General
- Target 2026-09-25_dda666eac68b510f7875c62e476a1990_amadey_cobalt-strike_coinminer_conti_elex_hellokitty_hijackloader_luca-stealer_njrat
- Size 642KB
- Sample260925-xbhdlsvs9m
- SHA256 4d4c79c25198531627955f89417c8deba7b6fd1913d7b00fafefe50760ccb916
- MD5 dda666eac68b510f7875c62e476a1990
- SHA1 f642f23faabbb19f1fd58275b3bec5121217b069
- SHA512 62a433c0684e8ad5419ed94de3cf1e490c200c5689d2cd277d56908ae34ae7b9f35fc8ba6ccf69e05ed8ebad945f0b65234bc493051cc02855185beff3ec23b1
- SSDEEP 6144:I7WQ0j4ltziolIGlnE2vpIrlBu0R+J5JlLgPYfq8ZF02IlLZD3P01netR82:gi4lZioDIfu0R+J5JlLgPbDf0192
- TLSH T1F8E46C1379C18431F7720E3404A297F5AE7EFD70196AA95B23C8762E1E312C3561AA7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-09-25_dda666eac68b510f7875c62e476a1990_amadey_cobalt-strike_coinminer_conti_elex_hellokitty_hij.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-25_dda666eac68b510f7875c62e476a1990_amadey_cobalt-strike_coinminer_conti_elex_hellokitty_hijackloader_luca-stealer_njrat
- Size 642KB
- SHA256 4d4c79c25198531627955f89417c8deba7b6fd1913d7b00fafefe50760ccb916
- MD5 dda666eac68b510f7875c62e476a1990
- SHA1 f642f23faabbb19f1fd58275b3bec5121217b069
- SHA512 62a433c0684e8ad5419ed94de3cf1e490c200c5689d2cd277d56908ae34ae7b9f35fc8ba6ccf69e05ed8ebad945f0b65234bc493051cc02855185beff3ec23b1
- SSDEEP 6144:I7WQ0j4ltziolIGlnE2vpIrlBu0R+J5JlLgPYfq8ZF02IlLZD3P01netR82:gi4lZioDIfu0R+J5JlLgPbDf0192
- TLSH T1F8E46C1379C18431F7720E3404A297F5AE7EFD70196AA95B23C8762E1E312C3561AA7F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE