2026-09-30_aff131c93de3e7fafbe5e8c40d0a33a9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_aff131c93de3e7fafbe5e8c40d0a33a9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat
Size 421KB
Sample261001-jsas7swfpe
SHA256 72632b05477fbf3b0e10933dab203cc459b2c90040cdc5150df707edf2494b71
MD5 aff131c93de3e7fafbe5e8c40d0a33a9
SHA1 3b1364c63a92bea8f042bbc10aac231486ba736f
SHA512 a5e67fb143b4c6c9e7692b6674e9a574ad91174f8c67bf0c0c4bd0ce8ca2761a62d4882299620631063a3ade3d53bd3bd58c3ecc27024d0ad30a8d919aff8bee
SSDEEP 6144:RBDwcXSXmtdcV2SvU3LQ50VD1Vtr2iBCCqI1X:RBDbX24bQzB21X
TLSH
T157945B1367DC9161E673573108F0E738472CFCB0EFA787EF55943927A622689B920B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_aff131c93de3e7fafbe5e8c40d0a33a9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

File Explorer

2026-09-30_aff131c93de3e7fafbe5e8c40d0a33a9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

.exe 421KB

2026-09-30_aff131c93de3e7fafbe5e8c40d0a33a9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

IMPHASH 4a071c55a717bdbff2ca415ce9326932
SHA256 72632b05477fbf3b0e10933dab203cc459b2c90040cdc5150df707edf2494b71
MD5 aff131c93de3e7fafbe5e8c40d0a33a9
SHA1 3b1364c63a92bea8f042bbc10aac231486ba736f
SHA512 a5e67fb143b4c6c9e7692b6674e9a574ad91174f8c67bf0c0c4bd0ce8ca2761a62d4882299620631063a3ade3d53bd3bd58c3ecc27024d0ad30a8d919aff8bee
SSDEEP 6144:RBDwcXSXmtdcV2SvU3LQ50VD1Vtr2iBCCqI1X:RBDbX24bQzB21X
TLSH
T157945B1367DC9161E673573108F0E738472CFCB0EFA787EF55943927A622689B920B4A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25751

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapAlloc Module32FirstW GetLocalTime GetProcAddress LocalFree GetThreadId ReadProcessMemory GetCurrentProcessId GetProcessHeap GetModuleHandleW WideCharToMultiByte Module32NextW QueryFullProcessImageNameW K32EnumProcessModules CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount GetExitCodeProcess DecodePointer GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx LCMapStringW OpenProcess CreateThread InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo K32GetModuleInformation CloseHandle Process32FirstW QueryPerformanceFrequency TerminateThread SetEvent Process32NextW GetLastError GetTickCount64 Sleep DuplicateHandle UnmapViewOfFile OpenEventW GetFileAttributesW CreateFileW SetInformationJobObject LocalAlloc WaitForSingleObject GetTempPathW CreateJobObjectW K32GetModuleFileNameExW GetProcessId GetModuleFileNameW GetOEMCP GetACP IsValidCodePage FindNextFileW MultiByteToWideChar CreateEventW VirtualProtect CreateToolhelp32Snapshot FindFirstFileExW FindClose GetFileType GetModuleHandleExW ExitProcess GetStdHandle TerminateProcess AssignProcessToJobObject WriteFile GetCurrentProcess GetCommandLineW SetPriorityClass HeapFree RaiseException EncodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW WriteConsoleW

user32

BeginPaint InvalidateRect LoadImageW GetWindowTextW SystemParametersInfoW PostThreadMessageW SetWindowsHookExW LoadCursorW EndPaint UpdateWindow TranslateMessage GetWindowThreadProcessId GetMessageW DefWindowProcW DestroyWindow IsWindowVisible SetWindowPos MessageBoxW FillRect CreateWindowExW CallNextHookEx GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW GetForegroundWindow UnhookWindowsHookEx EnumWindows SetLayeredWindowAttributes

gdi32

SelectObject DeleteObject GetObjectW DeleteDC BitBlt CreateCompatibleBitmap CreateSolidBrush CreateCompatibleDC GetStockObject

advapi32

FreeSid SetKernelObjectSecurity OpenServiceW InitializeAcl InitializeSecurityDescriptor AddAccessDeniedAce AllocateAndInitializeSid OpenSCManagerW CloseServiceHandle SetSecurityDescriptorDacl QueryServiceStatus GetLengthSid

shell32

CommandLineToArgvW

ws2_32

ntohs

iphlpapi

GetAdaptersAddresses GetExtendedTcpTable GetIpForwardTable

wintrust

CryptCATAdminCalcHashFromFileHandle WinVerifyTrust CryptCATAdminReleaseCatalogContext CryptCATAdminReleaseContext CryptCATCatalogInfoFromContext CryptCATAdminAcquireContext CryptCATAdminEnumCatalogFromHash

crypt32

CryptQueryObject CryptMsgClose CryptMsgGetParam CertFindCertificateInStore CertGetNameStringW CertCloseStore CertFreeCertificateContext

ntdll

RtlUnwind

Name

.text

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

236KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

246KB

Virtual Size

245KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_aff131c93de3e7fafbe5e8c40d0a33a9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

kernel32

user32

gdi32

advapi32

shell32

ws2_32

iphlpapi

wintrust

crypt32

ntdll

generic