2026-10-02_1d1a75469845081940756f8773e86dbb_amadey_elex_hellokitty_luca-stealer_njrat_remcos_smoke-loader

General

Target
2026-10-02_1d1a75469845081940756f8773e86dbb_amadey_elex_hellokitty_luca-stealer_njrat_remcos_smoke-loader
Size 4.2MB
Sample261003-twftqsts4n
SHA256 0b24ea14febb7998fb03a39e05d673eb3cd16e8aba942d9a85762466043d07e6
MD5 1d1a75469845081940756f8773e86dbb
SHA1 32e82087c0877404da3c8cadb6c3f266c5ce17eb
SHA512 7aed6d1fbeeb4df7d58bc23ccf91f56c028e1daa2cba2139312e760d3a0ce7cf527fe7e0ef1458800ee60152bc869c7debd8052bd3323ac86a0e0707d4dba101
SSDEEP 98304:N2bL0zSZHlNBZZjBUDwUZtLCtTv48guZSnSIwvKEoDXi:N+L9FrqwUbmQ6BCEobi
TLSH
T1B516335275A091B1E737593099F5827B6D3EBC268FA58A8763C8037D1A364C2FB11F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_1d1a75469845081940756f8773e86dbb_amadey_elex_hellokitty_luca-stealer_njrat_remcos_smoke-loader

File Explorer

2026-10-02_1d1a75469845081940756f8773e86dbb_amadey_elex_hellokitty_luca-stealer_njrat_remcos_smoke-loader

.exe 4.2MB

2026-10-02_1d1a75469845081940756f8773e86dbb_amadey_elex_hellokitty_luca-stealer_njrat_remcos_smoke-loader

IMPHASH bcf80497fe587a3956d64dc513da9548
SHA256 0b24ea14febb7998fb03a39e05d673eb3cd16e8aba942d9a85762466043d07e6
MD5 1d1a75469845081940756f8773e86dbb
SHA1 32e82087c0877404da3c8cadb6c3f266c5ce17eb
SHA512 7aed6d1fbeeb4df7d58bc23ccf91f56c028e1daa2cba2139312e760d3a0ce7cf527fe7e0ef1458800ee60152bc869c7debd8052bd3323ac86a0e0707d4dba101
SSDEEP 98304:N2bL0zSZHlNBZZjBUDwUZtLCtTv48guZSnSIwvKEoDXi:N+L9FrqwUbmQ6BCEobi
TLSH
T1B516335275A091B1E737593099F5827B6D3EBC268FA58A8763C8037D1A364C2FB11F23
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

43787

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ana\code\Squirrel\Squirrel.Windows\src\Setup\bin\Release\Setup.pdb

kernel32

LoadResource FindResourceW lstrlenW GetProcAddress GetModuleHandleW DeleteCriticalSection GetTempPathW GetLastError GetTempFileNameW MoveFileW WaitForSingleObject GetExitCodeProcess CloseHandle DeleteFileW GetModuleFileNameW GetCurrentProcess LoadLibraryW FreeLibrary InitializeCriticalSectionEx GetFileAttributesW CreateFileW SetFilePointer ReadFile VerSetConditionMask GetCurrentDirectoryW MultiByteToWideChar LocalFileTimeToFileTime WideCharToMultiByte CreateDirectoryW WriteFile SetFileTime FreeResource SizeofResource LockResource CreateProcessW GetSystemDirectoryW SetDefaultDllDirectories GetCurrentThreadId DecodePointer RaiseException LeaveCriticalSection EnterCriticalSection lstrcmpiW LoadLibraryExW SetFilePointerEx GetConsoleMode GetConsoleCP SystemTimeToFileTime VerifyVersionInfoW GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA IsDebuggerPresent OutputDebugStringW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle GetACP HeapFree HeapAlloc GetFileType CompareStringW LCMapStringW HeapSize HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW FlushFileBuffers WriteConsoleW

shlwapi

PathIsUNCW

comctl32

InitCommonControlsEx

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_1d1a75469845081940756f8773e86dbb_amadey_elex_hellokitty_luca-stealer_njrat_remcos_smoke-loader

kernel32

shlwapi

comctl32

generic