2026-10-01_7f2308a4aec1802c7e05d7682a8236c3_amadey_elex_hellokitty_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_7f2308a4aec1802c7e05d7682a8236c3_amadey_elex_hellokitty_luca-stealer_njrat
Size 1.3MB
Sample261002-mmscvazyet
SHA256 38ee56bc472e0f97d3b9b101942bf594f3ee624b61b451e66fa6e4227e5a9644
MD5 7f2308a4aec1802c7e05d7682a8236c3
SHA1 e3e5e4043ce51665feaa2895ab23ebd1835d113d
SHA512 f04f0eb2b60b5938fca6e682844778294bef79359d101fcedd27378b3a3189eaf9caf1de93f291bd59e9c3d0e4f63e1e39df49dc78da459efb879fcc40fce1e9
SSDEEP 12288:uvV7upUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8d:2apatr0zAiX90z/F0jsFB3SQkC
TLSH
T1AB55120234C5C0F2D8A31A3509A4DAA25A7DFD701BA19EDBA3843E7F4E345C15935EBB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_7f2308a4aec1802c7e05d7682a8236c3_amadey_elex_hellokitty_luca-stealer_njrat

File Explorer

2026-10-01_7f2308a4aec1802c7e05d7682a8236c3_amadey_elex_hellokitty_luca-stealer_njrat

.exe 1.3MB

2026-10-01_7f2308a4aec1802c7e05d7682a8236c3_amadey_elex_hellokitty_luca-stealer_njrat

IMPHASH a47085e8acf72a5536a475c07003df65
SHA256 38ee56bc472e0f97d3b9b101942bf594f3ee624b61b451e66fa6e4227e5a9644
MD5 7f2308a4aec1802c7e05d7682a8236c3
SHA1 e3e5e4043ce51665feaa2895ab23ebd1835d113d
SHA512 f04f0eb2b60b5938fca6e682844778294bef79359d101fcedd27378b3a3189eaf9caf1de93f291bd59e9c3d0e4f63e1e39df49dc78da459efb879fcc40fce1e9
SSDEEP 12288:uvV7upUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8d:2apatr0zAiX90z/F0jsFB3SQkC
TLSH
T1AB55120234C5C0F2D8A31A3509A4DAA25A7DFD701BA19EDBA3843E7F4E345C15935EBB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10896

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Intel\Developer\8819\p4\989747040\services\AMTSW\Release\MEWMIProv\WMIRegistrationService\Release\WMIRegistrationService.pdb

shlwapi

PathFileExistsW

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec

kernel32

SetEvent WaitForSingleObject CreateEventW GetExitCodeProcess QueueUserWorkItem GetModuleFileNameW SetDefaultDllDirectories GetLastError UnregisterWait GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize CloseHandle OutputDebugStringW DecodePointer CreateFileW RegisterWaitForSingleObject TlsAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RaiseException RtlUnwind SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount WriteConsoleW TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW CompareStringW LCMapStringW GetProcessHeap SetFilePointerEx

shell32

SHGetKnownFolderPath ShellExecuteExW

ole32

CoTaskMemFree

advapi32

SetServiceStatus RegisterServiceCtrlHandlerExW ReportEventW RegisterEventSourceW DeregisterEventSource StartServiceCtrlDispatcherW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_7f2308a4aec1802c7e05d7682a8236c3_amadey_elex_hellokitty_luca-stealer_njrat

shlwapi

api-ms-win-core-path-l1-1-0

kernel32

shell32

ole32

advapi32

generic