2026-10-28_9fa3ea2cc0c3c6bd83b3a0d2f2108e86_amadey_elex_hellokitty_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_9fa3ea2cc0c3c6bd83b3a0d2f2108e86_amadey_elex_hellokitty_luca-stealer_njrat
Size 1.3MB
Sample261029-2amn6agw9m
SHA256 2ad17b59eec38de53e1d3d9c6a687427e228e0a7c657a8db953f8ebaa0a7f5e3
MD5 9fa3ea2cc0c3c6bd83b3a0d2f2108e86
SHA1 bf0d91ea19ce062d1ecdd6dcdc1f83b32399284b
SHA512 919f828cc81c17af39d3cb046f4f458bb5da7174e7116b6107aba763bdc9f7e9a91dc377779fd3c3cd8294592e571b3d57bbe3ec1f3d7fde4dd5ecf31044bffa
SSDEEP 12288:huu7D1Dtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:NnRdZjHhQ6giafmvJW5
TLSH
T1C8551202B5D1C0B2E5B2153409B4EBB54B7EFCB04F200E9BA7982DB64E751D06E25E7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_9fa3ea2cc0c3c6bd83b3a0d2f2108e86_amadey_elex_hellokitty_luca-stealer_njrat

File Explorer

2026-10-28_9fa3ea2cc0c3c6bd83b3a0d2f2108e86_amadey_elex_hellokitty_luca-stealer_njrat

.exe 1.3MB

2026-10-28_9fa3ea2cc0c3c6bd83b3a0d2f2108e86_amadey_elex_hellokitty_luca-stealer_njrat

IMPHASH da25ce0361884e3f489a2a04f7d3a139
SHA256 2ad17b59eec38de53e1d3d9c6a687427e228e0a7c657a8db953f8ebaa0a7f5e3
MD5 9fa3ea2cc0c3c6bd83b3a0d2f2108e86
SHA1 bf0d91ea19ce062d1ecdd6dcdc1f83b32399284b
SHA512 919f828cc81c17af39d3cb046f4f458bb5da7174e7116b6107aba763bdc9f7e9a91dc377779fd3c3cd8294592e571b3d57bbe3ec1f3d7fde4dd5ecf31044bffa
SSDEEP 12288:huu7D1Dtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:NnRdZjHhQ6giafmvJW5
TLSH
T1C8551202B5D1C0B2E5B2153409B4EBB54B7EFCB04F200E9BA7982DB64E751D06E25E7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10896

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\home\jenkins\agent\workspace\sfip\BAAS\code\services\AMTSW\Release\MEWMIProv\WMIRegistrationService\Release\WMIRegistrationService.pdb

advapi32

RegisterEventSourceW ReportEventW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW DeregisterEventSource

kernel32

WaitForSingleObject CreateEventW GetExitCodeProcess QueueUserWorkItem GetModuleFileNameW SetEvent RegisterWaitForSingleObject UnregisterWait CreateFileW DecodePointer GetLastError CloseHandle OutputDebugStringW GetConsoleMode SetDefaultDllDirectories GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RaiseException RtlUnwind SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW CompareStringW LCMapStringW GetProcessHeap WriteConsoleW

shell32

SHGetKnownFolderPath ShellExecuteExW

ole32

CoTaskMemFree

shlwapi

PathFileExistsW

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_9fa3ea2cc0c3c6bd83b3a0d2f2108e86_amadey_elex_hellokitty_luca-stealer_njrat

advapi32

kernel32

shell32

ole32

shlwapi

api-ms-win-core-path-l1-1-0

generic