2026-10-02_b380ecc8b1467940052992b2f755c49c_coinminer_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
Packed dropper with C2 and miner strings
Snojan Rifaien marker cluster in packed dataPacked PE loader with writable entry and dynamic API resolution
SHA-25655fcd6afe3207234e0ce0c1c0d2d4a929c8f97e1a8f07a7d1a58085d76739313
Evidence
⋯3 more rows
0x3000000000000000000000000080000000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯6 more rows
⋯3 more rows
0x16800000000000000000000000000000000................
0x17855505830000000000030010000100000UPX0.....0......
0x18800000000000200000000000000000000................
0x19800000000800000e05550583100000000........UPX1....
⋯3 more rows
0x1f8210d0902010db87db55bb25e878e6602!......}.[.^..f.
0x20800f2450100002c0200260900ab03fbff..E...,..&......
0x218ff558b0d0053420089e55dffe18d7426.U...SB...]...t&
0x22800558b0de4520fddeeffff89e55383ec.U...R.......S..
0x238206850114000e80901ccec83c40c07bd hP.@...........
0x2481404beffffeeff2483ec0c8d45f4c745.......$....E..E
0x258f40000508d45f88b1d1ce04100535068...P.E.....A.SPh
0x268043042fbbb77ee0068000427c97ca1d8.0B..w..h..'.|..
0x2780983c42085c0754410f3bfdbfd9c8b15... ..uD........
0x2882c2789100cbe3483e4f0e80900031cfd,'....4.........
0x2987dbf7fc9bc538b08518b153e52a13f50}....S..Q..>R.?P
0x2a81a9c89c3ffbaeffe1ccc891c2407ccfc............$...
0x2b88b1ddca4a3435151508b3ef6ffee5310.....CQQP.>...S.
0x2c85216c98c83c41083fbe0741950507050R.........t.PPpP
0x2d88b4330e49207eb3e0118c0748450fedf.C0....>...t.P..
0x2e8fd9fe90900006e89f68dbc27c3005589......n....'..U.
0x2f8e583ec146a02ff15d05cd87be7617b00....j....\.{.a{.
0x3081c8db6181f01ffbf21902f048b45088b........!./..E..
0x318008b003d910000c077f97ef7ee3b3d8d...=....w.~..;=.
0x32806724bbb014850506a006a08aeacffbb.rK..HPPj.j.....
0x338effef8010f84d61685c00f85900731c0..............1.
0x3488b5dfcc9c204008de6efddddb4260e00.]...........&..
0x3583d943a74493d9606173d938ceddefd75=.:tI=...=.....u
0x368dbebb53d050874393d1d0675cb5304fb...=..t9=..u.S..
0x3781bfe80745a85c074b49d6a04ffd083c8...tZ..t..j.....
0x388ff6919db7db8eba790df31dbef016d31.i..}.....1...m1
0x3980b0d799a033e820bb64bc8f7288e1108..y..>...K..(...
0x3a83a016a6c582c160b59271550ff97852c:.jlX,..Y'.P...,
0x3b815ecc8ff85db0f841bffffc0c676b8ff.............v..
0x3c8793dc8ff3b9000ae733c427f08a13c1dy=..;...s<B...<.
0x3d8903b7e1f3afef16800f0417acd0c89c2.;~.:..h..Az....
0x3e87cb81585d2d3fdc1fd740f5050680d19|........t.PPh..
0x3f8f9cd1c5a592d0d58f7debd39afc410c9...ZY-.X...9....
0x408c3ef4f5d0877bb0f84bf08a1045f8b00..O].w......._..
0x4183315ffd0843fec630c83c004a31475eb3....?.c......u.
0x428c9c3907fff9d69173f5653232f85c974......i.?VS#/..t
0x12594f00006ff070340fd80282cde41008680......@..(,.A...
0x125a47a43ded0da4100d2095382fbf0d24100zC...A...S....A.
0x125b4f00bf340fd2a120644d3ffffbfa86c69...@.*..D.....li
0x125c46267636a5f732e646c6c005f4a765f52bgcj_s.dll._Jv_R
0x125d46567ff1df0ff6973746572436c617373eg....isterClass
0x125e465731d7262006d61206e756d60ffffffes.rb.ma num`...
0x125f4207761207269666169656e2079616e6a wa rifaien yanj
0x12604652076312e30000013df1db0ff322d25e v1.0.......2-%
0x12614732e6578652d67792a6f726e2068dfbds.exe-gy*orn h..
0x1262473ff797a696b202573200f2263207765s.yzik %s ."c we
0x12634094e4f444525ffff9ffd690a00776200.NODE%....i..wb.
0x126440a0066696c655b5d006e6f6465007365..file[].node.se
0x126546e640073ffffffff75626d6974006874nd.s....ubmit.ht
0x1266474703a2f2f776563616e2e6861737468tp://wecan.hasth
0x12674652e746563686e6fffffffff6c6f6779e.techno....logy
0x126842f75706c6f6164006375726c5f656173/upload.curl_eas
0x12694795f706572666f726d28292077ffba77y_perform() w..w
0x126a4ae6c65643a7b0a9861752067c5726520.led:{..au g.re
0x126b40e2872ee677961c187dbffffffff5b5b.(r.gya.......[[
0x126c4554e495155455d5d58349a28275f8c39UNIQUE]]X4.('_.9
0x126d484e08616cab169af000061626364ffff......i...abcd..
0x126e4ffff65666768696a6b6c6d6e6f707172..efghijklmnopqr
0x126f4737475767778797a4142434445464748stuvwxyzABCDEFGH
0x12704494affef88fa4b4c4d4e4f9254555657IJ....KLMNO.TUVW
0x1271458595a3031323334ffffffff35363738XYZ01234....5678
0x12724390000434f4e4e4543545f4f4e4c59209..CONNECT_ONLY
0x12734697320726571756972656421ff77ffeeis required!.w..
0x12744004661ee6420746f206765741763656e.Fa.d to get.cen
0x127547420736f636b6574ffffffbf00 t socket.....
⋯5 more rows
0x14bf000000000000000000000000000000000................
0x14c0090909090909090909090909090909090................
0x14c1090909090909090909090909090909090................
0x14c2090909090909090909090909090909090................
0x14c3090909090909090909090909090909090................
0x14c4090909090909090909090909090909090................
0x14c5090909090909090909090909090909090................
0x14c6090909090909090909090909090909090................
0x14c7090909090909090909090909090909090................
0x14c8090909090909090909090904d5a900003...........MZ...
0x14c9000000004000000ffff0000b800000000................
0x14ca000000040000000000000000000000000...@............
0x14cb000000000000000000000000000000000................
0x14cc000000000000000e00000000e1fba0e00................
0x14cd0b409cd21b8014ccd2154686973207072...!..L.!This pr
0x14ce06f6772616d2063616e6e6f7420626520ogram cannot be
0x14cf072756e20696e20444f53206d6f64652erun in DOS mode.
0x14d000d0d0a24000000000000006810842d2c...$.......h..-,
0x14d1071ea7e2c71ea7e2c71ea7e32237f7e3fq.~,q.~,q.~2#.~?
0x14d2071ea7e0bb7917e2b71ea7e2c71eb7e5cq.~...~+q.~,q.~\
0x14d3071ea7e32236e7e1c71ea7e3223697ea2q.~2#n~.q.~2#i~.
0x14d4071ea7e32237b7e2d71ea7e526963682cq.~2#{~-q.~Rich,
0x14d5071ea7e00000000000000000000000000q.~.............
0x14d60000000d7a3726200000000504500004c.....rb....PE..L
0x14d7001040074a500500000000000000000e0...t..P.........
0x14d800023010b01090000980100001c1e0000.#..............
0x14d900000002fcd00000010000000b0010000.../............
0x14da000400000100000000200000500000000.@..............
0x14db000000005000000000000000000200000............. ..
0x14dc0040000fb3b0200020000800000100000....;...........
0x14dd010000000001000001000000000000010................
0x14de00000000000000000000000b415020050...............P
0x14df00000000060020004971d000000000000....`...........
0x14e0000000000000000000000000000000000................
0x14e10000000c0b101001c0000000000000000................
0x14e2000000000000000000000000000000000................
0x14e30000000a00d0200400000000000000000.......@........
0x14e4000000000b00100840100000000000000................
0x14e5000000000000000000000000000000000................
0x14e600000002e746578740000001897010000....text........
0x14e7010000000980100000400000000000000................
0x14e8000000000000000200000602e72646174....... ..`.rdat
0x14e90610000b46d000000b00100006e000000a...m.......n...
0x20c35e82affffff83c40c5dc38bff558bec83.*......]...U...
0x20c453d9c344200027405e886200000ff7508=.4B..t... ...u.
0x20c55e8d31e000068ff000000e8151c000059.....h.........Y
0x20c65595dc36a1468c0114200e8ef150000b8Y].j.h..B.......
0x20ca540000e761033c93988e80040000f95c1@..v.3.9...@....
0x20cb5894de4eb048365e4006a01e8fa080000.M....e..j......
0x20cc55985c075086a1ce86effffff59e8323cY..u.j..n...Y.2<
0x20cd5000085c075086a10e85dffffff59e86c....u.j..]...Y.l
0x20ce55d00008365fc00e8af4d000085c07d08]...e....M....}.
0x20cf56a1be8291b000059ff156cb04100a3bcj..)...Y..l.A...
0x20d05504200e8105c0000a3943442 PB...\....4B