Hostile ^92% Download

2026-09-26_a00446d918e2e08c9fb44f4ce05b3571_cobalt-strike_dosia_luca-stealer_quasar-rat

Named Cobalt Strike, Quasar RAT

Shellcode injection with string obfuscationGarble randomized packages (digit variant)

SHA-25656cd47843aac1afe7d4fd330a0876a53dc8f6733b1e3d72898671cd6aa570336

URLhttps://tria.ge/api/v0/samples/260927-qpy5ysz1cv/sample

MaleculeO₃(ErAs₇Al)H₆(CrDb₂Mg₂Os₆Po₇Ti₂)Md₄(Bi₇PtSi)

Evidence

Many stack-constructed strings detected 0x807d–0x81fd

⋯7 more rows
0x80ed0400488b6d0048ba72756e74696d6520..H.m.H.runtime 
0x80fd48899424cc00000048ba206572726f72H..$....H. error
0x810d3a2048899424d300000031d2be640000: H..$....1..d..
⋯15 more rows

Load PAGE_EXECUTE_READ (0x20) into r8d/r9d 0x285ec–0x286ac

⋯3 more rows
0x2861cc0ffffffff4889c34889ce4c8d442450.....H..H..L.D$P
0x2862c41b9200000004531d24531db31c9e8c1A. ...E1.E1.1...
0x2863c17020090eb1e4889c8488d5c2450b920......H..H.\$P. 
⋯7 more rows

LoadLibraryExA name without IAT import 0x2acf3–0x2afe3

⋯7 more rows
0x2ad63ac245001000048b86b65726e656c3332.$P...H.kernel32
0x2ad73488944246448b86c33322e646c6c0048H.D$dH.l32.dll.H
0x2ad8389442469488b057a8e3900488d4c2464.D$iH..z.9.H.L$d
⋯3 more rows
0x2adc30f8456060000488944243048ba416464..V...H.D$0H.Add
0x2add3446c6c446948899424ad00000048ba72DllDiH..$....H.r
0x2ade36563746f72790048899424b500000048ectory.H..$....H
0x2adf38d9c24ad000000b9100000004889cfe8..$.........H...
0x2ae0359fcffff833d92524a00007509488905Y....=.RJ..u.H..
0x2ae13190e4500eb0c488d3d100e4500e8fb92..E...H.=..E....
0x2ae23020048ba416464566563746f48899424..H.AddVectoH..$
0x2ae333501000048ba726564436f6e746948895...H.redContiH.
0x2ae4394243d01000048ba436f6e74696e7565.$=...H.Continue
0x2ae53488994244001000048ba48616e646c65[email protected]
⋯3 more rows
0x2ae93a10d4500eb0c488d3d980d4500e87b92..E...H.=..E..{.
0x2aea3020048ba4c6f61644c69627248899424..H.LoadLibrH..$
0x2aeb38e00000048be72617279457841004889....H.raryExA.H.
0x2aec3b42495000000488b442430488d9c248e.$....H.D$0H..$.
0x2aed3000000b90f0000004889cf6690e87bfb........H..f..{.
0x2aee3ffff833db4514a00007509488905530d...=.QJ..u.H..S.
0x2aef34500eb0e488d3d4a0d45006690e81b92E...H.=J.E.f....
0x2af03020048ba4c6f61644c69627248895424..H.LoadLibrH.T$
0x2af137f48ba72617279457857004889942486.H.raryExW.H..$.
0x2af23000000488b442430488d5c247fb90f00...H.D$0H.\$....
⋯4 more rows
0x2af730c4500000f95c2eb0231d28815b04e4a.E.......1....NJ
0x2af830048ba61647661706933324889542457.H.advapi32H.T$W
0x2af9348ba6933322e646c6c00488954245c48H.i32.dll.H.T$\H
0x2afa38d442457bb0d0000004889d9e86cfbff.D$W.....H...l..
0x2afb3ff4885c00f845104000048ba53797374.H....Q...H.Syst
0x2afc3656d467548899424df00000048ba7374emFuH..$....H.st
0x2afd3656d46756e6348899424e100000048baemFuncH..$....H.
0x2afe374696f6e3033360048899424e9000000tion036.H..$....

Garble randomized packages (digit variant) 0x41acca–0x41ae9a

⋯5 more rows
0x41ad1a37724275503271492e537472696e67007rBuP2qI.String.
0x41ad2a636c6632334d4d7068442e282a6f754cclf23MMphD.(*ouL
0x41ad3a366d41775a4778292e537472696e67006mAwZGx).String.
0x41ad4a636c6632334d4d7068442e282a6f754cclf23MMphD.(*ouL
0x41ad5a366d41775a4778292e456c656d00636c6mAwZGx).Elem.cl
0x41ad6a6632334d4d7068442e282a6f754c366df23MMphD.(*ouL6m
0x41ad7a41775a4778292e4b696e6400636c6632AwZGx).Kind.clf2
0x41ad8a334d4d7068442e282a6f754c366d41773MMphD.(*ouL6mAw
0x41ad9a5a4778292e4c656e00636c6632334d4dZGx).Len.clf23MM
0x41adaa7068442e282a546a3772427550327149phD.(*Tj7rBuP2qI
0x41adba292e537472696e670075735a684f342e).String.usZhO4.
0x41adca282a696e3066576e3830615f67292e45(*in0fWn80a_g).E
0x41adda72726f7200636c6632334d4d7068442error.clf23MMphD.
0x41adea5a707452345f397a4d0073796e632e28ZptR4_9zM.sync.(
⋯11 more rows

Go garbled method receiver pattern 0x41b095–0x41b295

⋯16 more rows
0x41b195616c2f62797465616c672e4375746f76al/bytealg.Cutov
0x41b1a565720065325f4a62422e282a6a417a5fer.e2_JbB.(*jAz_
0x41b1b56237674754686439292e41737369676eb7gGThd9).Assign
0x41b1c50065325f4a62422e282a6a417a5f6237.e2_JbB.(*jAz_b7
0x41b1d5674754686439292e5368696674006532gGThd9).Shift.e2
0x41b1e55f4a62422e282a6a417a5f6237674754_JbB.(*jAz_b7gGT
⋯11 more rows