2026-10-22_9fd5b0b9ad444dcf4d3c748735d48ba6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_9fd5b0b9ad444dcf4d3c748735d48ba6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat
Size 487KB
Sample261024-c4n2msfs9v
SHA256 07f5bee626869f1ae523a07f7c0a1a7168774604cab1b650b5c890899e56731c
MD5 9fd5b0b9ad444dcf4d3c748735d48ba6
SHA1 37efc7468f10874becd2a116e8ba60cc792d02af
SHA512 99142e38f117e30adf8043d6331a47a7de004d45326cf6ffb2f9fe53065535a4093744a71240e016ea049ca752b52ce4bf4de8a357e1e53f584fe69e2f0c6711
SSDEEP 12288:Q3r1lcCH1x/Rvcr0+u0ZMz4V0zz/zz3zzDzzpzzzUzzJgzzzzzzzzzzzzzzzzzzZ:Q3sCHj/qr0+u1a0zz/zz3zzDzzpzzzUU
TLSH
T185B48DC2A995C961F83D0A3320B85C12213BBD7ED5947E5EAEC4707219F32827177A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_9fd5b0b9ad444dcf4d3c748735d48ba6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

File Explorer

2026-10-22_9fd5b0b9ad444dcf4d3c748735d48ba6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

.exe 487KB

2026-10-22_9fd5b0b9ad444dcf4d3c748735d48ba6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

IMPHASH c46619bc412ffd0ab9380fbd99011bbb
SHA256 07f5bee626869f1ae523a07f7c0a1a7168774604cab1b650b5c890899e56731c
MD5 9fd5b0b9ad444dcf4d3c748735d48ba6
SHA1 37efc7468f10874becd2a116e8ba60cc792d02af
SHA512 99142e38f117e30adf8043d6331a47a7de004d45326cf6ffb2f9fe53065535a4093744a71240e016ea049ca752b52ce4bf4de8a357e1e53f584fe69e2f0c6711
SSDEEP 12288:Q3r1lcCH1x/Rvcr0+u0ZMz4V0zz/zz3zzDzzpzzzUzzJgzzzzzzzzzzzzzzzzzzZ:Q3sCHj/qr0+u1a0zz/zz3zzDzzpzzzUU
TLSH
T185B48DC2A995C961F83D0A3320B85C12213BBD7ED5947E5EAEC4707219F32827177A6F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

243960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\all\jin\ycx\Release\ycx.pdb

kernel32

DecodePointer Sleep CreateMutexA GetModuleFileNameA CloseHandle GetLastError lstrcmpA GetCurrentProcess WriteConsoleW CreateFileW HeapReAlloc HeapSize SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetProcessHeap GetStringTypeW MultiByteToWideChar WideCharToMultiByte LocalFree UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW HeapAlloc HeapFree CompareStringW LCMapStringW GetFileType GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetModuleFileNameW GetModuleHandleA LoadLibraryA LocalAlloc LocalFree GetModuleFileNameA ExitProcess

advapi32

OpenProcessToken BuildExplicitAccessWithNameA SetEntriesInAclA AdjustTokenPrivileges RegCloseKey RegGetValueA RegQueryValueExA SetNamedSecurityInfoA LookupPrivilegeValueA RegEnumKeyExA RegOpenKeyExA LookupAccountNameA GetNamedSecurityInfoA

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx CoUninitialize

oleaut32

VariantClear SysFreeString SysAllocString

ws2_32

gethostbyname WSAStartup WSACleanup inet_ntoa

Name

.text

Size

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.asp0

Size

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.asp1

Size

266KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

215KB

Virtual Size

214KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_9fd5b0b9ad444dcf4d3c748735d48ba6_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

kernel32

advapi32

ole32

oleaut32

ws2_32

generic