Hostile 93% Download

2026-09-29_8db72be615331478ca2848b73b023598_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_ransomhub_remcos_smoke-loader_vidar

Signed malware dropper with embedded payloads

ScreenConnect installer configures Safe Mode persistenceUnsigned .NET Rijndael decrypts a packed resource
SHA-25647945ef80a369ba417d1faaf48afed6dc857f945db27312de221602dbf5b2917
URLhttps://tria.ge/api/v0/samples/260929-zed7gasz4l/sample
MaleculeK₃(LiLu₂Mc)O₈(As₁₅C₆P₃DyEr₁₁I₂PrXe)H₁₁(Hf₇Cm₄Cr₇Db₁₉DsF₉Mg₂Os₂₅Po₁₃TiU₅)Md₆(Bi₂₆PaPt₃Si₃)Th₂

Evidence

ScreenConnect native .NET resource runner PDB 0x106fb–0x108ab
⋯5 more rows
0x1074b00525344531a163bb2951ca64588d272.RSDS..;....E..r
0x1075b6e345d88e701000000433a5c55736572n4]......C:\User
0x1076b735c6a6d6f7267616e5c536f75726365s\jmorgan\Source
0x1077b5c6377636f6e74726f6c5c437573746f\cwcontrol\Custo
0x1078b6d5c446f744e657452756e6e65725c52m\DotNetRunner\R
0x1079b656c656173655c446f744e657452756eelease\DotNetRun
0x107ab6e65722e706462000000000000c90000ner.pdb.........
0x107bb00c900000000000000c8000000474354.............GCT
⋯15 more rows
Giant PE resource section 0x11fc0–0x122b0
⋯3 more rows
0x11ff000000000000000000000000000000000................
0x1200000000000000000000400000001000300................
0x12010f0010080300000800a00000068000080....0.......h...
0x1202010000000800000801800000098000080................
0x1203000000000000000000400000005000000................
0x12040fc010080b0000080b0020080c8000080................
0x120506a030080e000008036040080f8000080j.......6.......
0x120604e040080100100800000000000000000N...............
0x1207004000000010000006204008028010080........b...(...
0x1208000000000000000000400000000000100................
0x1209001000000400100800000000000000000....@...........
0x120a004000000000001000100000058010080............X...
0x120b000000000000000000400000000000100................
0x120c000000000700100000000000000000000....p...........
0x120d004000000000001000000000080010000................
0x120e000000000000000000400000000000100................
0x120f000000000900100000000000000000000................
0x12100040000000000010000000000a0010000................
0x1211000000000000000000400000000000100................
0x1212000000000b00100000000000000000000................
0x12130040000000000010000000000c0010000................
0x1214000000000000000000400000000000100................
0x1215009040000d00100000000000000000000................
0x12160040000000000010009040000e0010000................
0x121707864010000c21400e404000000000000xd..............
0x121807826160000a61d00e404000000000000x&..............
0x1219078cc330000420600e404000000000000x.3..B..........
0x121a0780e3a0000560000e404000000000000x.:..V..........
0x121b078643a0000160000e404000000000000xd:.............
0x121c0787a3a001c910101e404000000000000xz:.............
0x121d0940b3c01fc020000e404000000000000..<.............
0x121e0900e3c0188010000e404000000000000..<.............
0x121f00500460049004c004500530059005300..F.I.L.E.S.Y.S.
0x1220043005200450045004e0043004f004e00C.R.E.E.N.C.O.N.
0x122104e004500430054002e0043004f005200N.E.C.T...C.O.R.
0x1222045002c00200056004500520053004900E.,. .V.E.R.S.I.
0x122304f004e003d00320036002e0037002e00O.N.=.2.6...7...
0x1224032002e0039003700350034002c0020002...9.7.5.4.,. .
0x12250430055004c0054005500520045003d00C.U.L.T.U.R.E.=.
0x122604e00450055005400520041004c002c00N.E.U.T.R.A.L.,.
0x1227020005000550042004c00490043004b00 .P.U.B.L.I.C.K.
0x122804500590054004f004b0045004e003d00E.Y.T.O.K.E.N.=.
0x12290340032003000440030003200440033004.2.0.D.0.2.D.3.
0x122a0380034003900420037003900390032008.4.9.B.7.9.9.2.
0x122b05c00530043005200450045004e004300\.S.C.R.E.E.N.C.
Embedded PE binary at file offset 0x12478 (~1384448 bytes) 0x12418–0x12558
0x12418320030004400300032004400330038002.0.D.0.2.D.3.8.
0x1242834003900420037003900390032000b004.9.B.7.9.9.2...
0x124385f0045004e0054005200590050004f00_.E.N.T.R.Y.P.O.
0x1244849004e00540009005f00520045005300I.N.T..._.R.E.S.
0x124584f004c005600450052000a0053004300O.L.V.E.R...S.C.
0x124685f005000410059004c004f0041004400_.P.A.Y.L.O.A.D.
0x124784d5a90000300000004000000ffff0000MZ..............
0x12488b8000000000000004000000000000000........@.......
0x1249800000000000000000000000000000000................
0x124a800000000000000000000000080000000................
0x124b80e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x124c869732070726f6772616d2063616e6e6fis program canno
0x124d8742062652072756e20696e20444f5320t be run in DOS
0x124e86d6f64652e0d0d0a2400000000000000mode....$.......
0x124f8504500004c010300293adbf700000000PE..L...):......
0x1250800000000e00022200b01300000ba1400......" ..0.....
0x1251800060000000000004ed9140000200000........N.... ..
0x1252800e01400000000100020000000020000......... ......
0x1253804000000000000000400000000000000................
0x12548002015000002000086c8140003004085. ............@.
0x12558000010000010000000001000001000 ...............
Single section dominates file 0x13569f–0x1357bf
0x13569f6e744c6f67456e74727954797065004dntLogEntryType.M
0x1356af657472696373456e7472795479706500etricsEntryType.
0x1356bf6765745f50726f706572747954797065get_PropertyType
0x1356cf0070726f706572747954797065006461.propertyType.da
0x1356df74615f747970650046696c6553686172ta_type.FileShar
0x1356ef6500436f6d7061726500576865726500e.Compare.Where.
0x1356ff53637265656e436f6e6e6563742e436fScreenConnect.Co
0x13570f72650049734265666f726500436f6e63re.IsBefore.Conc
0x13571f61744265666f7265006765745f497343atBefore.get_IsC
0x13572f68616e6e656c53656375726500736574hannelSecure.set
0x13573f5f49734368616e6e656c536563757265_IsChannelSecure
0x13574f004661696c7572650073686f756c6445.Failure.shouldE
0x13575f6e73757265004c6f63616c46696c6552nsure.LocalFileR
0x13576f65636f72645369676e61747572650043ecordSignature.C
0x13577f656e7472616c4469726563746f727946entralDirectoryF
0x13578f696c655265636f72645369676e617475ileRecordSignatu
0x13579f726500456e644f6643656e7472616c44re.EndOfCentralD
0x1357af69726563746f72795265636f72645369irectoryRecordSi
0x1357bf676e617475726500496e7374616e gnature.Instan
SafeBoot Minimal or Network service registration 0x932014–0x932304
0x9320146d6d616e64225b494e5354414c4c4c4fmmand"[INSTALLLO
0x932024434154494f4e5d53637265656e436f6eCATION]ScreenCon
0x9320346e6563742e57696e646f7773436c6965nect.WindowsClie
0x9320446e742e65786522202225312272656733nt.exe" "%1"reg3
0x93205438333143304333364439434534344243831C0C36D9CE44BC
0x932064334536464145364631363142454138533E6FAE6F161BEA8S
0x932074797374656d5c43757272656e74436f6eystem\CurrentCon
0x93208474726f6c5365745c436f6e74726f6c5ctrolSet\Control\
0x93209453616665426f6f745c4e6574776f726bSafeBoot\Network
0x9320a45c5b534552564943455f4e414d455d53\[SERVICE_NAME]S
0x9320b465727669636572656732374246423945ervicereg27BFB9E
0x9320c4334241443441413039364137344444303BAD4AA096A74DD0
0x9320d446373644313745443553595354454d5cF76D17ED5SYSTEM\
0x9320e443757272656e74436f6e74726f6c5365CurrentControlSe
0x9320f4745c436f6e74726f6c5c4c7361417574t\Control\LsaAut
0x93210468656e7469636174696f6e205061636bhentication Pack
0x932114616765735b7e5d5b2353637265656e43ages[~][#ScreenC
0x9321246f6e6e6563742e57696e646f77734175onnect.WindowsAu
0x9321347468656e7469636174696f6e5061636bthenticationPack
0x9321446167652e646c6c5d7265673636444344age.dll]reg66DCD
0x932154374433303343363238374445354632427D303C6287DE5F2B
0x9321644131454546314232453733434c534944A1EEF1B2E73CLSID
0x9321745c5b43524544454e5449414c5f50524f\[CREDENTIAL_PRO
0x93218456494445525f434c4153535f49445d5bVIDER_CLASS_ID][
0x93219450726f647563744e616d655d20437265ProductName] Cre
0x9321a464656e7469616c2050726f7669646572dential Provider
0x9321b472656734383445433330373931344231reg484EC307914B1
0x9321c43532444441323141383545393732464652DDA21A85E972FF
0x9321d4453841434c5349445c5b43524544454eE8ACLSID\[CREDEN
0x9321e45449414c5f50524f56494445525f434cTIAL_PROVIDER_CL
0x9321f44153535f49445d5c496e70726f635365ASS_ID]\InprocSe
0x9322047276657233325b2353637265656e436frver32[#ScreenCo
0x9322146e6e6563742e57696e646f7773437265nnect.WindowsCre
0x93222464656e7469616c50726f76696465722edentialProvider.
0x932234646c6c5d726567363237313444303538dll]reg62714D058
0x932244364643323738364233323841393145466FC2786B328A91EF
0x93225433373031423437546872656164696e673701B47Threading
0x9322644d6f64656c41706172746d656e747265ModelApartmentre
0x93227467444244454541353030443043423730gDBDEEA500D0CB70
0x9322843633443436313930383537333631324463D461908573612D
0x932294312d72656732304436444635373945391-reg20D6DF579E9
0x9322a4374337353645464643453830373242427C756EFFCE8072BB
0x9322b43732433235536f6674776172655c4d6972C25Software\Mi
0x9322c463726f736f66745c57696e646f77735ccrosoft\Windows\
0x9322d443757272656e7456657273696f6e5c41CurrentVersion\A
0x9322e4757468656e7469636174696f6e5c4372uthentication\Cr
0x9322f46564656e7469616c2050726f76696465edential Provide
0x93230472735c5b43524544454e5449414c5f50rs\[CREDENTIAL_P

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.