Hostile 100% Download

2026-09-26_07efaa8c05de3e9c169d63bb0f2674e2_amadey_coinminer_elex_glassworm_magniber_maze_remcos_smoke-loader_stealc_zxxz

Trojanized BitTorrent with malware payloads

LSASS memory dump via MiniDump APIResource anti-debug memory loader
SHA-25662d72cc891594c4354cef26a4fa55c79dc9646ff110a2dfb3e4651c79526ab18
URLhttps://tria.ge/api/v0/samples/260927-ewd8ksydrg/sample
MaleculeK(Li)O₁₃(C₁₉CaCo₅Er₁₁P₄As₁₄Dy₇XeAlI₄LaPr₂S₂)H₁₀(Po₂₄Cm₃₉Cr₂Db₁₈F₁₆Hf₆Mg₂Os₂₇TiU₁₁)Md₇(Bi₁₅HePaPtSi)

Evidence

Modify memory page protection 0x224f98–0x225288
0x224f988517400079174000611740000a174000[email protected][email protected].@...@.
0x224fa829174000a9174000e816400049174000).@...@[email protected].@.
0x224fb800174000d01640003317400055174000..@[email protected][email protected].@.
0x224fc83f174000dc1640009117400009184000?.@...@...@...@.
0x224fd8b5174000391840002d18400021184000[email protected][email protected].@.!.@.
0x224fe8c1174000fd174000d917400015184000..@...@...@...@.
0x224ff8f1174000e5174000cd17400045184000..@...@[email protected].@.
0x2250087618400060184000fa184000e4184000v.@.`.@...@...@.
0x225018101940003c19400026194000ce184000..@.<.@.&.@...@.
0x225028b8184000941940007e19400068194000..@...@[email protected].@.
0x225038aa194000a21840008c18400052194000..@...@[email protected].@.
0x225048f1194000c0194000e5194000451a4000..@...@[email protected].@.
0x2250581e1a40006c1a4000781a4000841a4000[email protected][email protected].@...@.
0x225068601a4000901a40009c1a4000b71a4000`.@...@...@...@.
0x225078cd1a4000e51a4000fb1a4000071b4000..@...@...@...@.
0x225088c11a4000d91a40001d1b4000291b4000..@...@...@.).@.
0x225098351b4000411b40004d1b4000681b4000[email protected][email protected][email protected].@.
0x2250a8881b4000931b40009f1b4000ab1b4000..@...@...@...@.
0x2250b8b71b4000c31b4000cf1b4000181c4000..@...@...@...@.
0x2250c80c1c4000f61b4000021c4000431c4000..@...@[email protected].@.
0x2250d84f1c40005b1c4000761c4000821c4000O.@.[[email protected].@...@.
0x2250e88e1c4000b01c40009a1c4000c61c4000..@...@...@...@.
0x2250f8d21c4000011d40000d1d4000191d4000..@...@...@...@.
0x225108251d4000401d40005f1d4000791d4000%.@.@.@[email protected].@.
0x225118601f400005204000151e400051214000`.@.. @[email protected]!@.
0x225128ab204000bb1e4000d11e4000761f4000. @...@[email protected].@.
0x225138851d4000c12040001b2040002b1e4000..@.. @.. @.+.@.
0x225148aa2240006e2240007a22400062224000."@.n"@.z"@.b"@.
0x225158ce224000092340008622400092224000."@..#@.."@.."@.
0x2251689e224000b6224000fd224000c2224000."@.."@.."@.."@.
0x2251782722400033224000d3214000bb214000'"@.3"@..!@..!@.
0x225188a321400073214000672140007f214000[email protected][email protected]!@..!@.
0x225198af214000972140008b2140001b224000.!@..!@..!@.."@.
0x2251a8c7214000eb214000df214000f7214000.!@..!@..!@..!@.
0x2251b80f224000032240001523400082244000."@.."@..#@..$@.
0x2251c8ce244000ea2340005c244000a8244000.$@..#@.\$@..$@.
0x2251d877234000f42440003624400010244000w#@[email protected]$@..$@.
0x2251e82b2340009223400051234000b8234000+#@..#@.Q#@..#@.
0x2251f8de2340001a25400040254000a1264000.#@..%@.@%@..&@.
0x225208ed264000092640007b264000c7264000.&@..&@.{&@..&@.
0x225218a225400013274000552640002f264000.%@..'@.U&@./&@.
0x22522856254000bd2540007c254000e3254000V%@..%@.|%@..%@.
0x225238f6284000422940005e284000d0284000.(@.B)@.^(@..(@.
0x2252481c294000f727400068294000aa284000.)@..'@.h)@..(@.
0x225258842840005f2740001228400085274000.(@._'@..(@..'@.
0x22526838284000d1274000ab274000392740008(@..'@..'@.9'@.
0x225278d92a4000252b4000412a4000b32a4000.*@.%+@.A*@..*@.
0x225288ff2a4000da2940004b2b40008d2a4000.*@..)@.K+@..*@.
Cleartext http:// URL 0x2261fc–0x22639c
0x2261fc7300000043006f006e00740065006e00s...C.o.n.t.e.n.
0x22620c74002000540079007000650000000000t. .T.y.p.e.....
0x22621c27d3540053d354001ad1540053d15400'.T.S.T...T.S.T.
0x22622cef654200c5455b00ffda5400be704000.eB..E[...T..p@.
0x22623cd3184300e4ff49005b0051007d7e4000..C...I.[.Q.}~@.
0x22624c33d854000e9648005b005100be7040003.T...H.[.Q..p@.
0x22625c7d7e40003015430065006e0000000000}[email protected].....
0x22626c4d4f4e00426974546f7272656e740000MON.BitTorrent..
0x22627c687474703a2f2f7570646174652e7574http://update.ut
0x22628c6f7272656e742e636f6d2f756e696e73orrent.com/unins
0x22629c74616c6c3f747970653d25732d255526tall?type=%s-%U&
0x2262ac683d257326763d256400000053006f00h=%s&v=%d...S.o.
0x2262bc6600740077006100720065005c004d00f.t.w.a.r.e.\.M.
0x2262cc6900630072006f0073006f0066007400i.c.r.o.s.o.f.t.
0x2262dc5c00570069006e0064006f0077007300\.W.i.n.d.o.w.s.
0x2262ec5c00430075007200720065006e007400\.C.u.r.r.e.n.t.
0x2262fc560065007200730069006f006e005c00V.e.r.s.i.o.n.\.
0x22630c4500780070006c006f00720065007200E.x.p.l.o.r.e.r.
0x22631c5c00460069006c006500450078007400\.F.i.l.e.E.x.t.
0x22632c73005c00250073005c004f0070006500s.\.%.s.\.O.p.e.
0x22633c6e005700690074006800500072006f00n.W.i.t.h.P.r.o.
0x22634c67006900640073005c00250073000000g.i.d.s.\.%.s...
0x22635c0000000053006f006600740077006100....S.o.f.t.w.a.
0x22636c720065005c0043006c00610073007300r.e.\.C.l.a.s.s.
0x22637c650073005c004d0049004d0045005c00e.s.\.M.I.M.E.\.
0x22638c44006100740061006200610073006500D.a.t.a.b.a.s.e.
0x22639c5c004300 \.C.
URL targets .php endpoint 0x228b4c–0x228cec
0x228b4c656e61626c6564007465787400000000enabled.text....
0x228b5c6f6e4f66666572446f776e6c6f61643aonOfferDownload:
0x228b6c2025730065756c615f75726c00000000 %s.eula_url....
0x228b7c7375627469746c65000000006f6e4f66subtitle....onOf
0x228b8c666572446f776e6c6f61643a20476574ferDownload: Get
0x228b9c416374697665546f6f6c626172446963ActiveToolbarDic
0x228bac74204e554c4c2100687474703a2f2f25t NULL!.http://%
0x228bbc25732f6f66666572732f257300000000%s/offers/%s....
0x228bcc687474703a2f2f7570646174652e7574http://update.ut
0x228bdc6f7272656e742e636f6d2f696e737461orrent.com/insta
0x228bec6c6c6f666665722e7068700052657472lloffer.php.Retr
0x228bfc696576654f666665722062726f777365ieveOffer browse
0x228c0c7220255300000000683d257300000000r %S....h=%s....
0x228c1c763d254c64000000773d255800000000v=%Ld...w=%X....
0x228c2c6c3d255500000000633d255500000000l=%U....c=%U....
0x228c3c74623d254c64000063643d254c640000tb=%Ld..cd=%Ld..
0x228c4c62753d254c6400007736343d254c7500bu=%Ld..w64=%Lu.
0x228c5c64623d2555000000636c3d2573000000db=%U...cl=%s...
0x228c6c61753d254c640000747375623d256400au=%Ld..tsub=%d.
0x228c7c7376703d254c6400636d703d254c6400svp=%Ld.cmp=%Ld.
0x228c8c6f636d703d254c640000000052657472ocmp=%Ld....Retr
0x228c9c696576654f6666657220257300000000ieveOffer %s....
0x228cac54425265717565737454687265616400TBRequestThread.
0x228cbc44656661756c74005365727665720000Default.Server..
0x228ccc4e6f7450726f7669646564004f666665NotProvided.Offe
0x228cdc724e6f7452656164790000003c002000rNotReady...<. .
0x228cec26004200610063006b0000 &.B.a.c.k..
Accesses Windows CurrentVersion Run key 0x22bc18–0x22bdb8
0x22bc1861006e0064000000250073005c004100a.n.d...%.s.\.A.
0x22bc28700070006c0069006300610074006900p.p.l.i.c.a.t.i.
0x22bc386f006e0000000000250073005c005000o.n.....%.s.\.P.
0x22bc4872006f00670069006400000025007300r.o.g.i.d...%.s.
0x22bc585c005500730065007200430068006f00\.U.s.e.r.C.h.o.
0x22bc686900630065000000250073005c004f00i.c.e...%.s.\.O.
0x22bc78700065006e0057006900740068005000p.e.n.W.i.t.h.P.
0x22bc8872006f00670069006400730000000000r.o.g.i.d.s.....
0x22bc9853006f00660074007700610072006500S.o.f.t.w.a.r.e.
0x22bca85c004d006900630072006f0073006f00\.M.i.c.r.o.s.o.
0x22bcb8660074005c00570069006e0064006f00f.t.\.W.i.n.d.o.
0x22bcc8770073005c0043007500720072006500w.s.\.C.u.r.r.e.
0x22bcd86e007400560065007200730069006f00n.t.V.e.r.s.i.o.
0x22bce86e005c00520075006e00000022002500n.\.R.u.n...".%.
0x22bcf873002200000000002e006c006e006b00s.".......l.n.k.
0x22bd0800000000220020002200250031002200....". .".%.1.".
0x22bd1800000000500072006f00670072006100....P.r.o.g.r.a.
0x22bd286d002000460069006c00650073000000m. .F.i.l.e.s...
0x22bd385400650072006d0069006e0061007400T.e.r.m.i.n.a.t.
0x22bd486500530065007300730069006f006e00e.S.e.s.s.i.o.n.
0x22bd5843006c00690065006e00740049006e00C.l.i.e.n.t.I.n.
0x22bd687300740061006e006300650073002000s.t.a.n.c.e.s. .
0x22bd786600610069006c00650064003b002000f.a.i.l.e.d.;. .
0x22bd88680070003a0030007800250058002000h.p.:.0.x.%.X. .
0x22bd9872006500730075006c0074003a002500r.e.s.u.l.t.:.%.
0x22bda864000a000000000049004e0053005400d.......I.N.S.T.
0x22bdb841004c004c0044004500420055 A.L.L.D.E.B.U
LSASS or dump-file target reference 0x2d4a08–0x2d4ca8
0x2d4a0800000000000000000000000000000000................
0x2d4a1800000000000000000000000000000000................
0x2d4a28630073007200730073002e0065007800c.s.r.s.s...e.x.
0x2d4a3865000000000000000000000000000000e...............
0x2d4a4800000000000000000000000000000000................
0x2d4a5800000000000000000000000000000000................
0x2d4a6873006d00730073002e00650078006500s.m.s.s...e.x.e.
0x2d4a7800000000000000000000000000000000................
0x2d4a8800000000000000000000000000000000................
0x2d4a9800000000000000000000000000000000................
0x2d4aa873007600630068006f00730074002e00s.v.c.h.o.s.t...
0x2d4ab865007800650000000000000000000000e.x.e...........
0x2d4ac800000000000000000000000000000000................
0x2d4ad800000000000000000000000000000000................
0x2d4ae873006500720076006900630065007300s.e.r.v.i.c.e.s.
0x2d4af82e006500780065000000000000000000..e.x.e.........
0x2d4b0800000000000000000000000000000000................
0x2d4b1800000000000000000000000000000000................
0x2d4b286500780070006c006f00720065007200e.x.p.l.o.r.e.r.
0x2d4b382e006500780065000000000000000000..e.x.e.........
0x2d4b4800000000000000000000000000000000................
0x2d4b5800000000000000000000000000000000................
0x2d4b68770069006e0069006e00690074002e00w.i.n.i.n.i.t...
0x2d4b7865007800650000000000000000000000e.x.e...........
0x2d4b8800000000000000000000000000000000................
0x2d4b9800000000000000000000000000000000................
0x2d4ba86c0073006100730073002e0065007800l.s.a.s.s...e.x.
0x2d4bb865000000000000000000000000000000e...............
0x2d4bc800000000000000000000000000000000................
0x2d4bd800000000000000000000000000000000................
0x2d4be85c3e670000000000d904410000000000\>g.......A.....
0x2d4bf80000000000000000d804340000000000..........4.....
0x2d4c080000000000000000e4047c0000000000..........|.....
0x2d4c18080000000000000001052c0000000000..........,.....
0x2d4c2804000700000000000205250000000000..........%.....
0x2d4c38000000000000000003056a0000000000..........j.....
0x2d4c480000000000000000e504390000000000..........9.....
0x2d4c5804000f000000000005056c0000000000..........l.....
0x2d4c6800000e0000000000f404210000000000..........!.....
0x2d4c7804000500000000001a05160000000000................
0x2d4c8800000300000000000605220000000000..........".....
0x2d4c9800000400000000001b05140000000000................
0x2d4ca80000010000000000fe .........

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.