Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 23:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-03_3d2685dfbff9bba6f298eb56b0e0413b_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
Resource
win10v2004-20260911-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-03_3d2685dfbff9bba6f298eb56b0e0413b_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
Resource
win11ltsc2024-20260911-en
1 signatures
150 seconds
General
- Target 2026-11-03_3d2685dfbff9bba6f298eb56b0e0413b_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
- Size 1.7MB
- Sample261104-24dckseh66
- SHA256 2e885262b49ae4e56a9c396f860376fbc74d97cf1cea36d0742c751f7fee6170
- MD5 3d2685dfbff9bba6f298eb56b0e0413b
- SHA1 08f641a091e52c8e9ca309777130495b0b2ed354
- SHA512 1ebb83528fa92c4be1160553eba7cc6e8fc38f27d975fdd5338b642f98ceba8fc981bac17d3c17c5f2f694533c59fc88be51fd0bf7bd628137ef66183e5e0a72
- SSDEEP 3072:zwRPKV/q3WFlJpNCvJcbrvuXwyFWU/066vfM9fYrd1INAzmyJtFVpK:zwRPKhqG1XC2baA5xvrrDSuT
- TLSH T110855A1075E1CC72E4E7043118F8EBB559BDFA713B7299EB638407393E206D25A34A6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-03_3d2685dfbff9bba6f298eb56b0e0413b_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-03_3d2685dfbff9bba6f298eb56b0e0413b_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_3d2685dfbff9bba6f298eb56b0e0413b_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4840