2026-09-29_563fad65604ead3c11bdcaf7813dc052_amadey_elex_hellokitty_luca-stealer_njrat_remcos

General

Target
2026-09-29_563fad65604ead3c11bdcaf7813dc052_amadey_elex_hellokitty_luca-stealer_njrat_remcos
Size 1.4MB
Sample260930-a2mppaytgz
SHA256 b9d682fd022c28783843699d838294a8480c77aa8ff676849f8f2b5e5ad098c9
MD5 563fad65604ead3c11bdcaf7813dc052
SHA1 3ea4b75aa474f41a275aaaed61f1cf7099a92589
SHA512 3e12bc477cc29547b876ae289b188f33f5fe7b13903e90f6e57ed21fc9660ba8384d261c9ca4def645d4b066cbcd5749a1c743c3a7892c55c6f469a7d0eec339
SSDEEP 24576:BDB8IpfJ4yL/tNCJPXUQrPgVcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:Bd8IpfJ4klKXnoWkYej15VHW
TLSH
T1E3652341F8D5C4F2C9711E740A64E1A00B3CFEA06B2595776BC229B66FB42D21B78F72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_563fad65604ead3c11bdcaf7813dc052_amadey_elex_hellokitty_luca-stealer_njrat_remcos

File Explorer

2026-09-29_563fad65604ead3c11bdcaf7813dc052_amadey_elex_hellokitty_luca-stealer_njrat_remcos

.exe 1.4MB

2026-09-29_563fad65604ead3c11bdcaf7813dc052_amadey_elex_hellokitty_luca-stealer_njrat_remcos

IMPHASH 6b1178983ac9acc249d832adffa8a151
SHA256 b9d682fd022c28783843699d838294a8480c77aa8ff676849f8f2b5e5ad098c9
MD5 563fad65604ead3c11bdcaf7813dc052
SHA1 3ea4b75aa474f41a275aaaed61f1cf7099a92589
SHA512 3e12bc477cc29547b876ae289b188f33f5fe7b13903e90f6e57ed21fc9660ba8384d261c9ca4def645d4b066cbcd5749a1c743c3a7892c55c6f469a7d0eec339
SSDEEP 24576:BDB8IpfJ4yL/tNCJPXUQrPgVcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:Bd8IpfJ4klKXnoWkYej15VHW
TLSH
T1E3652341F8D5C4F2C9711E740A64E1A00B3CFEA06B2595776BC229B66FB42D21B78F72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8484

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\landun\pinyin_agent\workspace\p-e1ae94d8e66344a7989020677190c8be\src\QQPY6.x\client\Release\QQPYWIN7ToWin10Fix.pdb

kernel32

WriteConsoleW GetModuleHandleW GetProcessHeap GetProcAddress HeapAlloc GetLastError GetSystemDirectoryW GetFileAttributesW WaitForSingleObject FindClose GetCurrentProcess FindNextFileW HeapFree FindFirstFileW DecodePointer FlushFileBuffers SetFilePointerEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RaiseException GetStdHandle WriteFile GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP GetFileType CloseHandle FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetStringTypeW HeapSize HeapReAlloc GetConsoleCP GetConsoleMode CreateFileW

advapi32

AddAccessAllowedAce SetSecurityDescriptorDacl GetSecurityDescriptorDacl RegCloseKey SetFileSecurityW GetAclInformation GetAce EqualSid GetSecurityDescriptorControl AddAce GetFileSecurityW InitializeSecurityDescriptor InitializeAcl RegOpenKeyExW LookupAccountNameW RegQueryValueExW GetLengthSid

shell32

ShellExecuteExW SHGetSpecialFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_563fad65604ead3c11bdcaf7813dc052_amadey_elex_hellokitty_luca-stealer_njrat_remcos

kernel32

advapi32

shell32

generic