2026-10-22_0cafc58c605e7e6687282d5f599ea427_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_0cafc58c605e7e6687282d5f599ea427_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play
Size 181KB
Sample261024-1wmevaxtb1
SHA256 b7d7e8867c746aac14e87b2b54e7194e6ed126534b774a3ee13cf53515178428
MD5 0cafc58c605e7e6687282d5f599ea427
SHA1 fb7431a192b1eb64253f616af3c4895aef126dcb
SHA512 ab2bc2ff7dfb37f25c274c4e609e2bbe5f4e9f1fd7ed618a76b5c3ef8c7aa48ba696eef4661fdba516df19f2647e6efd199206031c55464f0c66a7c4a4cd310f
SSDEEP 3072:ELWcYNSv/auU8L9I4RgiNZUZb5KTyJQ0HDlBcpmFuTqqDRURtemAHaQCgWXWUZ:ELWcYNSn5LRJN25lQ2zcEEqJTRDm2
TLSH
T159047D60B5D0C433E963053068B4EBB6AA2DF9701FA499C7738807BD4F706E15A39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-22_0cafc58c605e7e6687282d5f599ea427_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play

.exe 181KB

2026-10-22_0cafc58c605e7e6687282d5f599ea427_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play

IMPHASH f077403829d37333900478020a86b320
SHA256 b7d7e8867c746aac14e87b2b54e7194e6ed126534b774a3ee13cf53515178428
MD5 0cafc58c605e7e6687282d5f599ea427
SHA1 fb7431a192b1eb64253f616af3c4895aef126dcb
SHA512 ab2bc2ff7dfb37f25c274c4e609e2bbe5f4e9f1fd7ed618a76b5c3ef8c7aa48ba696eef4661fdba516df19f2647e6efd199206031c55464f0c66a7c4a4cd310f
SSDEEP 3072:ELWcYNSv/auU8L9I4RgiNZUZb5KTyJQ0HDlBcpmFuTqqDRURtemAHaQCgWXWUZ:ELWcYNSn5LRJN25lQ2zcEEqJTRDm2
TLSH
T159047D60B5D0C433E963053068B4EBB6AA2DF9701FA499C7738807BD4F706E15A39B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

74:5b:41:26:f1:0b:d4:df:b1:5b:c6:d1:02:de:92:d9:6a:dc:44:37:03:b1:a0:2d:fc:4c:4e:fa:92:a1:cd:51

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Chains

Apr 23, 2026

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

e8:d9:66:fa:c8:32:8a:24:e0:39:2b:ca:d3:56:6a:ea:ac:de:dc:49

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Chains

Apr 23, 2026

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Serial Number

0f:52:f2:95:33:ee:ba:d4:11:50:36:79:4e:e1:07:4f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 18, 2024 - Oct 17, 2027

Minor OS version

Major OS version

Entry point

44704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\pub_18tol\master_kso_v12\Build\Release\WPSOffice\office6\kvprinter\kvpet.pdb

kernel32

GetCommandLineW GetTempPathW CloseHandle GetLastError SetLastError HeapAlloc HeapReAlloc HeapFree GetProcessHeap WaitForSingleObject Sleep CreateThread TerminateThread GetExitCodeThread GetSystemDirectoryW VirtualQuery MapViewOfFile UnmapViewOfFile GetSystemWow64DirectoryW FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryW LocalFree MultiByteToWideChar WideCharToMultiByte GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetWindowsDirectoryW IsWow64Process RaiseException GetSystemInfo CreateFileW IsDebuggerPresent IsValidCodePage HeapSize DecodePointer InitializeCriticalSectionAndSpinCount DeleteCriticalSection VirtualProtect LoadLibraryExA OutputDebugStringW EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess RtlUnwind EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetFileType FindClose FindFirstFileExW FindNextFileW GetACP GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW LCMapStringW SetFilePointerEx FlushFileBuffers GetConsoleCP GetConsoleMode WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_0cafc58c605e7e6687282d5f599ea427_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play

kernel32

generic