:0c:3e:cf:1b:d7:d7:23:38:1d:05:3c:b5:d4:1f:8e

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Chains

Oct 3, 2018

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 22, 2008 - Dec 30, 2025

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 29, 2015 - Jun 9, 2027

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Serial Number

44:18:e4:04:4b:5a:b7:74:fc:aa:9d:61:bd:8e:83:b4

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftKernelCodeSigning

Timespan

Jun 29, 2018 - Jan 23, 2020

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 22, 2008 - Jun 10, 2027

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

199478

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenEventW CreateFileMappingW OpenMutexW CreateFileW WriteConsoleW UnmapViewOfFile MapViewOfFile FileTimeToDosDateTime FileTimeToLocalFileTime GetSystemTimeAsFileTime CloseHandle WaitForSingleObject SetEvent HeapSize GetProcAddress MultiByteToWideChar WideCharToMultiByte GetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW LCMapStringW GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind RaiseException FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc GetFileType SetFilePointerEx GetConsoleMode GetConsoleCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap FlushFileBuffers

user32

MessageBoxA

advapi32

RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegCreateKeyExW RegCreateKeyExA RegCloseKey

Name

.text

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

z0tyg8go

Size

58KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

oc7esfle

Size

287KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

0.jibmbs

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-24_ab9a8d44a94b60cda29297160b69d14a_amadey_elex_floxif_hellokitty_luca-stealer_njrat_remcos_smoke-loader

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

generic