8c2c2de4ea10cb2da240ee00413e4bceb0b47c0e3c82f05e746a824851902d98

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 15:24

Target
2026-09-16_f471b4bb5b74f9372c99d963c36694d5_amadey_cobalt-strike_elex_hellokitty_luca-stealer_lumma-stealer_njrat.exe
Size 158KB
Sample260916-ss54sazzft
SHA256 8c2c2de4ea10cb2da240ee00413e4bceb0b47c0e3c82f05e746a824851902d98
MD5 f471b4bb5b74f9372c99d963c36694d5
SHA1 9d2a91862d9507d1d8b501eb91da11f4c7f983a4
SHA512 f25e66b9d350ad5a62690ddd3581f71872eae5b7393a0de7ed2cd8736b9a8441d09ffc14b98de9e3e510fe1052da473747b334dd033f553f4e883a7b9f3e5b51
SSDEEP 3072:7ZEsdw9MDdPyebt3JM0sknMIYIAsfJJ4MfehihzynMT0bLbF+OTwSG:1Esde4JfaIV/4KehQznwwSG
TLSH
T1F1F36B15B5D1C031E5770A3205F4D670AE3DBA302AA25AEF2B550BBE6F316C09724F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-16_f471b4bb5b74f9372c99d963c36694d5_amadey_cobalt-strike_elex_hellokitty_luca-stealer_lumma-stealer_njrat.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-16_f471b4bb5b74f9372c99d963c36694d5_amadey_cobalt-strike_elex_hellokitty_luca-stealer_lumma-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_f471b4bb5b74f9372c99d963c36694d5_amadey_cobalt-strike_elex_hellokitty_luca-stealer_lumma-stealer_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2576