2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play
Size 1.4MB
Sample261104-28tkcsgt7j
SHA256 64436ba1b4061ea153d82ba997692636d822f030f66cc570e93d8841d2711c40
MD5 3bdc1aa0fbc69c3d6058d31ab7c4dae7
SHA1 b9db35735b6cecce2704e1a6eeb08226afe61d3f
SHA512 4e0d28a64a3ab9e3f8c8a22ffbebb8b22b73bb37542fe4021168a937263a0b005b679daac01158c555d19301f4145e0b7b9075f862c2fb84905d103762aeb862
SSDEEP 24576:0iqiwYI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0iqihILNiXicJFFRGNzj3
TLSH
T16665026271C084B2EAB704350AB49670AA7DFD715F2448DBA3543B6E9A30BD0CE38773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play

File Explorer

2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play

.exe 1.4MB

2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play

IMPHASH fbd1e86ea8cf4d2116ac788e2570a9cb
SHA256 64436ba1b4061ea153d82ba997692636d822f030f66cc570e93d8841d2711c40
MD5 3bdc1aa0fbc69c3d6058d31ab7c4dae7
SHA1 b9db35735b6cecce2704e1a6eeb08226afe61d3f
SHA512 4e0d28a64a3ab9e3f8c8a22ffbebb8b22b73bb37542fe4021168a937263a0b005b679daac01158c555d19301f4145e0b7b9075f862c2fb84905d103762aeb862
SSDEEP 24576:0iqiwYI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0iqihILNiXicJFFRGNzj3
TLSH
T16665026271C084B2EAB704350AB49670AA7DFD715F2448DBA3543B6E9A30BD0CE38773
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

34688

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\T\CBT_Main\BuildResults\bin\Win32\Release\armsvc.pdb

kernel32

lstrcmpiW lstrcmpW LoadLibraryExW WritePrivateProfileStringW HeapFree GetCurrentProcess HeapSize GetPrivateProfileStringW GetFileInformationByHandle GetCurrentThread HeapReAlloc HeapAlloc HeapDestroy GetProcessHeap FormatMessageW GetLocalTime GetFileSize CopyFileW SetCurrentDirectoryW GetSystemWindowsDirectoryW SetDllDirectoryW GetVolumeInformationW OpenFileMappingW UnmapViewOfFile Sleep CreateFileMappingW MapViewOfFile VirtualQuery GetSystemInfo WriteConsoleW GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileSizeEx FreeLibrary GetModuleHandleW DeleteCriticalSection LocalFree GetProcAddress DecodePointer FindResourceW LoadResource RaiseException CloseHandle DeleteFileW GetLastError GetTickCount64 MultiByteToWideChar lstrcmpA GetCurrentThreadId GetFileAttributesW CreateFileW LocalAlloc FindClose InitializeCriticalSectionEx GetTempPathW SetFilePointer GetModuleFileNameW RemoveDirectoryW WriteFile lstrlenW FindNextFileW CreateDirectoryW FindFirstFileW SizeofResource ReadFile FlushFileBuffers GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW LCMapStringW VirtualProtect IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LoadLibraryExA

user32

CharNextW DispatchMessageW LoadStringW GetMessageW PostThreadMessageW

advapi32

InitializeSid GetSidSubAuthority GetSidLengthRequired CopySid IsValidSid OpenProcessToken CheckTokenMembership DuplicateToken GetLengthSid OpenThreadToken DeregisterEventSource CreateServiceW RegCloseKey RegQueryInfoKeyW CloseServiceHandle OpenSCManagerW RegDeleteKeyW SetServiceStatus RegCreateKeyExW DeleteService RegisterServiceCtrlHandlerW ControlService RegEnumKeyExW RegSetValueExW RegOpenKeyExW StartServiceCtrlDispatcherW RegDeleteValueW OpenServiceW ConvertStringSecurityDescriptorToSecurityDescriptorW RegisterEventSourceW ReportEventW RegQueryValueExW

shell32

SHCreateDirectoryExW SHGetFolderPathW ShellExecuteExW

ole32

CoCreateInstance CoRegisterClassObject CoTaskMemFree CoInitialize CoTaskMemAlloc StringFromGUID2 CoRevokeClassObject CoTaskMemRealloc CoUninitialize

oleaut32

VarUI4FromStr UnRegisterTypeLi LoadTypeLi SysFreeString RegisterTypeLi SysAllocString SysStringLen

shlwapi

PathGetCharTypeW

Name

.text

Size

107KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

generic