2026-09-29_31dbafcfb9fabc031c9f94fa90bc7e17_amadey_elex_hellokitty_luca-stealer_manuscrypt_njrat_remcos

General

Target
2026-09-29_31dbafcfb9fabc031c9f94fa90bc7e17_amadey_elex_hellokitty_luca-stealer_manuscrypt_njrat_remcos
Size 1.3MB
Sample260930-d1h7natdkd
SHA256 bcb881468af0b7fa523d1ed6878b2c98b6d89dcd25027869813e2f2d9c1c9a6f
MD5 31dbafcfb9fabc031c9f94fa90bc7e17
SHA1 cb988095a1d442617ab0cd4ff83adf218e96792b
SHA512 97e4dc2b09df321ed95e525c59f526885c7265171478b281f0bf207d9af62d550281aa09ceb10e058962c2b6840bdd01913175eab7368b200fe0493aec01069d
SSDEEP 12288:0ImQySt0SRuIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:0XSt0SRLuTeqGybWZJKSMCxVbT5o8P
TLSH
T13755F11075808830F76A4B3149A5E8E41958DD7C5AE8A9DFF3B87D3A5E740D3A93381F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_31dbafcfb9fabc031c9f94fa90bc7e17_amadey_elex_hellokitty_luca-stealer_manuscrypt_njrat_remcos

File Explorer

2026-09-29_31dbafcfb9fabc031c9f94fa90bc7e17_amadey_elex_hellokitty_luca-stealer_manuscrypt_njrat_remcos

.exe 1.3MB

2026-09-29_31dbafcfb9fabc031c9f94fa90bc7e17_amadey_elex_hellokitty_luca-stealer_manuscrypt_njrat_remcos

IMPHASH 12bd3b1f5fc8c9769bdad31b90226a14
SHA256 bcb881468af0b7fa523d1ed6878b2c98b6d89dcd25027869813e2f2d9c1c9a6f
MD5 31dbafcfb9fabc031c9f94fa90bc7e17
SHA1 cb988095a1d442617ab0cd4ff83adf218e96792b
SHA512 97e4dc2b09df321ed95e525c59f526885c7265171478b281f0bf207d9af62d550281aa09ceb10e058962c2b6840bdd01913175eab7368b200fe0493aec01069d
SSDEEP 12288:0ImQySt0SRuIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:0XSt0SRLuTeqGybWZJKSMCxVbT5o8P
TLSH
T13755F11075808830F76A4B3149A5E8E41958DD7C5AE8A9DFF3B87D3A5E740D3A93381F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

18384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\AWork\_drw_main\SetupUE\Release\SetupUE.pdb

kernel32

GetProcAddress LoadLibraryA GetTimeZoneInformation GetLocaleInfoW GetCommandLineW CloseHandle GetModuleHandleW CreateProcessW GetModuleFileNameW LocalFree WriteConsoleW DecodePointer FlushFileBuffers FreeLibrary GetVersionExW WaitForSingleObject GetSystemInfo SetFilePointerEx GetConsoleMode GetConsoleCP HeapReAlloc HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle WriteFile MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetStringTypeW GetProcessHeap CreateFileW

user32

GetSystemMetrics

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW

shell32

CommandLineToArgvW

netapi32

NetWkstaGetInfo NetApiBufferFree

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_31dbafcfb9fabc031c9f94fa90bc7e17_amadey_elex_hellokitty_luca-stealer_manuscrypt_njrat_remcos

kernel32

user32

advapi32

shell32

netapi32

generic