2026-10-01_41bc6c5fddd190c6b6976c4685982134_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

General

Target
2026-10-01_41bc6c5fddd190c6b6976c4685982134_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat
Size 778KB
Sample261002-tefgmswbre
SHA256 f335d6f114ab9edfae314070cd8c8357e279b8d48a2b0f01506bcf9a3a51cba1
MD5 41bc6c5fddd190c6b6976c4685982134
SHA1 c16c67e273568c680f43ba95936d46bfb4787f13
SHA512 46a4f27a1a2ebb359bf88c53890335a15c610d93677e02eccb39a135628d5642b50e977efe6135c9f8d310e6b73b6c219eb5a51ecec054c0b6e2b42f497b0355
SSDEEP 24576:CPMU0YNM+zhkJZXYGbwinaJK5mlz776UfiP:CPMdD+KJZhbww6z776rP
TLSH
T1A1050105F6DCBCFAD02A94301934C2F15939FC756A90A45FA3E13B262E34693FA19937
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_41bc6c5fddd190c6b6976c4685982134_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

File Explorer

2026-10-01_41bc6c5fddd190c6b6976c4685982134_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

.exe 778KB

2026-10-01_41bc6c5fddd190c6b6976c4685982134_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

IMPHASH 8d44eb44f1d03b5cffc3a966d5470916
SHA256 f335d6f114ab9edfae314070cd8c8357e279b8d48a2b0f01506bcf9a3a51cba1
MD5 41bc6c5fddd190c6b6976c4685982134
SHA1 c16c67e273568c680f43ba95936d46bfb4787f13
SHA512 46a4f27a1a2ebb359bf88c53890335a15c610d93677e02eccb39a135628d5642b50e977efe6135c9f8d310e6b73b6c219eb5a51ecec054c0b6e2b42f497b0355
SSDEEP 24576:CPMU0YNM+zhkJZXYGbwinaJK5mlz776UfiP:CPMdD+KJZhbww6z776rP
TLSH
T1A1050105F6DCBCFAD02A94301934C2F15939FC756A90A45FA3E13B262E34693FA19937
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

7327

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\1\b\bin\win32\venvwlauncher.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

WriteConsoleW SetEndOfFile LeaveCriticalSection HeapReAlloc GetStartupInfoW SetConsoleCtrlHandler SetInformationJobObject QueryInformationJobObject GetCommandLineW GetCurrentProcess GetStdHandle AssignProcessToJobObject GetModuleFileNameW SetEnvironmentVariableW GetEnvironmentVariableW GetFileAttributesW DuplicateHandle MultiByteToWideChar FormatMessageW GetLastError WaitForSingleObjectEx CloseHandle CreateJobObjectA CreateProcessW GetExitCodeProcess HeapSize CreateFileW SetFilePointerEx GetFileSizeEx GetProcessHeap UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlUnwind SetLastError EnterCriticalSection DecodePointer DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException ExitProcess GetModuleHandleExW GetCommandLineA WriteFile HeapFree HeapAlloc GetFileType LCMapStringW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetStringTypeW ReadFile ReadConsoleW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle

user32

MessageBoxW PostMessageA GetMessageA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_41bc6c5fddd190c6b6976c4685982134_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

version

kernel32

user32

generic