Hostile 93% Download

2026-09-26_5bda19d5c14487f8f67c667d3fa009fc_amadey_coinminer_darkgate_elex_glassworm_graphican_kwampirs_mafia_remcos_rhadamanthys_smoke-loader_stop

Multi-stage malware with C2 and injection

Redundant numbered C2 domain pools resolved over DoHDynamically resolved process-hollowing API chain
SHA-2565eb9c8ce76268ab63820608677d964a5b08baef766c7a43e16486f0c6063097e
URLhttps://tria.ge/api/v0/samples/260926-14sxlasfjd/sample
MaleculeK₃(AmMcTe)O₁₀(C₁₁Er₁₉As₁₉Pr₃Al₂CoDyIP₂S)H₁₁(Os₂₅Cm₂₂CrDb₆DsF₁₄HfMg₆Po₂₁TiU₃)Md₈(Bi₂₃BkHe₂PaPt₂Si)Th₂

Evidence

CreateProcessAsUser API reference 0x24fa0–0x25290
⋯5 more rows
0x24ff0a45f4200805f4200785f42006c5f4200._B.._B.x_B.l_B.
0x250005c5f4200405f4200205f4200f85e4200\_B.@_B. _B..^B.
0x25010d05e4200a85e42007c5e4200605e4200.^B..^B.|^B.`^B.
0x250203c5e4200185e4200ec5d4200c05d4200<^B..^B..]B..]B.
0x25030a45d4200ec6f42000000000000000000.]B..oB.........
0x2504000000000000000000000000000000000................
0x2505000000000000000000000000000000000................
0x2506000000000000000000000000000000000................
0x2507000000000000000000000000000000000................
0x2508000000000000000000000000000000000................
0x2509000000000000000000000000000000000................
0x250a000000000000000000000000000000000................
0x250b000000000000000000000000000000000................
0x250c000000000000000000000000000000000................
0x250d000000000000000000000000000000000................
0x250e000000000000000000000000000000000................
0x250f000000000000000000000000000000000................
0x2510000000000000000000000000000000000................
0x2511000000000000000000000000000000000................
0x2512000000000000000000000000000000000................
0x2513000000000000000002000200020002000........ . . . .
0x2514020002000200020002000280028002800 . . . . .(.(.(.
0x2515028002800200020002000200020002000(.(. . . . . . .
0x2516020002000200020002000200020002000 . . . . . . . .
0x2517020002000200020004800100010001000 . . . .H.......
0x2518010001000100010001000100010001000................
0x2519010001000100010008400840084008400................
0x251a084008400840084008400840010001000................
0x251b010001000100010001000810081008100................
0x251c081008100810001000100010001000100................
0x251d001000100010001000100010001000100................
0x251e001000100010001000100010001001000................
0x251f010001000100010001000820082008200................
0x2520082008200820002000200020002000200................
0x2521002000200020002000200020002000200................
0x2522002000200020002000200020002001000................
0x2523010001000100020000000000000000000...... .........
0x2524000000000000000000000000000000000................
0x2525000000000000000000000000000000000................
0x2526000000000000000000000000000000000................
0x2527000000000000000000000000000000000................
0x2528000000000000000000000000000000000................
0x2529000000000000000000000000000000000................
PHP client-report query template 0x259f4–0x25ce4
⋯5 more rows
0x25a4447006c006f00620061006c005c000000G.l.o.b.a.l.\...
0x25a5453006500440065006200750067005000S.e.D.e.b.u.g.P.
0x25a6472006900760069006c00650067006500r.i.v.i.l.e.g.e.
0x25a7400000000530065005400630062005000....S.e.T.c.b.P.
0x25a8472006900760069006c00650067006500r.i.v.i.l.e.g.e.
0x25a9400000000450078006300650070007400....E.x.c.e.p.t.
⋯13 more rows
0x25b7474797065000000006461746100000000type....data....
0x25b84770069006e006c006f0067006f006e00w.i.n.l.o.g.o.n.
0x25b942e006500780065000000000051756572..e.x.e.....Quer
⋯3 more rows
0x25bd4000000007069645b25645d2070706964....pid[%d] ppid
0x25be45b25645d202573000000000075007300[%d] %s.....u.s.
0x25bf4650072006e0061006d0065003d002500e.r.n.a.m.e.=.%.
0x25c0473002400260024006d00610063003d00s.$.&.$.m.a.c.=.
0x25c1425007300240026002400650072007200%.s.$.&.$.e.r.r.
0x25c246f0072003d00250073007c0025007300o.r.=.%.s.|.%.s.
0x25c3424002600240077006f0072006b007400$.&.$.w.o.r.k.t.
0x25c447900700065003d002500640025006400y.p.e.=.%.d.%.d.
0x25c5424002600240076006500720073006900$.&.$.v.e.r.s.i.
0x25c646f006e003d002500730000002f007200o.n.=.%.s.../.r.
0x25c74650070006f00720074002e0070006800e.p.o.r.t...p.h.
0x25c8470003f0074007900700065003d006300p.?.t.y.p.e.=.c.
0x25c946c00690065006e007400260064006100l.i.e.n.t.&.d.a.
0x25ca4740061003d002500730000006e007200t.a.=.%.s...n.r.
0x25cb46500700072006f0074002e0000000000e.p.r.o.t.......
0x25cc464006f0077006e002e00000068007400d.o.w.n.....h.t.
0x25cd47400700073003a002f002f0025007300t.p.s.:././.%.s.
0x25ce42f007200650070006f00720074002e00/.r.e.p.o.r.t...
Pinned external IPv4 host literal in binary 0x25dcb–0x25f4b
⋯3 more rows
0x25dfb004700450054000000000000002f0063.G.E.T......./.c
0x25e0b002000740069006d0065006f00750074. .t.i.m.e.o.u.t
0x25e1b0020002f007400200031002000260020. ./.t. .1. .&.
0x25e2b00640065006c0020002f00510020002f.d.e.l. ./.Q. ./
0x25e3b00460020002200250073002200000000.F. .".%.s."....
0x25e4b0063006d0064002e0065007800650000.c.m.d...e.x.e..
0x25e5b006f00700065006e0000000000250078.o.p.e.n.....%.x
0x25e6b0000000000696e76616c6964206d6170.....invalid map
0x25e7b2f7365743c543e206974657261746f72/set<T> iterator
0x25e8b00000000003131342e3131342e313134.....114.114.114
0x25e9b2e313134003232332e352e352e350000.114.223.5.5.5..
0x25eab00680071006400300020002500640000.h.q.d.0. .%.d..
⋯10 more rows
tyui54345 numbered SPI domain pool 0x2fbbc–0x2feac
⋯3 more rows
0x2fbec660032000000000052756e446c6c0000f.2.....RunDll..
0x2fbfc576f77363444697361626c65576f7736Wow64DisableWow6
0x2fc0c3446735265646972656374696f6e00004FsRedirection..
0x2fc1c2d657379730000002d656e616d650000-esys...-ename..
0x2fc2c2d696e30000000004500580050004c00-in0....E.X.P.L.
0x2fc3c4f005200450052002e00450058004500O.R.E.R...E.X.E.
0x2fc4c00000000570069006e00530074006100....W.i.n.S.t.a.
0x2fc5c30005c00440065006600610075006c000.\.D.e.f.a.u.l.
0x2fc6c740000002d696e31000000002d656300t...-in1....-ec.
⋯3 more rows
0x2fcac50004900330032002e0044004c004c00P.I.3.2...D.L.L.
0x2fcbc000000005754534f70656e5365727665....WTSOpenServe
0x2fccc72410000575453456e756d6572617465rA..WTSEnumerate
0x2fcdc50726f63657373657341000025005300ProcessesA..%.S.
0x2fcec000000006500780070006c006f007200....e.x.p.l.o.r.
0x2fcfc650072002e0065007800650000000000e.r...e.x.e.....
⋯12 more rows
0x2fdcc756d6265727300004e54444c4c2e444cumbers..NTDLL.DL
0x2fddc4c000000720075006e00610073000000L...r.u.n.a.s...
0x2fdec57534854435049502e444c4c00000000WSHTCPIP.DLL....
⋯4 more rows
0x2fe3c330066003500300034003900000000003.f.5.0.4.9.....
0x2fe4c00000000680074007400700073003a00....h.t.t.p.s.:.
0x2fe5c2f002f0064006e0073002e0061006c00/./.d.n.s...a.l.
0x2fe6c690064006e0073002e0063006f006d00i.d.n.s...c.o.m.
0x2fe7c2f007200650073006f006c0076006500/.r.e.s.o.l.v.e.
0x2fe8c3f006e0061006d0065003d0025007300?.n.a.m.e.=.%.s.
0x2fe9c260074007900700065003d0025006400&.t.y.p.e.=.%.d.
0x2feac0000000068007400740070003a002f00....h.t.t.p.:./.
Runtime Process32First API name 0x32bda–0x32d5a
⋯7 more rows
0x32c4a63657074696f6e46696c746572000000ceptionFilter...
0x32c5a50726f6365737333324e657874570000Process32NextW..
0x32c6a50726f63657373333246697273745700Process32FirstW.
0x32c7a0000437265617465546f6f6c68656c70..CreateToolhelp
0x32c8a3332536e617073686f7400004765745032Snapshot..GetP
0x32c9a726f634164647265737300004f70656erocAddress..Open
⋯12 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.