Hostile ^93% Download

2026-10-02_62856c64fdea4c77d8fd24e346af3e00_coinminer_elex_glassworm_hawkeye_icedid_luca-stealer_njrat_remcos_smoke-loader_stop_vidar

Multi-stage malware with C2, persistence, evasion

UPX markers present but image is not packedNetBIOS worm copies a payload and schedules remote execution

SHA-2563758a25dcd679578cb8052b435ea4bb2321bd2780280781f7bc5ca2cbc8601cc

URLhttps://tria.ge/api/v0/samples/261003-njnqxsyxaw/sample

MaleculeK₂(Li₈Mc₂)O₉(C₇La₃As₁₂I₂P₂Dy₂Er₁₂PrS₃)H₁₀(Cm₃₃Cr₁₇Db₁₁F₃₀Hf₂Mg₅Os₂₀Po₂₂Ti₂U₃)Md₇(Bi₂₁HePaPt₃Si₅)Th

Evidence

Windows Start Menu Startup directory reference 0x3e56–0x3fe6

⋯7 more rows
0x3ec674696e67735c416c6c2055736572735ctings\All Users\
0x3ed65374617274204d656e755c50726f6772Start Menu\Progr
0x3ee6616d735c537461727475705c0000ffffams\Startup\....
0x3ef6ffff250000005c57494e444f57535c53..%...\WINDOWS\S
⋯15 more rows

IRC message reports a NetBIOS infection 0x47f4–0x4984

⋯4 more rows
0x4834c3000000ffffffff010000005c000000............\...
0x4844ffffffff0900000053657475702e6578........Setup.ex
0x485465000000ffffffff0900000073657475e...........setu
0x4864702e657865000000ffffffff21000000p.exe.......!...
0x4874505249564d534720237065776b203a4ePRIVMSG #pewk :N
0x4884657442696f7320696e66656374656420etBios infected 
0x489428000000ffffffff0100000029000000(...........)...
⋯15 more rows

NetScheduleJobAdd remote task creation 0x4d04–0x4e94

⋯7 more rows
0x4d744e657452656d6f7465544f4400000000NetRemoteTOD....
0x4d844e65745363686564756c654a6f624164NetScheduleJobAd
0x4d94640000004e65745368617265456e756dd...NetShareEnum
0x4da4000000004e6574417069427566666572....NetApiBuffer
⋯15 more rows

IRC PRIVMSG command in binary 0x8180–0x82a0

⋯5 more rows
0x81d072726f7200000000ffffffff08000000rror............
0x81e0505249564d53472000000000ffffffffPRIVMSG ........
0x81f002000000203a0000ffffffff0a000000.... :..........
⋯11 more rows

Network share connection API import 0xd0dc–0xd2fc

⋯15 more rows
0xd1ccee950100fd9501000e9601001d960100................
0xd1dc2b960100379601000000000065960100+...7.......e...
0xd1ec7d960100000000007a97010000000000}.......z.......
0xd1fcf5960100000000002398010030980100........#...0...
0xd20c3d9801004d980100569801005d980100=...M...V...]...
0xd21c669801006d980100759801007e980100f...m...u...~...
0xd22c8a980100969801009e980100a6980100................
0xd23cb4980100be980100cc980100d3980100................
0xd24c00000000a79701000000000021970100............!...
0xd25c00000000000000000000000000000000................
0xd26c00000000000000000000000000000000................
⋯9 more rows