2026-09-17_c9a37575f4d70b4f24c331445cf177c4_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
Unsigned .NET binary combines decryption with reflective entry-point executionUnsigned .NET implant decrypts commands from an HTTP client
SHA-2561c3d487ef36f804d71d433585b6efc4635b4f4815e14ae42b5917fbbe4d66486
MaleculeMdTh
Evidence
⋯3 more rows
0x2ca8bf03e9bc8503e9bc8f03e9bc9603e9bcbb................
0x2ca8cf5456715141414d414141414541414141TVqQAAMAAAAEAAAA
0x2ca8df2f2f3841414c67414141414141414141//8AALgAAAAAAAAA
0x2ca8ef51414141414141414141414141414141QAAAAAAAAAAAAAAA
⋯7 more rows
⋯3 more rows
0x2f6dc7565842736232466b5a57514163325630VXBsb2FkZWQAc2V0
0x2f6dd75831527664474673526d6c735a584e56X1RvdGFsRmlsZXNV
0x2f6de7634778765957526c5a41424a63306c75cGxvYWRlZABJc0lu
0x2f6df7593278315a47566b41456c7a5258686aY2x1ZGVkAElzRXhj
⋯7 more rows
⋯3 more rows
0x567bf000000000000000000000000000000000................
0x567c00363636363636363636363636363636366666666666666666
0x567c10363636363636363636363636363636366666666666666666
0x567c20363636363636363636363636363636366666666666666666
⋯7 more rows
⋯7 more rows
0x5b9baf324335320041657331393200524332002C52.Aes192.RC2.
0x5b9bbf446574656374564d32004445434f4445DetectVM2.DECODE
0x5b9bcf5f53544f5245445f4c454e32004f5332_STORED_LEN2.OS2
⋯15 more rows
⋯3 more rows
0x5c122e700070006f007200740065006400002fp.p.o.r.t.e.d../
0x5c123e300030003a00350030003a00350036000.0.:.5.0.:.5.6.
0x5c124e20002f00200056004d00770061007200 ./. .V.M.w.a.r.
0x5c125e65002c00200049006e0063002e00002fe.,. .I.n.c..../
0x5c126e300030003a00300043003a00320039000.0.:.0.C.:.2.9.
0x5c127e20002f00200056004d00770061007200 ./. .V.M.w.a.r.
0x5c128e65002c00200049006e0063002e00002fe.,. .I.n.c..../
0x5c129e300030003a00300035003a00360039000.0.:.0.5.:.6.9.
0x5c12ae20002f00200056004d00770061007200 ./. .V.M.w.a.r.
0x5c12be65002c00200049006e0063002e00005de.,. .I.n.c....]
0x5c12ce300038003a00300030003a00320037000.8.:.0.0.:.2.7.
0x5c12de20002f00200050004300530020005300 ./. .P.C.S. .S.
0x5c12ee79007300740065006d00740065006300y.s.t.e.m.t.e.c.
0x5c12fe68006e0069006b00200047006d006200h.n.i.k. .G.m.b.
0x5c130e48002000280056006900720074007500H. .(.V.i.r.t.u.
0x5c131e61006c0042006f007800290000353000a.l.B.o.x.)..50.
0x5c132e30003a00310043003a003400320020000.:.1.C.:.4.2. .
0x5c133e2f00200050006100720061006c006c00/. .P.a.r.a.l.l.
0x5c134e65006c0073002c00200049006e006300e.l.s.,. .I.n.c.
0x5c135e2e000035300030003a00310036003a00...50.0.:.1.6.:.
0x5c136e3300450020002f002000580065006e003.E. ./. .X.e.n.
⋯7 more rows
⋯7 more rows
0x5b9baf324335320041657331393200524332002C52.Aes192.RC2.
0x5b9bbf446574656374564d32004445434f4445DetectVM2.DECODE
0x5b9bcf5f53544f5245445f4c454e32004f5332_STORED_LEN2.OS2
⋯15 more rows
0x13fcc4a0000066f560000066fc001000a2572J...oV...o....%r
0x13fdcf84f0070027bfd0200046f6c00000a6f.O.p.{....ol...o
0x13fecc001000a257208500070027bfd020004....%r.P.p.{....
0x13ffc6f2f02000a2c12027bfd0200046f2f02o/...,..{....o/.
0x1400c000a6f5d00000a2b0572010000706fc0..o]...+.r...po.
0x1401c01000a257226500070027bfe0200046f...%r&P.p.{....o
0x1402cc001000a282e00000626de0326de002a....(....&..&..*
0x1403c01100000000000008888000310000001................
0x1404c42534a4201000100000000000c000000BSJB............
0x1405c76342e302e3330333139000000000500v4.0.30319......
0x1406c6c00000070b80000237e0000dcb80000l...p...#~......
0x1407ce470000023537472696e677300000000.p..#Strings....
0x1408cc02901004050000023555300007a0100.)..@P..#US..z..
0x1409c100000002347554944000000107a0100....#GUID....z..
0x140ac8025000023426c6f6200000000000000.%..#Blob.......
0x140bc02000001579fa23f091f000000fa0133....W..?.......3
0x140cc0016000001000000d0000000ba000000................
0x140dcfe020000330500002505000020000000....3...%... ...
0x140ec2f02000006010000880000000e000000/...............
0x140fcc1000000470000002f010000ac010000....G.../.......
0x1410c08000000040000003b0000001b000000........;.......
0x1411c10000000010000000700000004000000................
0x1412c38000000010000001d000000010000008...............
0x1413c000092340100000000000600ae320855...4.........2.U
0x1414c06001b33 ...3
0x212d45461736b4964006765745f5365737369TaskId.get_Sessi
0x212e46f6e49640050726f636573736f724964onId.ProcessorId
0x212f40045746865726e657449640050616400.EthernetId.Pad.
0x21304496e697469616c52656164006765745fInitialRead.get_
0x2131443616e52656164004f70656e52656164CanRead.OpenRead
0x2132400426567696e5265616400426f647952.BeginRead.BodyR
0x21334656164006c6f6f6b6168656164006765ead.lookahead.ge
0x21344745f43757272656e7454687265616400t_CurrentThread.
0x213544c6f616400556e6c6f61640044726976Load.Unload.Driv
0x213646555706c6f6164005f7461736b55706ceUpload._taskUpl
0x213746f6164005f74696d657255706c6f6164oad._timerUpload
0x21384004d617463684d616341646400746f41.MatchMacAdd.toA
0x213946464007267625265640049735a697036dd.rgbRed.IsZip6
0x213a434466f72636564006765745f546f74614Forced.get_Tota
0x213b46c46696c657355706c6f616465640073lFilesUploaded.s
0x213c465745f546f74616c46696c657355706cet_TotalFilesUpl
0x213d46f61646564004973496e636c75646564oaded.IsIncluded
0x213e40049734578636c756465640043726353.IsExcluded.CrcS
0x213f4656564007365656400506b7a6970436ceed.seed.PkzipCl
0x2140461737369634d616e616765640052696aassicManaged.Rij
0x214146e6461656c4d616e6167656400506174ndaelManaged.Pat
0x2142463686564006765745f497346696e6973ched.get_IsFinis
0x21434686564006765745f4973466c75736865hed.get_IsFlushe
0x2144464006765745f4964656e746966696564d.get_Identified
0x21454007365745f4964656e74696669656400.set_Identified.
0x214644865616465724d61736b656400697346HeaderMasked.isF
0x2147469726577616c6c456e61626c65640077irewallEnabled.w
0x21484696e646f7746696c6c6564006765745findowFilled.get_
0x2149449735363616e6e6564007365745f4973IsScanned.set_Is
0x214a45363616e6e65640046696c7465726564Scanned.Filtered
0x214b4004f6e4b657973526571756972656400.OnKeysRequired.
0x214c44465666c61746553746f72656400436fDeflateStored.Co
0x214d4707953746f7265640073746f72656400pyStored.stored.
0x214e46269436c7255736564005f66696e616cbiClrUsed._final
0x214f469736564006973436c6f736564005f74ised.isClosed._t
0x21504696d657255706c6f61645f456c617073imerUpload_Elaps
0x215146564006164645f456c617073 ed.add_Elaps
0x22d1a727947657456616c7565004d61785661ryGetValue.MaxVa
0x22d2a6c7565006b657956616c756500476574lue.keyValue.Get
0x22d3a50726f706572747956616c7565007661PropertyValue.va
0x22d4a6c75650053617665006765745f497345lue.Save.get_IsE
0x22d5a6d626564646564417263686976650054mbeddedArchive.T
0x22d6a65737441726368697665006765745f49estArchive.get_I
0x22d7a734e657741726368697665007365745fsNewArchive.set_
0x22d8a4b656570416c69766500647269766500KeepAlive.drive.
0x22d9a6164645f417373656d626c795265736fadd_AssemblyReso
0x22daa6c7665004d6f76650052656d6f766500lve.Move.Remove.
0x22dba4c534153532e657865006765745f5369LSASS.exe.get_Si
0x22dca7a65007365745f53697a65006765745fze.set_Size.get_
0x22dda4145534f7665726865616453697a6500AESOverheadSize.
0x22dea6765745f4f6666736574426173656453get_OffsetBasedS
0x22dfa697a65007365745f4f66667365744261ize.set_OffsetBa
0x22e0a73656453697a65005f6f666673657442sedSize._offsetB
0x22e1a6173656453697a65006765745f436f6dasedSize.get_Com
0x22e2a7072657373656453697a65007365745fpressedSize.set_
0x22e3a436f6d7072657373656453697a650063CompressedSize.c
0x22e4a6f6d7072657373656453697a65006765ompressedSize.ge
0x22e5a745f496d61676553697a65007365745ft_ImageSize.set_
0x22e6a496d61676553697a65006765745f4d61ImageSize.get_Ma
0x22e7a736b496d61676553697a65006765745fskImageSize.get_
0x22e8a586f72496d61676553697a6500647749XorImageSize.dwI
0x22e9a6d61676553697a6500456e644f664365mageSize.EndOfCe
0x22eaa6e7472 ntr
0x24ca072696e67456e756d657261746f72004dringEnumerator.M
0x24cb0616e6167656d656e744f626a65637445anagementObjectE
0x24cc06e756d657261746f720053797374656dnumerator.System
0x24cd02e436f6c6c656374696f6e732e49456e.Collections.IEn
0x24ce0756d657261626c652e476574456e756dumerable.GetEnum
0x24cf0657261746f72005a6970456e74727945erator.ZipEntryE
0x24d006e756d657261746f720052616e646f6dnumerator.Random
0x24d104e756d62657247656e657261746f7200NumberGenerator.
0x24d20416374697661746f72002e63746f7200Activator..ctor.
0x24d302e6363746f72005f7461736b4d6f6e69.cctor._taskMoni
0x24d40746f7200526561644461746144657363tor.ReadDataDesc
0x24d50726970746f7200577269746544617461riptor.WriteData
0x24d6044657363726970746f72004372656174Descriptor.Creat
0x24d7065446563727970746f72004372656174eDecryptor.Creat
0x24d8065456e63727970746f72005f656e6372eEncryptor._encr
0x24d907970746f7200496e7450747200707472yptor.IntPtr.ptr
0x24da0005f737472006765745f486f75720054._str.get_Hour.T
0x24db061736b4a6f62730053797374656d2e44askJobs.System.D
0x24dc06961676e6f7374696373006368696c64iagnostics.child
0x24dd073006765745f546f74616c5365636f6es.get_TotalSecon
0x24de064730046726f6d5365636f6e64730044ds.FromSeconds.D
0x24df06573006c7052657300476574416c6c4ees.lpRes.GetAllN
0x24e006574776f726b496e7465726661636573etworkInterfaces
0x24e100053797374656d2e52756e74696d652e.System.Runtime.
0x24e20496e7465726f70536572766963657300InteropServices.
0x24e3053797374656d2e52756e74696d652e43System.Runtime.C
0x24e406f6d70696c6572536572766963657300ompilerServices.
0x24e5047657453657276696365730047657449GetServices.GetI
0x24e606e7374616e636573006765745f526573nstances.get_Res
0x24e706f75726365730057726974655265736fources.WriteReso
0x24e807572636573006244656c657465457869urces.bDeleteExi
Showing the top 5 files — 1 more file (106 regions) not shown.