2026-11-06_edb77351b2b5c489a73c7b309bfee26d_amadey_elex_hellokitty_luca-stealer_manuscrypt_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-06_edb77351b2b5c489a73c7b309bfee26d_amadey_elex_hellokitty_luca-stealer_manuscrypt_njrat_remcos
Size 1.2MB
Sample261107-x89t5aex2x
SHA256 81815519132c7c6fa4b25bc7bb1a4e9f81e0076103886a529bc6d1d7fafe8da9
MD5 edb77351b2b5c489a73c7b309bfee26d
SHA1 ee61e2ccb82baf8b0c887ee43642bc723d11f495
SHA512 0ef559d4bcc294c305a98ae4702fe61610ec6782770c2feb563377949d042397499c26ad647e062df65561b5caf48953b4586e4789a40aac9906ac0d230de2a5
SSDEEP 24576:L29NDJtIORNx3cHWhK0xmxKeaKngL2jdshRTdG1YxITqvfPkbIcbjLm:L0DJtIORNxDs0IharSj8RoTCCW
TLSH
T18B45ACD166C88D30E3F69B3034E2965759766DE21C3B8A4FF2F036590F786B0D62463A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-06_edb77351b2b5c489a73c7b309bfee26d_amadey_elex_hellokitty_luca-stealer_manuscrypt_njrat_remcos

File Explorer

2026-11-06_edb77351b2b5c489a73c7b309bfee26d_amadey_elex_hellokitty_luca-stealer_manuscrypt_njrat_remcos

.exe 1.2MB

2026-11-06_edb77351b2b5c489a73c7b309bfee26d_amadey_elex_hellokitty_luca-stealer_manuscrypt_njrat_remcos

IMPHASH c5b99cd17c52fa61ed7f12d60666667a
SHA256 81815519132c7c6fa4b25bc7bb1a4e9f81e0076103886a529bc6d1d7fafe8da9
MD5 edb77351b2b5c489a73c7b309bfee26d
SHA1 ee61e2ccb82baf8b0c887ee43642bc723d11f495
SHA512 0ef559d4bcc294c305a98ae4702fe61610ec6782770c2feb563377949d042397499c26ad647e062df65561b5caf48953b4586e4789a40aac9906ac0d230de2a5
SSDEEP 24576:L29NDJtIORNx3cHWhK0xmxKeaKngL2jdshRTdG1YxITqvfPkbIcbjLm:L0DJtIORNxDs0IharSj8RoTCCW
TLSH
T18B45ACD166C88D30E3F69B3034E2965759766DE21C3B8A4FF2F036590F786B0D62463A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13214

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\LSU-COM-JOB1\tvsu\Output\tvsu.pdb

kernel32

GlobalFree LoadLibraryW LoadResource FindResourceW GlobalLock OpenMutexW GlobalUnlock MulDiv SetUnhandledExceptionFilter DecodePointer FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP HeapReAlloc HeapSize GetProcessHeap Process32FirstW SetStdHandle LCMapStringW CompareStringW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileW GlobalAlloc Process32NextW GetLastError Sleep CreateToolhelp32Snapshot FreeResource GetVersionExW WaitForSingleObject CreateMutexW GetCurrentProcess SizeofResource GetCurrentProcessId CreateFileW WriteFile FreeLibrary GetProcAddress CloseHandle GetVersionExA LoadLibraryA OpenProcess GetStringTypeW TerminateProcess FindFirstFileExW WriteConsoleW FindClose GetFileType HeapAlloc HeapFree GetACP GetModuleHandleExW ExitProcess WideCharToMultiByte MultiByteToWideChar GetModuleFileNameW GetStdHandle LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection UnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind RaiseException SetLastError EncodePointer EnterCriticalSection

user32

GetDesktopWindow PostQuitMessage KillTimer GetClientRect ReleaseDC FindWindowW TranslateMessage SetTimer DispatchMessageW UpdateWindow EndPaint BeginPaint ShowWindow SetWindowLongW LoadStringW GetMessageW CreateDialogParamW DestroyWindow GetDC SetWindowPos MessageBoxW SendMessageW

gdi32

GetDeviceCaps

advapi32

RegCloseKey EqualSid AllocateAndInitializeSid OpenProcessToken FreeSid RegOpenKeyExW RegGetValueW GetUserNameW LookupAccountSidW RegQueryValueExW GetTokenInformation

shell32

ShellExecuteExW

ole32

CreateStreamOnHGlobal

shlwapi

StrCmpW

gdiplus

GdiplusStartup GdiplusShutdown GdipLoadImageFromStream GdipDeleteFont GdipDeleteGraphics GdipCloneBrush GdipCreateFromHDC GdipDrawString GdipFree GdipCreateSolidFill GdipCreateFont GdipDisposeImage GdipDrawImageRectI GdipAlloc GdipDeleteBrush GdipCloneImage GdipCreateFontFamilyFromName GdipDeleteFontFamily

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-06_edb77351b2b5c489a73c7b309bfee26d_amadey_elex_hellokitty_luca-stealer_manuscrypt_njrat_remcos

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

gdiplus

generic