2026-10-22_27494f2fde70d7afd8d967063e54e6b7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_27494f2fde70d7afd8d967063e54e6b7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat
Size 495KB
Sample261024-xaxrxafe45
SHA256 6c60e511e736548fc34f660898ab0bf79bbcce080a0f5611d84f4c5e55a5ef0e
MD5 27494f2fde70d7afd8d967063e54e6b7
SHA1 20b79685f644fb5d22094d3852da6bd963bfad88
SHA512 2fe409f31342eef93964c15804293df5d80cccb9e5ede11d9889be11c509c6080c3d4c6325cce40c87ae21c2292087fddccc502d3a92339ea09be3a276809847
SSDEEP 12288:Q3r1lcCH1x/Rvcr0+u0ZMz4V0zz/zz3zzDzzpzzzUzzJgzzzzzzzzzzzzzzzzzzb:Q3sCHj/qr0+u1a0zz/zz3zzDzzpzzzUm
TLSH
T15EB48EC2A995C962FC2D0A3320B85C12213BBD7ED5947E5EAEC4707219F3282717796F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_27494f2fde70d7afd8d967063e54e6b7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

File Explorer

2026-10-22_27494f2fde70d7afd8d967063e54e6b7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

.exe 495KB

2026-10-22_27494f2fde70d7afd8d967063e54e6b7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

IMPHASH c46619bc412ffd0ab9380fbd99011bbb
SHA256 6c60e511e736548fc34f660898ab0bf79bbcce080a0f5611d84f4c5e55a5ef0e
MD5 27494f2fde70d7afd8d967063e54e6b7
SHA1 20b79685f644fb5d22094d3852da6bd963bfad88
SHA512 2fe409f31342eef93964c15804293df5d80cccb9e5ede11d9889be11c509c6080c3d4c6325cce40c87ae21c2292087fddccc502d3a92339ea09be3a276809847
SSDEEP 12288:Q3r1lcCH1x/Rvcr0+u0ZMz4V0zz/zz3zzDzzpzzzUzzJgzzzzzzzzzzzzzzzzzzb:Q3sCHj/qr0+u1a0zz/zz3zzDzzpzzzUm
TLSH
T15EB48EC2A995C962FC2D0A3320B85C12213BBD7ED5947E5EAEC4707219F3282717796F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

243960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\all\jin\ycx\Release\ycx.pdb

kernel32

DecodePointer Sleep CreateMutexA GetModuleFileNameA CloseHandle GetLastError lstrcmpA GetCurrentProcess WriteConsoleW CreateFileW HeapReAlloc HeapSize SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetProcessHeap GetStringTypeW MultiByteToWideChar WideCharToMultiByte LocalFree UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW HeapAlloc HeapFree CompareStringW LCMapStringW GetFileType GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetModuleFileNameW GetModuleHandleA LoadLibraryA LocalAlloc LocalFree GetModuleFileNameA ExitProcess

advapi32

OpenProcessToken BuildExplicitAccessWithNameA SetEntriesInAclA AdjustTokenPrivileges RegCloseKey RegGetValueA RegQueryValueExA SetNamedSecurityInfoA LookupPrivilegeValueA RegEnumKeyExA RegOpenKeyExA LookupAccountNameA GetNamedSecurityInfoA

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx CoUninitialize

oleaut32

VariantClear SysFreeString SysAllocString

ws2_32

gethostbyname WSAStartup WSACleanup inet_ntoa

Name

.text

Size

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.asp0

Size

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.asp1

Size

266KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

215KB

Virtual Size

214KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_27494f2fde70d7afd8d967063e54e6b7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

kernel32

advapi32

ole32

oleaut32

ws2_32

generic