Analysis
- max time kernel
148s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/10/2026, 14:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-19_893ea0a5b2743db75251400f90c46a41_amadey_cobalt-strike_darkgate_elex_hellokitty_luca-stealer_njrat.exe
Resource
win10v2004-20260911-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-19_893ea0a5b2743db75251400f90c46a41_amadey_cobalt-strike_darkgate_elex_hellokitty_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260911-en
1 signatures
150 seconds
General
- Target 2026-10-19_893ea0a5b2743db75251400f90c46a41_amadey_cobalt-strike_darkgate_elex_hellokitty_luca-stealer_njrat.exe
- Size 112KB
- Sample261020-reyxwaz1ex
- SHA256 9edfaf03b7aec8138c8486cd257b2cfd94e8d1c4ae5d72acc45c452c36a6167a
- MD5 893ea0a5b2743db75251400f90c46a41
- SHA1 9bde078030f91231edf6166c675ae45278484efb
- SHA512 51b008e8cb549af07ea3e19935bc6d32283855cac662d242f85411fe57e5a9feb14a0eb5639a27c9e7321e00bc08750753877c2419cfa0e681e4ad9fbf2dc07e
- SSDEEP 3072:djSJ0UVqR6jrjJFI+dA09vOFWPELs/LG/UuJqcatDg+W868F/1:A0MqanEqvTEuLtuJqcat/WnA
- TLSH T1A4B36C0176D1C432D876193554B4DAB24A3EFC300E609E9FA798167A8E703D1963AFBF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_893ea0a5b2743db75251400f90c46a41_amadey_cobalt-strike_darkgate_elex_hellokitty_luca-stealer_njrat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_893ea0a5b2743db75251400f90c46a41_amadey_cobalt-strike_darkgate_elex_hellokitty_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_893ea0a5b2743db75251400f90c46a41_amadey_cobalt-strike_darkgate_elex_hellokitty_luca-stealer_njrat.exe"1⤵
- System Location Discovery: System Language Discovery
PID:5932