Hostile ^100% Download

2026-09-26_0670791b498684125a61b76466f51788_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader

Netwire RAT, process injection, keylogging

Detects Windows.Trojan.NetwireDetects a string also used in Netwire RAT auxilliary

SHA-25605ef987411cee3a3d3f4f2ee35d1b384ad2c91fe92b40c123c8a003396b63fb7

URLhttps://tria.ge/api/v0/samples/260927-ey1vcsyena/sample

MaleculeK₂(AmMc)O₉(C₂AlAs₆CoDy₃Er₆IPPr)H₁₀(Hf₁₀Cm₁₂Cr₂Db₃F₁₅Mg₂Os₂₁Po₁₆TiU₇)Md₅(Bi₁₃HePtSi)Th₅

Evidence

x86 indirect call through a global pointer 0x1753–0x1813

⋯3 more rows
0x178301000075633b8778010000755bff7318...uc;.x...u[.s.
0x17938b35f0f54800ffd6ff731c0fb7c0c1e8.5..H....s......
0x17a30f894508ffd60fb7f08b4508c1ee0f3b..E.......E....;
⋯7 more rows

References JFIF or the JPEG media type 0x12217c–0x12232c

⋯3 more rows
0x1221aceaf2f3f4f5f6f7f8f9fa000005001000................
0x1221bc4a464946000101000100010000000000JFIF............
0x1221ccc0ff1100080000000000030111000211................
⋯3 more rows
0x12220c0010002000400080406563686f206f66... .@..@echo of
0x12221c660d0a70696e67203139322e302e322ef..ping 192.0.2.
0x12222c32202d6e2031202d77202564203e6e752 -n 1 -w %d >nu
0x12223c6c20323e26310d0a44454c202f732022l 2>&1..DEL /s "
⋯15 more rows

WinHTTP DLL name string reference 0x122a64–0x122d54

⋯11 more rows
0x122b14f304353f15efc33ed48b0a3f753da73f..5?...>...?u=.?
0x122b24000000002000d04050544c4c6a507120.... ..@PTLLjPq 
0x122b3425363a2553202d7171392f472e790052%6:%S -qq9/G.y.R
0x122b442d5736353a2025363a25530052005200-W65: %6:%S.R.R.
0x122b54323030204f4b00006d57594369206134200 OK..mWYCi a4
⋯5 more rows
0x122bb47834ddaa55886512382756883b003a00x4..U.e.8'V.;.:.
0x122bc45534522d353573547364520077696e68U4R-55sTsdR.winh
0x122bd47474702e646c6c005534522d35357345ttp.dll.U4R-55sE
0x122be46435393057665a5f5730753069002553d590WfZ_W0u0i.%S
⋯17 more rows
0x122d0474696e67732e696e6900257325730000tings.ini.%s%s..
0x122d1447455420257320485454502f312e310dGET %s HTTP/1.1.
0x122d240a486f73743a202573200d0a55736572.Host: %s ..User
0x122d342d4167656e743a204d6f7a696c6c612f-Agent: Mozilla/
0x122d44342e30202857696e646f7773204e54204.0 (Windows NT 
0x122d54362e313b20574f5736343b20547269646.1; WOW64; Trid

CPU model name registry value 0x1240b3–0x124363

⋯7 more rows
0x1241230059764100e273410025640725730700.YvA..sA.%d.%s..
0x1241332563252e38782573002563252e387825%c%.8x%s.%c%.8x%
0x124143732573002563252e387825735c257300s%s.%c%.8x%s\%s.
0x1241532563252e387825735c25730725730000%c%.8x%s\%s.%s..
0x12416300797e41006078410056794100857a41.y~A.`xA.VyA..zA
0x124173004b7b4100797e41005c7c4100436f6d.K{A.y~A.\|A.Com
0x124183537065630025730057494e4449520025Spec.%s.WINDIR.%
0x124193365c365a3635646c4e685c596c532e646\6Z65dlNh\YlS.d
0x1241a366640000006c6f63616c686f73740043fd...localhost.C
0x1241b353324373344e682e5369690045643575S2Cs4Nh.Sii.Ed5u
⋯13 more rows
0x1242933635646c5c506452353043693930575965dl\PdR50Ci90WY
0x1242a364363657305c790050726f636573736fd66W0\y.Processo
0x1242b3724e616d65537472696e670044696957rNameString.DiiW
0x1242c35943356444525358523435344369346bYC5dDRSXR454Ci4k
⋯10 more rows

Custom .htext RWX section 0x152da0–0x152ed0

⋯5 more rows
0x152df000000000000000000000000000000000................
0x152e00e80fa0eaff80f1ef80f1ef80f1ef80f1................
0x152e10ef80f1ef80f1ef80f1ef80f1ef80f1ef................
0x152e2080f1ef80f1ef80f1ef80f1ef80f1ef80................
⋯11 more rows