General
- Target 2026-09-22_6b129d86f9b509c3cb0d2216f9f468f4_amadey_avoslocker_cobalt-strike_conti_elex_hellokitty_hijackloader_luca-stealer_lynx_njrat
- Size 496KB
- Sample260922-ynrcqa1flg
- SHA256 da159dd67041603f1db6a131ba6bebcb6b4d1899e7d03454fd044b60059b309b
- MD5 6b129d86f9b509c3cb0d2216f9f468f4
- SHA1 3cb7a54173c3a834effa8c66e68cc576861c62e9
- SHA512 0b78230ee7a87e1918b486464db0fc2ff76a05c8c1ad7dec2aa6bcc3129048282f02d91bb39f24b624b249d4da3cc587c5daa3e0d026f15ec5b9786061467a85
- SSDEEP 6144:y7WQ0j4ltziolIGlnE2dFDurlBu0R+J5JlLgPYfq8ZF02IlLZDI0nXea2Q:6i4lZioxufu0R+J5JlLgPbDI0nn2Q
- TLSH T175B47D1379C19431F7720D3004A297F57E7EFE20196AA99B23C8762E5E312C3561AA7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-22_6b129d86f9b509c3cb0d2216f9f468f4_amadey_avoslocker_cobalt-strike_conti_elex_hellokitty_hi.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-22_6b129d86f9b509c3cb0d2216f9f468f4_amadey_avoslocker_cobalt-strike_conti_elex_hellokitty_hi.exe
Resource
win11ltsc2024-20260911-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-22_6b129d86f9b509c3cb0d2216f9f468f4_amadey_avoslocker_cobalt-strike_conti_elex_hellokitty_hijackloader_luca-stealer_lynx_njrat
- Size 496KB
- SHA256 da159dd67041603f1db6a131ba6bebcb6b4d1899e7d03454fd044b60059b309b
- MD5 6b129d86f9b509c3cb0d2216f9f468f4
- SHA1 3cb7a54173c3a834effa8c66e68cc576861c62e9
- SHA512 0b78230ee7a87e1918b486464db0fc2ff76a05c8c1ad7dec2aa6bcc3129048282f02d91bb39f24b624b249d4da3cc587c5daa3e0d026f15ec5b9786061467a85
- SSDEEP 6144:y7WQ0j4ltziolIGlnE2dFDurlBu0R+J5JlLgPYfq8ZF02IlLZDI0nXea2Q:6i4lZioxufu0R+J5JlLgPbDI0nn2Q
- TLSH T175B47D1379C19431F7720D3004A297F57E7EFE20196AA99B23C8762E5E312C3561AA7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE