General
- Target 2026-09-17_f79a22830dc678600685e2036723a11a_amadey_avoslocker_cobalt-strike_conti_elex_hellokitty_hijackloader_luca-stealer_lynx_njrat
- Size 496KB
- Sample260917-3xtxes1erf
- SHA256 8e85bd7476d9e9cba751ce4dcad423708e10a99c4314b651c70b74b7ef8f30b9
- MD5 f79a22830dc678600685e2036723a11a
- SHA1 8f57130ff5a3b4df658b393375cf8073eb6435b2
- SHA512 16d0b7606367cf84670a4bb9b7870aa9263cf858bf291bb51038baf7088177bcbbcdfe89ac97f8a59410bf5dd4b3395b1504153887a44c2a4bfddad076e9c04d
- SSDEEP 6144:y7WQ0j4ltziolIGlnE2dFDVrlBu0R+J5JlLgPYfq8ZF02IlLZD70nXea2k:6i4lZioxVfu0R+J5JlLgPbD70nn2k
- TLSH T1BBB47D1379C19431F7720E3004A297F5BE7EFD20196AA99B23C8762E5E312C3561A97F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-17_f79a22830dc678600685e2036723a11a_amadey_avoslocker_cobalt-strike_conti_elex_hellokitty_hi.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-17_f79a22830dc678600685e2036723a11a_amadey_avoslocker_cobalt-strike_conti_elex_hellokitty_hi.exe
Resource
win11ltsc2024-20260911-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-17_f79a22830dc678600685e2036723a11a_amadey_avoslocker_cobalt-strike_conti_elex_hellokitty_hijackloader_luca-stealer_lynx_njrat
- Size 496KB
- SHA256 8e85bd7476d9e9cba751ce4dcad423708e10a99c4314b651c70b74b7ef8f30b9
- MD5 f79a22830dc678600685e2036723a11a
- SHA1 8f57130ff5a3b4df658b393375cf8073eb6435b2
- SHA512 16d0b7606367cf84670a4bb9b7870aa9263cf858bf291bb51038baf7088177bcbbcdfe89ac97f8a59410bf5dd4b3395b1504153887a44c2a4bfddad076e9c04d
- SSDEEP 6144:y7WQ0j4ltziolIGlnE2dFDVrlBu0R+J5JlLgPYfq8ZF02IlLZD70nXea2k:6i4lZioxVfu0R+J5JlLgPbD70nn2k
- TLSH T1BBB47D1379C19431F7720E3004A297F5BE7EFD20196AA99B23C8762E5E312C3561A97F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE