2026-11-03_5803ee933a34cff20206c825ab76108b_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_5803ee933a34cff20206c825ab76108b_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader
Size 165KB
Sample261104-yrvvbafv2m
SHA256 fbdf1af1c29fc06c03fe2a6836a0d7110527bca8fc4d0c649e90fc7bd8950ba7
MD5 5803ee933a34cff20206c825ab76108b
SHA1 bcfecc77f1ab3c5f6788fe8a0584a796ffd67eea
SHA512 bec40bda72c40c940e74518bc80a683f94c3ed813fd347fcc2b0d8fbab3015cce9df2ffa151efdccef5fc63d4dda8250b3d7db432d15b1b6172959976752d74e
SSDEEP 3072:5beID/DDGeQKo4rGvEZQz30wRpEzXPmxRcKZ9Mj97Y4GS+hGLGrHr1n336+:5beIDP8KFrEAQwXPm4KZKj9+13K+
TLSH
T1B5F37C2079C1C073E5BB193019F4DE729A7EF9310FA449EB639903390E616D36939A7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-03_5803ee933a34cff20206c825ab76108b_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader

.exe 165KB

2026-11-03_5803ee933a34cff20206c825ab76108b_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader

IMPHASH 4e50182b617ffbc8ec5f7081c3d9e52c
SHA256 fbdf1af1c29fc06c03fe2a6836a0d7110527bca8fc4d0c649e90fc7bd8950ba7
MD5 5803ee933a34cff20206c825ab76108b
SHA1 bcfecc77f1ab3c5f6788fe8a0584a796ffd67eea
SHA512 bec40bda72c40c940e74518bc80a683f94c3ed813fd347fcc2b0d8fbab3015cce9df2ffa151efdccef5fc63d4dda8250b3d7db432d15b1b6172959976752d74e
SSDEEP 3072:5beID/DDGeQKo4rGvEZQz30wRpEzXPmxRcKZ9Mj97Y4GS+hGLGrHr1n336+:5beIDP8KFrEAQwXPm4KZKj9+13K+
TLSH
T1B5F37C2079C1C073E5BB193019F4DE729A7EF9310FA449EB639903390E616D36939A7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

8b:11:34:20:03:3b:10:c6:eb:58:5f:8d:7d:a1:80:0b:1d:fd:16:b3:cd:62:5e:f8:6f:64:93:f2:52:86:a5:c8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 30, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

77:d9:12:68:10:b4:7a:d8:41:65:66:51

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 8, 2024 - Feb 7, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

31943

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\autobuild-components-v5\workspace\360update_service\360update_service\UpdateService\Release\360chromeup.pdb

kernel32

GetCurrentProcessId FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryW LocalFree WaitForSingleObject OpenMutexW GetCurrentProcess CreateRemoteThread OpenFileMappingW MapViewOfFile lstrcpynW GetCommandLineW CreateMutexW CreateEventW MultiByteToWideChar WideCharToMultiByte DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection WriteConsoleW GetConsoleMode GetConsoleCP InitializeCriticalSection GetStringTypeW SetStdHandle LCMapStringW GetLastError RaiseException CloseHandle CompareStringW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc HeapSize GetFileType GetCommandLineA GetStdHandle GetModuleHandleExW ExitProcess LoadLibraryExW InitializeCriticalSectionAndSpinCount EncodePointer DecodePointer FlushFileBuffers RtlUnwind CreateFileW IsDebuggerPresent OutputDebugStringW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW TerminateProcess QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WriteFile SetFilePointerEx SetLastError TlsSetValue HeapFree HeapLock ReleaseMutex HeapWalk TlsAlloc HeapAlloc GetProcessHeap TlsGetValue TlsFree HeapUnlock

user32

SendMessageTimeoutW IsWindow TranslateMessage GetClassNameW GetWindow GetMessageW DefWindowProcW DispatchMessageW GetDesktopWindow PostQuitMessage CloseWindow CreateWindowExW RegisterClassExW

advapi32

FreeSid CheckTokenMembership AllocateAndInitializeSid

shell32

ShellExecuteExW CommandLineToArgvW

ole32

CoUninitialize CLSIDFromString CoInitialize CLSIDFromProgID CoCreateInstance

oleaut32

SysFreeString VariantInit SysAllocString

shlwapi

PathAddBackslashW SHSetValueW SHGetValueW PathFileExistsW PathRemoveFileSpecW PathAppendW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_5803ee933a34cff20206c825ab76108b_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

generic