Hostile 100% Download

2026-09-26_57521295252715d02ab2cc489c3f5e37_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader

Known malware, C2, injection

Native libcurl Tor client over SOCKSDLL injection via remote LoadLibrary call
SHA-2565baf931bcc2404b037bc63ee600a3824e4e59290982ec4d504f8d5a99497c947
URLhttps://tria.ge/api/v0/samples/260927-t4391atyf1/sample
MaleculeO₄(C₅Er₅As₅Dy)H₈(Os₆Po₁₃Cm₂₂Db₃DsF₁₀Mg₄U)Md₅(Bi₄He₂Si)

Evidence

Hidden cmd.exe launch stack strings 0x3da76f–0x3daa5f
⋯7 more rows
0x3da7df004f0054005c00430049004d00560032.O.T.\.C.I.M.V.2
0x3da7ef000000000053454c4543542043617074.....SELECT Capt
0x3da7ff696f6e2046524f4d2057696e33325f56ion FROM Win32_V
0x3da80f6964656f436f6e74726f6c6c65720000ideoController..
0x3da81f0057514c00430061007000740069006f.WQL.C.a.p.t.i.o
0x3da82f006e0000004e56494449410000414d44.n...NVIDIA..AMD
0x3da83f0053454c454354204e616d652046524f.SELECT Name FRO
0x3da84f4d2057696e33325f50726f636573736fM Win32_Processo
0x3da85f720000000057514c004e0061006d0065r....WQL.N.a.m.e
0x3da86f000000000053454c4543542053657269.....SELECT Seri
⋯4 more rows
0x3da8bf00650072000000000054006100670000.e.r.....T.a.g..
0x3da8cf005c005c002e005c0050004800590053.\.\...\.P.H.Y.S
0x3da8df004900430041004c0044005200490056.I.C.A.L.D.R.I.V
0x3da8ef00450030000000000072620000257370.E.0.....rb..%sp
0x3da8ff257500000025736d256c6c7500257373%u...%sm%llu.%ss
0x3da90f68740000004d454d4c4f41443a202573ht...MEMLOAD: %s
0x3da91f0a000000007262000025735c25730000.....rb..%s\%s..
0x3da92f00726200004552524f52204d454d4c4f.rb..ERROR MEMLO
0x3da93f41443a2043414e542046494e44202573AD: CANT FIND %s
⋯4 more rows
0x3da98f00454e5445522025702025730a000000.ENTER %p %s....
0x3da99f00433a5c57696e646f77735c53797357.C:\Windows\SysW
0x3da9af4f5736345c636d642e65786500435245OW64\cmd.exe.CRE
0x3da9bf4154454420434d442e4558450a000000ATED CMD.EXE....
0x3da9cf007262000068656b2e646c6c0046494c.rb..hek.dll.FIL
⋯3 more rows
0x3daa0f5448524541440a00004652454520504cTHREAD...FREE PL
0x3daa1f53205245540a000000433a5c57696e64S RET....C:\Wind
0x3daa2f6f77735c53797374656d33325c636d64ows\System32\cmd
0x3daa3f2e65786500435245415445442036340a.exe.CREATED 64.
0x3daa4f007262000068656b36342e646c6c0000.rb..hek64.dll..
0x3daa5f006c6f61646d650000454e5452593a20.loadme..ENTRY:
LoadLibraryA name absent from imports 0x3db004–0x3db1d4
⋯4 more rows
0x3db04452656c656173654d7574657800000000ReleaseMutex....
0x3db05443726561746546696c6541004f757470CreateFileA.Outp
0x3db06475744465627567537472696e67570000utDebugStringW..
0x3db07447657446696c6553697a6500456e636fGetFileSize.Enco
0x3db0846465506f696e74657200000056697274dePointer...Virt
0x3db09475616c46726565006c7374726c656e57ualFree.lstrlenW
0x3db0a4000000004c6f61644c69627261727941....LoadLibraryA
0x3db0b4000000004765744d6f64756c6548616e....GetModuleHan
⋯4 more rows
0x3db1044c6f61645265736f7572636500000000LoadResource....
0x3db114556e6d6170566965774f6646696c6500UnmapViewOfFile.
0x3db12447657445786974436f646550726f6365GetExitCodeProce
⋯11 more rows
FTP authentication command token 0x3dba70–0x3dbd60
⋯5 more rows
0x3dbac06561746546696c65000000004e74436ceateFile....NtCl
0x3dbad06f7365004e745175657279566f6c756dose.NtQueryVolum
0x3dbae065496e666f726d6174696f6e46696c65eInformationFile
0x3dbaf0000000004e745175657279496e666f72....NtQueryInfor
⋯6 more rows
0x3dbb6075726541646472657373466f7243616cureAddressForCal
0x3dbb706c6572004e7443726561746554687265ler.NtCreateThre
0x3dbb8061644578000000004765744375727265adEx....GetCurre
0x3dbb906e744469726563746f72794100000000ntDirectoryA....
⋯15 more rows
0x3dbc90574e0a00444f574e4c4f414445442025WN..DOWNLOADED %
0x3dbca0750d0000736f636b7335683a2f2f3132u...socks5h://12
0x3dbcb0372e302e302e313a39303530000000007.0.0.1:9050....
0x3dbcc04355524c204552524f523a2025642025CURL ERROR: %d %
0x3dbcd0730a0000253032686858000072000000s...%02hhX..r...
⋯6 more rows
0x3dbd407c000000444556535452494e473a203c|...DEVSTRING: <
0x3dbd5025733e0a0000000055534552203c2573%s>.....USER <%s
0x3dbd603e205043203c25733e204f574e455220> PC <%s> OWNER
libcurl version string 0x3e2357–0x3e24d7
⋯7 more rows
0x3e23c761756c740021000000434c49454e5420ault.!...CLIENT
0x3e23d76c69626375726c20372e36332e300d0alibcurl 7.63.0..
0x3e23e74d415443482025732025732025730d0aMATCH %s %s %s..
⋯15 more rows
VirtualAllocEx API string reference 0x3ee9fa–0x3eecea
⋯3 more rows
0x3eea2a6e744469726563746f72794100001001ntDirectoryA....
0x3eea3a44656c65746546696c65410073014669DeleteFileA.s.Fi
0x3eea4a6e64436c6f736500770146696e644669ndClose.w.FindFi
0x3eea5a72737446696c65410000880146696e64rstFileA....Find
0x3eea6a4e65787446696c65410064024765744cNextFileA.d.GetL
0x3eea7a6f676963616c44726976657300008600ogicalDrives....
0x3eea8a436c6f736548616e646c65005d024765CloseHandle.].Ge
⋯7 more rows
0x3eeb0a4372656174655468726561640000e500CreateThread....
0x3eeb1a43726561746552656d6f746554687265CreateRemoteThre
0x3eeb2a616400001a0247657443757272656e74ad....GetCurrent
0x3eeb3a546872656164496400000d044f70656eThreadId....Open
0x3eeb4a54687265616400005d01457869745468Thread..].ExitTh
0x3eeb5a72656164000085055465726d696e6174read....Terminat
0x3eeb6a65546872656164007d0553757370656eeThread.}.Suspen
0x3eeb7a6454687265616400c504526573756d65dThread...Resume
0x3eeb8a54687265616400003405536574507269Thread..4.SetPri
0x3eeb9a6f72697479436c6173730000f8024765orityClass....Ge
⋯3 more rows
0x3eebda75616c416c6c6f630000c10556697274ualAlloc....Virt
0x3eebea75616c4672656500bf05566972747561ualFree...Virtua
0x3eebfa6c416c6c6f6345780000130657726974lAllocEx....Writ
0x3eec0a6550726f636573734d656d6f72790000eProcessMemory..
0x3eec1af805576f77363444697361626c65576f..Wow64DisableWo
0x3eec2a77363446735265646972656374696f6ew64FsRedirection
0x3eec3a0000fc05576f77363452657665727457....Wow64RevertW
⋯11 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.