General
- Target 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader
- Size 556KB
- Sample261014-beh9eswxev
- SHA256 34d6c0e8026902040861c68d8bb4c8057283398ede5d0f9c9f75523049a773dc
- MD5 f519231b5e4d07efe7844ea01a8eb3f6
- SHA1 c49aaea3e75d55a6734eb60ea3d01d4e9c380122
- SHA512 922be897199da8cf00322ff67b373eb66c7d366b4e26538404262cfb61f7ea3864ab1b8bba1c6add8bafff4b3016570407a15f109e8c874be0223fa4bc363773
- SSDEEP 12288:KImGUcsvZZdubv7vJl33Wbgxyn+0KfOVteimHoTfzLogN:KxGBcOlYnnIimHoTfn7N
- TLSH T1BDC49D77A29C2CDCD43F9E3834EBB9D08968B6702319545FAAEB194A06BCF974334543
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win10v2004-20260911-en
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win11ltsc2024-20260911-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-13_f519231b5e4d07efe7844ea01a8eb3f6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader
- Size 556KB
- SHA256 34d6c0e8026902040861c68d8bb4c8057283398ede5d0f9c9f75523049a773dc
- MD5 f519231b5e4d07efe7844ea01a8eb3f6
- SHA1 c49aaea3e75d55a6734eb60ea3d01d4e9c380122
- SHA512 922be897199da8cf00322ff67b373eb66c7d366b4e26538404262cfb61f7ea3864ab1b8bba1c6add8bafff4b3016570407a15f109e8c874be0223fa4bc363773
- SSDEEP 12288:KImGUcsvZZdubv7vJl33Wbgxyn+0KfOVteimHoTfzLogN:KxGBcOlYnnIimHoTfn7N
- TLSH T1BDC49D77A29C2CDCD43F9E3834EBB9D08968B6702319545FAAEB194A06BCF974334543
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Disables taskbar notifications via registry modification
-
Executes dropped EXE
-
Windows security modification
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Defense Evasion
Direct Volume Access
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2