2026-11-12_4a94401b15dca97caeb8cf1e82c09b97_amadey_cobalt-strike_elex_floxif_hellokitty_hijackloader_luca-stealer_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_4a94401b15dca97caeb8cf1e82c09b97_amadey_cobalt-strike_elex_floxif_hellokitty_hijackloader_luca-stealer_njrat_remcos
Size 217KB
Sample261113-eaks8sfy3r
SHA256 119a597c0941a8342f3edb94d615e0bca128fd530375713a9dc7178f150ef0eb
MD5 4a94401b15dca97caeb8cf1e82c09b97
SHA1 a06c356ea1cae2c31af6c038e699900fee05d382
SHA512 f3fe303fd05f969ca377190f1d5536170ecb5f6057d026ef17325947c463fccbb58a81b35a7ae3dd53004fde4629e906181f573fe34f053f04111bf6b2447b34
SSDEEP 6144:raWT6xvcChEKOD2n8JAyDBV+UdvrEFp7hKlp:raWT6xFH8JAUBjvrEH7w
TLSH
T11024BF0035C0C7F9E4B21D3038B899305AF9F93C0E769A5B635542299F7C6829B79B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-12_4a94401b15dca97caeb8cf1e82c09b97_amadey_cobalt-strike_elex_floxif_hellokitty_hijackloader_luca-stealer_njrat_remcos

File Explorer

2026-11-12_4a94401b15dca97caeb8cf1e82c09b97_amadey_cobalt-strike_elex_floxif_hellokitty_hijackloader_luca-stealer_njrat_remcos

.exe 217KB

2026-11-12_4a94401b15dca97caeb8cf1e82c09b97_amadey_cobalt-strike_elex_floxif_hellokitty_hijackloader_luca-stealer_njrat_remcos

IMPHASH 2a0bfad31e607f22b31fc302c3435f3f
SHA256 119a597c0941a8342f3edb94d615e0bca128fd530375713a9dc7178f150ef0eb
MD5 4a94401b15dca97caeb8cf1e82c09b97
SHA1 a06c356ea1cae2c31af6c038e699900fee05d382
SHA512 f3fe303fd05f969ca377190f1d5536170ecb5f6057d026ef17325947c463fccbb58a81b35a7ae3dd53004fde4629e906181f573fe34f053f04111bf6b2447b34
SSDEEP 6144:raWT6xvcChEKOD2n8JAyDBV+UdvrEFp7hKlp:raWT6xFH8JAUBjvrEH7w
TLSH
T11024BF0035C0C7F9E4B21D3038B899305AF9F93C0E769A5B635542299F7C6829B79B7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

89:20:85:9d:10:12:d9:5f:96:43:ad:d0:79:8b:d4:e5:d8:47:ca:f8:5f:d6:a2:ab:7a:9a:40:5e:f6:b7:a9:bd

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=Hsinchu City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Chains

Oct 24, 2022

SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=Hsinchu City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=Hsinchu City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

bc:95:ab:05:ee:41:c8:af:c6:95:93:17:27:b8:ea:28:bd:6b:00:60

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=Hsinchu City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Chains

Oct 24, 2022

SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=Hsinchu City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=Hsinchu City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=Hsinchu City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Serial Number

0b:8f:52:fa:f6:4c:42:1e:ab:b2:27:5a:e1:48:c5:19

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 30, 2022 - Jul 19, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

10304

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\DavidL\Storage\Realtek\Source\Git\autoinstall\autoinstall_v2\RTKAutoInstall\RTKAutoInstall\ServiceInstall_Release\WifiAutoInstallSrv.pdb

setupapi

SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList

kernel32

VerSetConditionMask VerifyVersionInfoW GetTickCount HeapReAlloc HeapSize GetConsoleMode GetLocalTime CloseHandle SetEvent OutputDebugStringW GetLastError Sleep CreateEventW CreateFileW WaitForSingleObject GetModuleFileNameW DeviceIoControl GetPrivateProfileIntW GetCurrentProcess SetEndOfFile ReadFile ReadConsoleW DecodePointer SetFilePointerEx SetLastError GetConsoleCP FlushFileBuffers UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind WriteConsoleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException GetStdHandle WriteFile MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetACP HeapFree HeapAlloc GetFileType GetStringTypeW CompareStringW LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap

user32

RegisterDeviceNotificationW UnregisterDeviceNotification

advapi32

DeregisterEventSource RegisterServiceCtrlHandlerExW CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW SetServiceStatus DeleteService ControlService OpenProcessToken StartServiceW StartServiceCtrlDispatcherW OpenServiceW QueryServiceStatusEx RegisterEventSourceW ReportEventW GetTokenInformation

shell32

ShellExecuteExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_4a94401b15dca97caeb8cf1e82c09b97_amadey_cobalt-strike_elex_floxif_hellokitty_hijackloader_luca-stealer_njrat_remcos

PE Signature issue

PE Signature issue

setupapi

kernel32

user32

advapi32

shell32

generic