Hostile ^92% Download

2026-10-02_a93ccbaf610a1d71c92120ee936859af_coinminer_darkgate_elex_glassworm_rhadamanthys_stop

VMProtect packed malware dropper

Resource loader with registry and anti-debugExplicitly targets specific AV/EDR products for termination

SHA-25659a1cdf8027cd3290bb0015a4d0da4f143f2911ad4d6b07a843c4a99cd2ac9ae

URLhttps://tria.ge/api/v0/samples/261003-gwy9vs1fnc/sample

MaleculeK₂(McLi)O₁₁(C₄I₃As₁₇Dy₄Er₁₁Al₂CaCoP₅Pr₂S)H₁₁(Cm₁₈Cr₄Db₇DsF₁₆HfMg₂Os₂₉Po₁₄TiU₅)Md₆(Bi₁₈HePaSi)

Evidence

Create registry key via WinAPI 0xb9d98–0xba088

⋯3 more rows
0xb9dc853006f00660074004d00670072002e00S.o.f.t.M.g.r...
0xb9dd865007800650000003300360030007200e.x.e...3.6.0.r.
0xb9de8700073002e0065007800650000000000p.s...e.x.e.....
0xb9df8330036003000720070002e00650078003.6.0.r.p...e.x.
0xb9e08650000003300360030006c0065006100e...3.6.0.l.e.a.
0xb9e186b00660069007800650072002e006500k.f.i.x.e.r...e.
0xb9e2878006500000000005a00680075006400x.e.....Z.h.u.d.
0xb9e386f006e006700460061006e0067007900o.n.g.F.a.n.g.y.
0xb9e4875002e00650078006500000033003600u...e.x.e...3.6.
0xb9e583000530044002e0065007800650000000.S.D...e.x.e...
0xb9e6853004f00460054005700410052004500S.O.F.T.W.A.R.E.
⋯7 more rows
0xb9ee86f006d00000000002e00650078006500o.m.......e.x.e.
0xb9ef8000000000000000053004f0046005400........S.O.F.T.
0xb9f0857004100520045005c004d0069006300W.A.R.E.\.M.i.c.
0xb9f1872006f0073006f00660074005c005700r.o.s.o.f.t.\.W.
0xb9f2869006e0064006f007700730020004e00i.n.d.o.w.s. .N.
0xb9f3854005c00430075007200720065006e00T.\.C.u.r.r.e.n.
0xb9f487400560065007200730069006f006e00t.V.e.r.s.i.o.n.
⋯9 more rows
0xb9fe87300740061006c006c00530074007200s.t.a.l.l.S.t.r.
0xb9ff869006e006700000075006e0069006e00i.n.g...u.n.i.n.
0xba008730074002e0065007800650000000000s.t...e.x.e.....
0xba0185000750062006c006900730068006500P.u.b.l.i.s.h.e.
0xba0287200000044006900730070006c006100r...D.i.s.p.l.a.
0xba0387900560065007200730069006f006e00y.V.e.r.s.i.o.n.
0xba0480000000044006900730070006c006100....D.i.s.p.l.a.
0xba05879004e0061006d006500000044006900y.N.a.m.e...D.i.
0xba068730070006c0061007900490063006f00s.p.l.a.y.I.c.o.
0xba0786e0000005c005500740069006c007300n...\.U.t.i.l.s.
0xba0885c003300360030004600650065006400\.3.6.0.F.e.e.d.

Security service process images 0xbbb7c–0xbbcfc

⋯7 more rows
0xbbbec65006300740041005000490032000000e.c.t.A.P.I.2...
0xbbbfc6100760070002e006500780065000000a.v.p...e.x.e...
0xbbc0c0000000053004f004600540057004100....S.O.F.T.W.A.
0xbbc1c520045005c004b006100730070006500R.E.\.K.a.s.p.e.
0xbbc2c720073006b0079004c00610062005c00r.s.k.y.L.a.b.\.
⋯13 more rows

crashreport.dll sideload module name 0xc1615–0xc1735

⋯5 more rows
0xc1665000000496e697469616c697a6500005c...Initialize..\
0xc167500430072006100730068005200650070.C.r.a.s.h.R.e.p
0xc1685006f00720074002e0064006c006c0000.o.r.t...d.l.l..
⋯11 more rows

PE/MZ binary embedded in resource section 0x312de0–0x312f60

⋯7 more rows
0x312e50524f0c6dda858e287a957904e27f0150RO.m...(z.y....P
0x312e604d5a90000300000004000000ffff0000MZ..............
0x312e70b8000000000000004000000000000000........@.......
0x312e8000000000000000000000000000000000................
0x312e90000000000000000000000000f8000000................
⋯13 more rows

PE version metadata includes FileVersion 0x8e86d6–0x8e8826

0x8e86d601000904000090000000a070b9005001...........p..P.
0x8e86e60000e404000000000000f071b9005a01...........q..Z.
0x8e86f60000e404000000000000500134000000..........P.4...
0x8e8706560053005f0056004500520053004900V.S._.V.E.R.S.I.
0x8e87164f004e005f0049004e0046004f000000O.N._.I.N.F.O...
⋯6 more rows
0x8e8786300038003000340030003400620030000.8.0.4.0.4.b.0.
0x8e8796000036000b000100460069006c006500..6.....F.i.l.e.
0x8e87a6560065007200730069006f006e000000V.e.r.s.i.o.n...
0x8e87b6000031002e0030002e0030002e003100..1...0...0...1.
⋯7 more rows