2026-11-01_aed8e4486239ecf1ca4f6ef39467adc5_amadey_cobalt-strike_elex_expiro_hellokitty_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_aed8e4486239ecf1ca4f6ef39467adc5_amadey_cobalt-strike_elex_expiro_hellokitty_luca-stealer_njrat
Size 765KB
Sample261102-nw7dssbv8l
SHA256 3b361645b616191c7aa15ab1b3f59cb41e731525c8155cb32851640c7bafde89
MD5 aed8e4486239ecf1ca4f6ef39467adc5
SHA1 11f69de4d0d9f423fd1046173dadb73748295259
SHA512 e502f9a439620b7264b32ab805711542edee954de03ca1af9328957a6d2beec95495daf0ccd680bbfbd1060e4050f44199415e201aa54b46092c59675eeb0ee2
SSDEEP 12288:l2cZD0x5hdz7HF9ZBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/npp:lLgx5Hz7HFHBsqjnhMgeiCl7G0nehbGT
TLSH
T1E2F4F19171818071D4B564F222D4D27DB729FD5C1B3C0BF3E7B436AEAE346E08A39266
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_aed8e4486239ecf1ca4f6ef39467adc5_amadey_cobalt-strike_elex_expiro_hellokitty_luca-stealer_njrat

File Explorer

2026-11-01_aed8e4486239ecf1ca4f6ef39467adc5_amadey_cobalt-strike_elex_expiro_hellokitty_luca-stealer_njrat

.exe 765KB

2026-11-01_aed8e4486239ecf1ca4f6ef39467adc5_amadey_cobalt-strike_elex_expiro_hellokitty_luca-stealer_njrat

IMPHASH aac6c75964be60f59222afed6d4406a7
SHA256 3b361645b616191c7aa15ab1b3f59cb41e731525c8155cb32851640c7bafde89
MD5 aed8e4486239ecf1ca4f6ef39467adc5
SHA1 11f69de4d0d9f423fd1046173dadb73748295259
SHA512 e502f9a439620b7264b32ab805711542edee954de03ca1af9328957a6d2beec95495daf0ccd680bbfbd1060e4050f44199415e201aa54b46092c59675eeb0ee2
SSDEEP 12288:l2cZD0x5hdz7HF9ZBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/npp:lLgx5Hz7HFHBsqjnhMgeiCl7G0nehbGT
TLSH
T1E2F4F19171818071D4B564F222D4D27DB729FD5C1B3C0BF3E7B436AEAE346E08A39266
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\_work\1\s\bin\Release\CoreDebugger\x86\VsDebugConsole.pdb

kernel32

HeapReAlloc HeapSize LocalAlloc WideCharToMultiByte GetEnvironmentVariableW GetProcessHeap EnterCriticalSection LeaveCriticalSection CloseHandle CreateEventW OpenEventW ResetEvent SetEvent SetConsoleTitleW GetConsoleTitleW Sleep GetConsoleWindow QueueUserWorkItem Wow64DisableWow64FsRedirection CreateProcessW Wow64RevertWow64FsRedirection ReadConsoleInputW GetStdHandle WriteFile GetConsoleOutputCP FlushConsoleInputBuffer ReadFile GetOverlappedResult PeekNamedPipe GetConsoleProcessList OpenProcess WaitForMultipleObjects FlushFileBuffers DisconnectNamedPipe GetNumberOfConsoleInputEvents GetExitCodeProcess GetCurrentProcess IsDebuggerPresent SetConsoleCtrlHandler CreateNamedPipeW ConnectNamedPipe SizeofResource LockResource LoadResource FindResourceExW FindResourceW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind HeapAlloc SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetCommandLineA GetCommandLineW GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW WaitForSingleObject GetFileAttributesExW CreateFileW GetConsoleMode PeekConsoleInputA SetStdHandle FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW GetStringTypeW GetFileSizeEx SetFilePointerEx WriteConsoleW HeapFree HeapDestroy DeleteCriticalSection DecodePointer GetLastError RaiseException InitializeCriticalSectionEx

user32

ShowWindow FindWindowW GetWindowPlacement GetWindowLongW SetForegroundWindow

advapi32

OpenProcessToken AllocateAndInitializeSid SetEntriesInAclW InitializeSecurityDescriptor SetSecurityDescriptorDacl GetTokenInformation

ole32

CoCreateGuid StringFromGUID2

oleaut32

SysAllocStringLen SysFreeString

Name

.text

Size

107KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_aed8e4486239ecf1ca4f6ef39467adc5_amadey_cobalt-strike_elex_expiro_hellokitty_luca-stealer_njrat

kernel32

user32

advapi32

ole32

oleaut32

generic