2026-09-22_108844761a5a1b06d6e31bc6850998a0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-22_108844761a5a1b06d6e31bc6850998a0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_smoke-loader
Size 158KB
Sample260922-2csm7agg59
SHA256 3bc2c2fed70320e2bf9fd181deb3e4e3e71015d5d5a35f559e6744376833e9e0
MD5 108844761a5a1b06d6e31bc6850998a0
SHA1 a6088140330b2a968286cbf4ea2586ffa684c501
SHA512 a6a79f1c224fcfe823c21a57a35d9b8bf28036a5bb32e1c09c042a11b07b823d2508c387dc3fa84eecf3cad3f8f4d87f9923768b24f584c4bd1332d70a76ef28
SSDEEP 3072:FE4y8N7O42k4HzYRRluYam7tJeYu13RfypCxJX7EO9GQ1Ch5pLgCu9:Ft7O4IHzYrUYamqjyCxtEEGQ8hbLgCS
TLSH
T147F37B1175D08432E5B3193015F4DAB25A3DFE711F71CEAB2794063A5FA02D0AA39BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-22_108844761a5a1b06d6e31bc6850998a0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_smoke-loader

.exe 158KB

2026-09-22_108844761a5a1b06d6e31bc6850998a0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_smoke-loader

IMPHASH e63a2a8649c9d05c2339bff968d73d61
SHA256 3bc2c2fed70320e2bf9fd181deb3e4e3e71015d5d5a35f559e6744376833e9e0
MD5 108844761a5a1b06d6e31bc6850998a0
SHA1 a6088140330b2a968286cbf4ea2586ffa684c501
SHA512 a6a79f1c224fcfe823c21a57a35d9b8bf28036a5bb32e1c09c042a11b07b823d2508c387dc3fa84eecf3cad3f8f4d87f9923768b24f584c4bd1332d70a76ef28
SSDEEP 3072:FE4y8N7O42k4HzYRRluYam7tJeYu13RfypCxJX7EO9GQ1Ch5pLgCu9:Ft7O4IHzYrUYamqjyCxtEEGQ8hbLgCS
TLSH
T147F37B1175D08432E5B3193015F4DAB25A3DFE711F71CEAB2794063A5FA02D0AA39BBB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

05:10:67:d4:90:3a:a6:ce:c6:ff:1c:96:2f:fb:97:9e:1a:a0:8f:6e:05:4b:f8:2d:51:29:fb:dd:cd:4f:a6:db

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2025

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

05:10:67:d4:90:3a:a6:ce:c6:ff:1c:96:2f:fb:97:9e:1a:a0:8f:6e:05:4b:f8:2d:51:29:fb:dd:cd:4f:a6:db

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,OU=SYS BG-PC BU-SW RD Ctr,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 24, 2021

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

Serial Number

07:20:7b:3a:1a:cb:44:e4:dc:39:eb:d3:89:a9:6d:65

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 4, 2021 - May 8, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:11:2a:07:90:aa:e5:56:85:29:00:00:00:00:01:11

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 16, 2024 - May 14, 2025

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:e7:2e:8f:2f:93:0b:4f:1b:e9:00:01:00:00:01:e7

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

21390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Working\AsusDataFocus\DataFocus\Release\AsusTaskFirst.pdb

kernel32

SetEvent LockResource DeleteFileW HeapReAlloc CloseHandle RaiseException FindResourceExW LoadResource FindResourceW HeapAlloc DecodePointer HeapDestroy LocalFree GetProcessHeap CopyFileW ReadConsoleW ReadFile SetEndOfFile OutputDebugStringW GetLastError FormatMessageW GetPrivateProfileStringW MultiByteToWideChar CreateEventW SetFileAttributesW HeapSize GetPrivateProfileSectionNamesW CreateFileW LocalAlloc FindClose InitializeCriticalSectionEx GetModuleFileNameW RemoveDirectoryW GetPrivateProfileIntW lstrlenW FindNextFileW HeapFree FindFirstFileW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW SetStdHandle WriteConsoleW SetEnvironmentVariableW DeleteCriticalSection SizeofResource FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount ResetEvent WaitForSingleObjectEx GetModuleHandleW GetProcAddress UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW WideCharToMultiByte GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetACP GetFileType CompareStringW LCMapStringW FindFirstFileExW IsValidCodePage

advapi32

RegOpenKeyExW RegQueryValueExW SetSecurityDescriptorDacl RegCloseKey SetFileSecurityW AllocateAndInitializeSid SetEntriesInAclW RegCreateKeyExW RegSetValueExW FreeSid InitializeSecurityDescriptor

shell32

ShellExecuteW SHCreateDirectoryExW ShellExecuteA SHGetSpecialFolderPathW

shlwapi

PathRemoveFileSpecW SHDeleteKeyW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-22_108844761a5a1b06d6e31bc6850998a0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_smoke-loader

kernel32

advapi32

shell32

shlwapi

generic