2026-09-08_0412dc1f41f9e5906f4880b3d1460f02_amadey_elex_hellokitty_luca-stealer_njrat_remcos

General

Target
2026-09-08_0412dc1f41f9e5906f4880b3d1460f02_amadey_elex_hellokitty_luca-stealer_njrat_remcos
Size 104KB
Sample260910-jq4cqszflb
SHA256 cef2ebddb70d2af7728a1f5263865d1eed6b3fc5756e534f5d325f4bbdf942ed
MD5 0412dc1f41f9e5906f4880b3d1460f02
SHA1 db14444b080a137df10b0ada98cc7fe09c87681b
SHA512 265b08fd87919e12d2e6d3b3b31c122c5ce3189567772ea16ec329357e43ae25a38c34e62375edfebbe92708bf619249861c0afed120bb3fd00c9e984dfea30e
SSDEEP 3072:KAB6OQsYZHTecyxpn9fs/8cIuPH34HVqp:NNQXdAvYHT
TLSH
T11EA36D1174C1F8B2D4721D3108B4CA714A7EF9301F659EAB3FA8167A0FA41E19A3AD77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_0412dc1f41f9e5906f4880b3d1460f02_amadey_elex_hellokitty_luca-stealer_njrat_remcos

File Explorer

2026-09-08_0412dc1f41f9e5906f4880b3d1460f02_amadey_elex_hellokitty_luca-stealer_njrat_remcos

.exe 104KB

2026-09-08_0412dc1f41f9e5906f4880b3d1460f02_amadey_elex_hellokitty_luca-stealer_njrat_remcos

IMPHASH 5aee2b2154e1d40ef87c6426f519ea31
SHA256 cef2ebddb70d2af7728a1f5263865d1eed6b3fc5756e534f5d325f4bbdf942ed
MD5 0412dc1f41f9e5906f4880b3d1460f02
SHA1 db14444b080a137df10b0ada98cc7fe09c87681b
SHA512 265b08fd87919e12d2e6d3b3b31c122c5ce3189567772ea16ec329357e43ae25a38c34e62375edfebbe92708bf619249861c0afed120bb3fd00c9e984dfea30e
SSDEEP 3072:KAB6OQsYZHTecyxpn9fs/8cIuPH34HVqp:NNQXdAvYHT
TLSH
T11EA36D1174C1F8B2D4721D3108B4CA714A7EF9301F659EAB3FA8167A0FA41E19A3AD77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

7719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualAlloc WaitForSingleObject GetProcAddress CreateFileW WriteConsoleW HeapReAlloc HeapSize GetConsoleCP FlushFileBuffers GetProcessHeap GetStringTypeW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess RaiseException RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetCommandLineA GetCommandLineW GetACP SetFilePointerEx GetConsoleMode GetFileType HeapFree HeapAlloc CompareStringW LCMapStringW CloseHandle FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle DecodePointer

ws2_32

send getaddrinfo connect recv htons socket WSAStartup

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_0412dc1f41f9e5906f4880b3d1460f02_amadey_elex_hellokitty_luca-stealer_njrat_remcos

kernel32

ws2_32

generic