22ee89747b581c36c0aad8128cdab6fbca80f2e7da3112af95a1fa1e788508a1

General

Target
2026-08-25_96973dcd78f2c78ab1f42123ef9ce04f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_nymaim_rhadamanthys_smoke-loader
Size 3.6MB
Sample260826-t7nnqasflb
SHA256 22ee89747b581c36c0aad8128cdab6fbca80f2e7da3112af95a1fa1e788508a1
MD5 96973dcd78f2c78ab1f42123ef9ce04f
SHA1 8dcdecea7f950080dfb549e844dc375db751e7eb
SHA512 fda9f54a817e115fde7496825ef5a23800c9eb69b26ab59492f826434b3f81f13d6cc8fc2ce9a171180fbe2b9618acadb357068fd2ff668e05e43f5607629074
SSDEEP 98304:IIMDtIXLr06AdfEThF35PzuzKB5qFb0I+0PqkWEU:IYrmEdF3bsbSEU
TLSH
T15906331136F18079F6E70C3019E686B10ABCF9314DA4B96F63E019AD1F714E2B529BDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-08-25_96973dcd78f2c78ab1f42123ef9ce04f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_nymaim_rhadamanthys_smoke-loader
- Size 3.6MB
- SHA256 22ee89747b581c36c0aad8128cdab6fbca80f2e7da3112af95a1fa1e788508a1
- MD5 96973dcd78f2c78ab1f42123ef9ce04f
- SHA1 8dcdecea7f950080dfb549e844dc375db751e7eb
- SHA512 fda9f54a817e115fde7496825ef5a23800c9eb69b26ab59492f826434b3f81f13d6cc8fc2ce9a171180fbe2b9618acadb357068fd2ff668e05e43f5607629074
- SSDEEP 98304:IIMDtIXLr06AdfEThF35PzuzKB5qFb0I+0PqkWEU:IYrmEdF3bsbSEU
- TLSH
  T15906331136F18079F6E70C3019E686B10ABCF9314DA4B96F63E019AD1F714E2B529BDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution miner persistence privilege_escalation spyware stealer trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Cryptocurrency Miner
  Makes network request to known mining pool URL.
  miner
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral1 behavioral2