Hostile ^93% Download

2026-10-02_af122a00b1cb9d37c5e3f2523727db4f_coinminer_elex_emotet_glassworm_remcos

Multi-stage malware with evasion

.NET profiler anti-debug checkUnsigned PE writable entry with multiple RWX sections

SHA-2563d94456092b7095c59acf8cc898b1eac249bc2beb201709114be87a9b2c01b2f

URLhttps://tria.ge/api/v0/samples/261003-gc2kwast9m/sample

MaleculeK₄(Am₂Li₂Mc₃Te₂)O₁₂(Al₆As₁₇C₇CoEr₁₆Ca₂I₅P₈Dy₃LaPr₂Xe)H₁₁(F₁₇Po₂₁Cm₁₃Cr₆Db₅DsHf₅Mg₉Os₃₇Ti₂U₃)Md₈(Bi₂₂BkHe₂PaSi₄V)Th₂

Evidence

Large elevated-entropy PE .rdata section 0x12afa0–0x12b290

⋯5 more rows
0x12aff000000000000000000000000000000000................
0x12b000f0773400007834001278340022783400.w4..x4..x4."x4.
0x12b010347834004478340056783400e27734004x4.Dx4.Vx4..w4.
0x12b02000000000605b3400805b340000000000....`[4..[4.....
0x12b030b07a34009c7a340011000080887a3400.z4..z4......z4.
0x12b040707a3400567a3400c27a340000000000pz4.Vz4..z4.....
⋯4 more rows
0x12b090ec763400d87634008c72340098723400.v4..v4..r4..r4.
0x12b0a0a4723400ae723400b8723400c6723400.r4..r4..r4..r4.
0x12b0b0d8723400ee723400027334000c733400.r4..r4..s4..s4.
0x12b0c01c7334002a7334003473340040733400.s4.*s4.4s4.@s4.
⋯3 more rows
0x12b10020743400307434003a74340046743400 t4.0t4.:t4.Ft4.
0x12b110587434006c7434007e7434008a743400Xt4.lt4.~t4..t4.
0x12b1209c743400ac743400ba743400ca743400.t4..t4..t4..t4.
0x12b130e4743400f67434000675340016753400.t4..t4..u4..u4.
0x12b1402a753400387534004c75340060753400*u4.8u4.Lu4.`u4.
0x12b1507875340086753400927534009e753400xu4..u4..u4..u4.
0x12b160ae753400c2753400cc753400d8753400.u4..u4..u4..u4.
⋯3 more rows
0x12b1a0ba763400c4763400e271340000000000.v4..v4..q4.....
0x12b1b0b4623400c2623400d2623400a2623400.b4..b4..b4..b4.
0x12b1c0e6623400f46234000c63340024633400.b4..b4..c4.$c4.
0x12b1d030633400426334004e633400606334000c4.Bc4.Nc4.`c4.
0x12b1e074633400806334008e6334009e633400tc4..c4..c4..c4.
0x12b1f0b0633400bc633400d0633400e2633400.c4..c4..c4..c4.
0x12b200f46334000a6434001664340024643400.c4..d4..d4.$d4.
0x12b21030643400406434004a64340058643400[email protected].
0x12b22068643400766434008464340098643400hd4.vd4..d4..d4.
0x12b230a6643400b6643400ca643400d6643400.d4..d4..d4..d4.
0x12b240e2643400f46434000065340010653400.d4..d4..e4..e4.
0x12b250226534002e6534003865340048653400"e4..e4.8e4.He4.
0x12b26056653400726534008c653400a6653400Ve4.re4..e4..e4.
0x12b270be653400d8653400ea653400fa653400.e4..e4..e4..e4.
0x12b2801466340022663400306634003e663400.f4."f4.0f4.>f4.
0x12b29058663400686634007866340088663400Xf4.hf4.xf4..f4.

References an HTTP Content-Type header 0x206e42–0x2070d2

⋯3 more rows
0x206e7245414400505554004f5054494f4e5300EAD.PUT.OPTIONS.
0x206e8244454c45544500545241434500434f4eDELETE.TRACE.CON
0x206e924e454354000a000000140000001e0000NECT............
0x206ea20028000000320000003c000000460000.(...2...<...F..
0x206eb2005000000068747470733a2f2f005573.P...https://.Us
0x206ec265722d4167656e743a004d6f7a696c6cer-Agent:.Mozill
0x206ed2612f342e302028636f6d70617469626ca/4.0 (compatibl
0x206ee2653b204d53494520392e303b2057696ee; MSIE 9.0; Win
0x206ef2646f7773204e5420362e312900534f43dows NT 6.1).SOC
0x206f024b533d00687474703d00416363657074KS=.http=.Accept
0x206f123a202a2f2a004163636570743a000d0a: */*.Accept:...
0x206f224163636570743a202a2f2a0052656665Accept: */*.Refe
0x206f327265723a000d0a526566657265723a20rer:...Referer: 
0x206f42004163636570742d4c616e6775616765.Accept-Language
0x206f523a000d0a4163636570742d4c616e6775:...Accept-Langu
0x206f626167653a207a682d636e00436f6e7465age: zh-cn.Conte
0x206f726e742d547970653a000d0a436f6e7465nt-Type:...Conte
0x206f826e742d547970653a206170706c696361nt-Type: applica
0x206f9274696f6e2f782d7777772d666f726d2dtion/x-www-form-
0x206fa275726c656e636f64656400436f6f6b69urlencoded.Cooki
0x206fb2653a000d0a436f6f6b69653a20006874e:...Cookie: .ht
⋯6 more rows
0x207022737369643d2700717565727953656c65ssid='.querySele
0x20703263746f72006f626a65637400496e7465ctor.object.Inte
0x207042726e6574204578706c6f7265725f5365rnet Explorer_Se
0x2070527276657200574d5f48544d4c5f474554rver.WM_HTML_GET
0x2070624f424a45435400010000001000000020OBJECT......... 
⋯7 more rows

References Windows Search host executable name 0x279d37–0x279e67

⋯5 more rows
0x279d872e65786500cccccccccccccccccccccc.exe............
0x279d9753656172636850726f746f636f6c486fSearchProtocolHo
0x279da773742e65786500ccccccccccccccccccst.exe..........
0x279db7576d6950727653452e65786500ccccccWmiPrvSE.exe....
⋯11 more rows

Encoded Process Monitor probe 0x286d77–0x286e97

⋯5 more rows
0x286dc78bf98df9d7f98af980f98af9f9f90000................
0x286dd7fa8af88ae58ae98ae78ae58ae48aa48a................
0x286de7ef8af28aef8a8a8ae1e1fedccfdfd2d3................
⋯11 more rows

Encoded Process Explorer probe 0x28757f–0x28773f

⋯5 more rows
0x2875cf416f1c6f166f1c6f6f6f000000000000Ao.o.o.ooo......
0x2875df09790b7916791a791c79017909795779.y.y.y.y.y.y.yWy
0x2875ef1c7901791c7979793e4e264e374e3d4e.y.y.yyy>N&N7N=N
⋯5 more rows
0x28764fd5ba94bac9bac3bac9bababa00000000................
0x28765f94fd99fd9cfd8cfdcbfdc9fdd3fd98fd................
0x28766f85fd98fdfdfd0000c98ccf8cdf8ce58c................
0x28767fe38cc88cfe8ce58cfa8ce98cfe8ca28c................
0x28768fff8cf58cff8c8c8ccdbad3bad4bad3ba................
0x28769fd5ba94bac9bac3bac9bababa00000000................
0x2876af781b731b7e1b7a1b6f1b7e1b751b7c1bx.s.~.z.o.~.u.|.
0x2876bf721b751b7e1b361b721b281b231b2d1br.u.~.6.r.(.#.-.
0x2876cf351b7e1b631b7e1b1b1b0000000000005.~.c.~.........
⋯7 more rows