2026-09-08_102c2c0e84c3e31ab4d93beec47a08ae_amadey_elex_hellokitty_luca-stealer_njrat

General

Target
2026-09-08_102c2c0e84c3e31ab4d93beec47a08ae_amadey_elex_hellokitty_luca-stealer_njrat
Size 1.5MB
Sample260910-jcmstszejg
SHA256 cd7d78e78e0c762fee7a725a07e3007d3746c06bf3c3a64559705ba86b6a6694
MD5 102c2c0e84c3e31ab4d93beec47a08ae
SHA1 5d024074e8c6f7885940acf350ccb12282b087f2
SHA512 b7d2c65e4992c9cc853722dc35a9d6978e56c6d0c771883a486833b059237046a535342127c2f32261ac519ebbca73cddb72b1aeab74dcfa189a489413a41abe
SSDEEP 12288:3N9+Gbxv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dBNyxknw4FYnshx8OfVe247
TLSH
T19A65121077C1D072E5B629321670A6711B3DFC744E348A6FD3A8213E9EB08D16A2AF77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_102c2c0e84c3e31ab4d93beec47a08ae_amadey_elex_hellokitty_luca-stealer_njrat

File Explorer

2026-09-08_102c2c0e84c3e31ab4d93beec47a08ae_amadey_elex_hellokitty_luca-stealer_njrat

.exe 1.5MB

2026-09-08_102c2c0e84c3e31ab4d93beec47a08ae_amadey_elex_hellokitty_luca-stealer_njrat

IMPHASH 30cf598f803065deb538206803e6bf38
SHA256 cd7d78e78e0c762fee7a725a07e3007d3746c06bf3c3a64559705ba86b6a6694
MD5 102c2c0e84c3e31ab4d93beec47a08ae
SHA1 5d024074e8c6f7885940acf350ccb12282b087f2
SHA512 b7d2c65e4992c9cc853722dc35a9d6978e56c6d0c771883a486833b059237046a535342127c2f32261ac519ebbca73cddb72b1aeab74dcfa189a489413a41abe
SSDEEP 12288:3N9+Gbxv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dBNyxknw4FYnshx8OfVe247
TLSH
T19A65121077C1D072E5B629321670A6711B3DFC744E348A6FD3A8213E9EB08D16A2AF77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11810

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\GetDeviceVersion\GetDeviceVersion\Release\GetDeviceVersion.pdb

oleaut32

SysStringLen SysAllocString

kernel32

GetCommandLineA CreateFileW CloseHandle LoadLibraryW GetProcAddress GetModuleFileNameW GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary DeleteFileW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW DecodePointer RaiseException RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW WriteConsoleW GetCommandLineW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW CompareStringW LCMapStringW GetProcessHeap SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_102c2c0e84c3e31ab4d93beec47a08ae_amadey_elex_hellokitty_luca-stealer_njrat

oleaut32

kernel32

generic