2026-10-03_aca48bda67b134ae5fbbe4229be4e9ca_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar
Cobalt Strike beacon embedded
Cobalt Strike reflective Beacon DLLDynamically resolved process-hollowing API chain
SHA-256170ae75ac07f8fae19bda0e6c2742740f01b66c8240e74f18f5b37171f240454
Evidence
⋯7 more rows
0x39de98d9370b00b6370b0095370b0068370b00.7...7...7..h7..
0x39dea8433a2f55736572732f534b4f4c2d4e4fC:/Users/SKOL-NO
0x39deb854452f4465736b746f702f4c6f616465TE/Desktop/Loade
0x39dec8722f7363726970742e676f0000433a2fr/script.go..C:/
0x39ded8476f2f7372632f6f732f657865632f6cGo/src/os/exec/l
⋯15 more rows
⋯7 more rows
0x5a3b9d2a2f2a00256400002573257300000000*/*.%d..%s%s....
0x5a3bad63646e2e257825782e25730077777736cdn.%x%x.%s.www6
0x5a3bbd2e257825782e25730000000025732e31.%x%x.%s....%s.1
0x5a3bcd25782e257825782e2573000025732e34%x.%x%x.%s..%s.4
0x5a3bdd25303878253038782530387825303878%08x%08x%08x%08x
0x5a3bed253038782e2530387825303878253038%08x.%08x%08x%08
⋯4 more rows
0x5a3c3d30387825303878253038782e2578257808x%08x%08x.%x%x
0x5a3c4d2e25730025732e332530387825303878.%s.%s.3%08x%08x
0x5a3c5d25303878253038782530387825303878%08x%08x%08x%08x
0x5a3c6d253038782e2530387825303878253038%08x.%08x%08x%08
0x5a3c7d78253038782530387825303878253038x%08x%08x%08x%08
0x5a3c8d782e2530387825303878253038782530x.%08x%08x%08x%0
0x5a3c9d38782530387825303878253038782e258x%08x%08x%08x.%
0x5a3cad7825782e257300000000000025732e32x%x.%s......%s.2
0x5a3cbd25303878253038782530387825303878%08x%08x%08x%08x
0x5a3ccd2530387825303878253038782e253038%08x%08x%08x.%08
0x5a3cdd78253038782530387825303878253038x%08x%08x%08x%08
0x5a3ced7825303878253038782e257825782e25x%08x%08x.%x%x.%
0x5a3cfd7300000025732e322530387825303878s...%s.2%08x%08x
0x5a3d0d25303878253038782530387825303878%08x%08x%08x%08x
0x5a3d1d2e253038782530387825303878253038.%08x%08x%08x%08
0x5a3d2d7825303878253038782e257825782e25x%08x%08x.%x%x.%
0x5a3d3d7300000025732e322530387825303878s...%s.2%08x%08x
0x5a3d4d2530387825303878253038782e253038%08x%08x%08x.%08
0x5a3d5d78253038782530387825303878253038x%08x%08x%08x%08
0x5a3d6d782e257825782e257300000025732e31x.%x%x.%s...%s.1
0x5a3d7d25303878253038782530387825303878%08x%08x%08x%08x
⋯10 more rows
⋯9 more rows
0x5a44612e5c2a005c2a000025730a0044093009.\*.\*..%s..D.0.
0x5a4471253032642f253032642f253032642025%02d/%02d/%02d %
0x5a44813032643a253032643a2530326409257302d:%02d:%02d.%s
0x5a44910a000000460925493634640925303264....F.%I64d.%02d
0x5a44a12f253032642f2530326420253032643a/%02d/%02d %02d:
0x5a44b1253032643a253032640925730a000000%02d:%02d.%s....
0x5a44c1576f77363444697361626c65576f7736Wow64DisableWow6
0x5a44d13446735265646972656374696f6e00004FsRedirection..
0x5a44e1576f773634526576657274576f773634Wow64RevertWow64
⋯8 more rows
0x5a457174657320696e2070726f636573733a20tes in process:
0x5a458125640000636f756c64206e6f74207772%d..could not wr
0x5a459169746520746f2070726f63657373206dite to process m
0x5a45a1656d6f72793a202564000000636f756cemory: %d...coul
0x5a45b164206e6f742061646a75737420706572d not adjust per
⋯5 more rows
0x5a4611656e2070726f636573732025643a2025en process %d: %
0x5a462164000000256420697320616e20783634d...%d is an x64
0x5a46312070726f63657373202863616e277420 process (can't
0x5a4641696e6a6563742078383620636f6e7465inject x86 conte
0x5a46516e742900256420697320616e20783836nt).%d is an x86
0x5a46612070726f63657373202863616e277420 process (can't
0x5a4671696e6a6563742078363420636f6e7465inject x64 conte
0x5a46816e742900737973776f77363400000000nt).syswow64....
0x5a469173797374656d333200000000436f756csystem32....Coul
⋯3 more rows
⋯3 more rows
0x5a4829742062696e6420746f20256400000000t bind to %d....
0x5a483949455820284e65772d4f626a65637420IEX (New-Object
0x5a48494e65742e576562636c69656e74292e44Net.Webclient).D
0x5a48596f776e6c6f6164537472696e67282768ownloadString('h
0x5a48697474703a2f2f3132372e302e302e313attp://127.0.0.1:
0x5a487925752f27290000002525494d504f5254%u/')...%%IMPORT
0x5a488925250000436f6d6d616e64206c656e67%%..Command leng
0x5a48997468202825642920746f6f206c6f6e67th (%d) too long
0x5a48a9000000000000000049455820284e6577........IEX (New
0x5a48b92d4f626a656374204e65742e57656263-Object Net.Webc
0x5a48c96c69656e74292e446f776e6c6f616453lient).DownloadS
0x5a48d97472696e672827687474703a2f2f3132tring('http://12
0x5a48e9372e302e302e313a25752f27293b20257.0.0.1:%u/'); %
0x5a48f973000000706f7765727368656c6c202ds...powershell -
0x5a49096e6f70202d6578656320627970617373nop -exec bypass
0x5a4919202d456e636f646564436f6d6d616e64 -EncodedCommand
0x5a492920222573220000003f25733d25730000 "%s"...?%s=%s..
0x5a493925732625733d25730000000025732573%s&%s=%s....%s%s
0x5a49493a2025730d0a00003f25730025732625: %s....?%s.%s&%
⋯10 more rows
0x5a49f949276d20616c726561647920696e2053I'm already in S
0x5a4a094d42206d6f6465002573202861646d69MB mode.%s (admi
0x5a4a196e290000436f756c64206e6f74206f70n)..Could not op
0x5a4a29656e2070726f636573733a2025642028en process: %d (
0x5a4a39257529004661696c656420746f20696d%u).Failed to im
0x5a4a49706572736f6e61746520746f6b656e20personate token
0x5a4a5966726f6d202564202825752900000000from %d (%u)....
0x5a4a694661696c656420746f206475706c6963Failed to duplic
0x5a4a79617465207072696d61727920746f6b65ate primary toke
0x5a4a896e20666f722025642028257529000000n for %d (%u)...
0x5a4a994661696c656420746f20696d70657273Failed to impers
0x5a4aa96f6e617465206c6f67676564206f6e20onate logged on
0x5a4ab975736572202564202825752900000000user %d (%u)....
0x5a4ac9436f756c64206e6f7420637265617465Could not create
0x5a4ad920746f6b656e3a202564000000000000 token: %d......
0x5a4ae9485454502f312e3120323030204f4b0dHTTP/1.1 200 OK.
⋯8 more rows
0x5a711d28fb02002cfb020030fb0200798c0000(...,...0...y...
0x5a712d3dfb02000000626561636f6e2e646c6c=.....beacon.dll
0x5a713d005f5265666c6563746976654c6f6164._ReflectiveLoad
0x5a714d65724034000000000000000000000000er@4............
0x5a715d00000000000000000000000000000000................
⋯15 more rows
⋯7 more rows
0x39de98d9370b00b6370b0095370b0068370b00.7...7...7..h7..
0x39dea8433a2f55736572732f534b4f4c2d4e4fC:/Users/SKOL-NO
0x39deb854452f4465736b746f702f4c6f616465TE/Desktop/Loade
0x39dec8722f7363726970742e676f0000433a2fr/script.go..C:/
0x39ded8476f2f7372632f6f732f657865632f6cGo/src/os/exec/l
⋯15 more rows
⋯7 more rows
0x5a3b9d2a2f2a00256400002573257300000000*/*.%d..%s%s....
0x5a3bad63646e2e257825782e25730077777736cdn.%x%x.%s.www6
0x5a3bbd2e257825782e25730000000025732e31.%x%x.%s....%s.1
0x5a3bcd25782e257825782e2573000025732e34%x.%x%x.%s..%s.4
0x5a3bdd25303878253038782530387825303878%08x%08x%08x%08x
0x5a3bed253038782e2530387825303878253038%08x.%08x%08x%08
⋯4 more rows
0x5a3c3d30387825303878253038782e2578257808x%08x%08x.%x%x
0x5a3c4d2e25730025732e332530387825303878.%s.%s.3%08x%08x
0x5a3c5d25303878253038782530387825303878%08x%08x%08x%08x
0x5a3c6d253038782e2530387825303878253038%08x.%08x%08x%08
0x5a3c7d78253038782530387825303878253038x%08x%08x%08x%08
0x5a3c8d782e2530387825303878253038782530x.%08x%08x%08x%0
0x5a3c9d38782530387825303878253038782e258x%08x%08x%08x.%
0x5a3cad7825782e257300000000000025732e32x%x.%s......%s.2
0x5a3cbd25303878253038782530387825303878%08x%08x%08x%08x
0x5a3ccd2530387825303878253038782e253038%08x%08x%08x.%08
0x5a3cdd78253038782530387825303878253038x%08x%08x%08x%08
0x5a3ced7825303878253038782e257825782e25x%08x%08x.%x%x.%
0x5a3cfd7300000025732e322530387825303878s...%s.2%08x%08x
0x5a3d0d25303878253038782530387825303878%08x%08x%08x%08x
0x5a3d1d2e253038782530387825303878253038.%08x%08x%08x%08
0x5a3d2d7825303878253038782e257825782e25x%08x%08x.%x%x.%
0x5a3d3d7300000025732e322530387825303878s...%s.2%08x%08x
0x5a3d4d2530387825303878253038782e253038%08x%08x%08x.%08
0x5a3d5d78253038782530387825303878253038x%08x%08x%08x%08
0x5a3d6d782e257825782e257300000025732e31x.%x%x.%s...%s.1
0x5a3d7d25303878253038782530387825303878%08x%08x%08x%08x
⋯10 more rows
⋯3 more rows
0x25ff0d0bb6bd0efc52aefaa4fe5aafbed16fb..k...*..O......
0x260004386c5434d9ad74d3366553385119485C..CM..M3fU3....
0x26010458acf45f9e910f9020406027ffe817fE..E............
0x2602050a0f0503c78443c9f25ba9fa84be3a8P..P<xD<.%...K..
0x2603051a2f351a35dfea34080c0408f058a8fQ..Q.]..@..@....
0x26040923fad929d21bc9d38704838f5f104f5.?...!..8pH8....
0x26050bc63dfbcb677c1b6daaf75da21426321.c...w....u.!Bc!
0x2606010203010ffe51afff3fd0ef3d2bf6dd2. 0...........m.
0x26070cd814ccd0c18140c13263513ecc32fec..L......&5.../.
0x260805fbee15f9735a2974488cc44172e3917_.._.5..D..D..9.
0x26090c49357c4a755f2a77efc827e3d7a473d..W..U..~..~=zG=
0x260a064c8ac645dbae75d19322b1973e69573d..d]..].2+.s..s
0x260b060c0a060811998814f9ed14fdca37fdc`..`....O..O....
0x260c0224466222a547e2a903bab90880b8388"Df"*T~*.;......
0x260d0468cca46eec729eeb86bd3b814283c14F..F..)..k...(<.
0x260e0dea779de5ebce25e0b161d0bdbad76db..y.^..^......v.
0x260f0e0db3be0326456323a744e3a0a141e0a..;.2dV2:tN:....
0x261004992db49060c0a0624486c245cb8e45cI..I....$Hl$\..\
0x26110c29f5dc2d3bd6ed3ac43efac62c4a662..]...n..C..b..b
0x261209139a8919531a495e4d337e479f28b79.9...1....7.y..y
0x26130e7d532e7c88b43c8376e59376ddab76d..2...C.7nY7m..m
0x261408d018c8dd5b164d54e9cd24ea949e0a9......d.N..N.I..
0x261506cd8b46c56acfa56f4f307f4eacf25eal..lV..V......%.
0x2616065caaf657af48e7aae47e9ae08101808e..ez..z.G......
0x26170ba6fd5ba78f08878254a6f252e5c722e.o..x..x%Jo%.\r.
0x261801c38241ca657f1a6b473c7b4c69751c6.8$..W...s....Q.
0x26190e8cb23e8dda17cdd74e89c741f3e211f..#...|.t..t.>!.
0x261a04b96dd4bbd61dcbd8b0d868b8a0f858aK..K.a..........
0x261b070e090703e7c423eb571c4b566ccaa66p..p>|B>.q..f..f
0x261c04890d84803060503f6f701f60e1c120eH..H............
0x261d061c2a361356a5f3557aef957b969d0b9a..a5j_5W..W.i..
0x261e086179186c19958c11d3a271d9e27b99e......X..:'..'..
0x261f0e1d938e1f8eb13f8982bb39811223311..8......+..."3.
0x2620069d2bb69d9a970d98e07898e9433a794i..i..p......3..
0x262109b2db69b1e3c221e87159287e9c920e9.-...<"....... .
0x26220ce8749ce55aaff5528507828dfa57adf..I.U..U(Px(..z.
0x262308c038f8ca159f8a1890980890d1a170d.....Y..........
0x26240bf65dabfe6d731e64284c64268d0b868.e....1.B..Bh..h
0x262504182c3419929b0992d5a772d0f1e110fA..A.)..-Zw-....
0x26260b07bcbb054a8fc54bb6dd6bb162c3a16.{..T..T.m...,:.
0x26270c6a56363f8847c7cee997777f68d7b7b..cc..||..ww..{{
0x26280ff0df2f2d6bd6b6bdeb16f6f9154c5c5......kk..oo.T..
0x262906050303002030101cea96767567d2b2b`P00......ggV}++
0x262a0e719fefeb562d7d74de6ababec9a7676.....b..M.....vv
0x262b08f45caca1f9d82828940c9c9fa877d7d.E.......@....}}
⋯7 more rows
0x2af046f6b656e3a2025642028257529000000oken: %d (%u)...
0x2af14636f756c64206e6f742072756e202573could not run %s
0x2af242061732025735c25733a202564000000 as %s\%s: %d...
0x2af34434f4d5350454300202f432000000000COMSPEC. /C ....
⋯5 more rows
0x2af94636f756c64206e6f7420736574206669could not set fi
0x2afa46c652074696d653a202564003132372ele time: %d.127.
0x2afb4302e302e31000000436f756c64206e6f0.0.1...Could no
0x2afc47420636f6e6e65637420746f20706970t connect to pip
⋯7 more rows
⋯8 more rows
0x2e11c28fb02002cfb020030fb0200798c0000(...,...0...y...
0x2e12c3dfb02000000626561636f6e2e646c6c=.....beacon.dll
0x2e13c005f5265666c6563746976654c6f6164._ReflectiveLoad
0x2e14c65724034000000000000000000000000er@4............
0x2e15c00000000000000000000000000000000................
⋯17 more rows