2026-10-02_862b38e381a73697388870e7c5a755c2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar
Cobalt Strike beacon embedded
Cobalt Strike reflective Beacon DLLDynamically resolved process-hollowing API chain
SHA-2566ddd1217d8a8a452ca8567055a1fe9e1450a09aa74a9d6787587ffdf12fe62ab
Evidence
⋯7 more rows
0x3dd498d9370b00b6370b0095370b0068370b00.7...7...7..h7..
0x3dd4a8433a2f55736572732f534b4f4c2d4e4fC:/Users/SKOL-NO
0x3dd4b854452f4465736b746f702f4c6f616465TE/Desktop/Loade
0x3dd4c8722f7363726970742e676f0000433a2fr/script.go..C:/
0x3dd4d8476f2f7372632f6f732f657865632f6cGo/src/os/exec/l
⋯15 more rows
⋯7 more rows
0x5e319d2a2f2a00256400002573257300000000*/*.%d..%s%s....
0x5e31ad63646e2e257825782e25730077777736cdn.%x%x.%s.www6
0x5e31bd2e257825782e25730000000025732e31.%x%x.%s....%s.1
0x5e31cd25782e257825782e2573000025732e34%x.%x%x.%s..%s.4
0x5e31dd25303878253038782530387825303878%08x%08x%08x%08x
0x5e31ed253038782e2530387825303878253038%08x.%08x%08x%08
⋯4 more rows
0x5e323d30387825303878253038782e2578257808x%08x%08x.%x%x
0x5e324d2e25730025732e332530387825303878.%s.%s.3%08x%08x
0x5e325d25303878253038782530387825303878%08x%08x%08x%08x
0x5e326d253038782e2530387825303878253038%08x.%08x%08x%08
0x5e327d78253038782530387825303878253038x%08x%08x%08x%08
0x5e328d782e2530387825303878253038782530x.%08x%08x%08x%0
0x5e329d38782530387825303878253038782e258x%08x%08x%08x.%
0x5e32ad7825782e257300000000000025732e32x%x.%s......%s.2
0x5e32bd25303878253038782530387825303878%08x%08x%08x%08x
0x5e32cd2530387825303878253038782e253038%08x%08x%08x.%08
0x5e32dd78253038782530387825303878253038x%08x%08x%08x%08
0x5e32ed7825303878253038782e257825782e25x%08x%08x.%x%x.%
0x5e32fd7300000025732e322530387825303878s...%s.2%08x%08x
0x5e330d25303878253038782530387825303878%08x%08x%08x%08x
0x5e331d2e253038782530387825303878253038.%08x%08x%08x%08
0x5e332d7825303878253038782e257825782e25x%08x%08x.%x%x.%
0x5e333d7300000025732e322530387825303878s...%s.2%08x%08x
0x5e334d2530387825303878253038782e253038%08x%08x%08x.%08
0x5e335d78253038782530387825303878253038x%08x%08x%08x%08
0x5e336d782e257825782e257300000025732e31x.%x%x.%s...%s.1
0x5e337d25303878253038782530387825303878%08x%08x%08x%08x
⋯10 more rows
⋯9 more rows
0x5e3a612e5c2a005c2a000025730a0044093009.\*.\*..%s..D.0.
0x5e3a71253032642f253032642f253032642025%02d/%02d/%02d %
0x5e3a813032643a253032643a2530326409257302d:%02d:%02d.%s
0x5e3a910a000000460925493634640925303264....F.%I64d.%02d
0x5e3aa12f253032642f2530326420253032643a/%02d/%02d %02d:
0x5e3ab1253032643a253032640925730a000000%02d:%02d.%s....
0x5e3ac1576f77363444697361626c65576f7736Wow64DisableWow6
0x5e3ad13446735265646972656374696f6e00004FsRedirection..
0x5e3ae1576f773634526576657274576f773634Wow64RevertWow64
⋯8 more rows
0x5e3b7174657320696e2070726f636573733a20tes in process:
0x5e3b8125640000636f756c64206e6f74207772%d..could not wr
0x5e3b9169746520746f2070726f63657373206dite to process m
0x5e3ba1656d6f72793a202564000000636f756cemory: %d...coul
0x5e3bb164206e6f742061646a75737420706572d not adjust per
⋯5 more rows
0x5e3c11656e2070726f636573732025643a2025en process %d: %
0x5e3c2164000000256420697320616e20783634d...%d is an x64
0x5e3c312070726f63657373202863616e277420 process (can't
0x5e3c41696e6a6563742078383620636f6e7465inject x86 conte
0x5e3c516e742900256420697320616e20783836nt).%d is an x86
0x5e3c612070726f63657373202863616e277420 process (can't
0x5e3c71696e6a6563742078363420636f6e7465inject x64 conte
0x5e3c816e742900737973776f77363400000000nt).syswow64....
0x5e3c9173797374656d333200000000436f756csystem32....Coul
⋯3 more rows
⋯3 more rows
0x5e3e29742062696e6420746f20256400000000t bind to %d....
0x5e3e3949455820284e65772d4f626a65637420IEX (New-Object
0x5e3e494e65742e576562636c69656e74292e44Net.Webclient).D
0x5e3e596f776e6c6f6164537472696e67282768ownloadString('h
0x5e3e697474703a2f2f3132372e302e302e313attp://127.0.0.1:
0x5e3e7925752f27290000002525494d504f5254%u/')...%%IMPORT
0x5e3e8925250000436f6d6d616e64206c656e67%%..Command leng
0x5e3e997468202825642920746f6f206c6f6e67th (%d) too long
0x5e3ea9000000000000000049455820284e6577........IEX (New
0x5e3eb92d4f626a656374204e65742e57656263-Object Net.Webc
0x5e3ec96c69656e74292e446f776e6c6f616453lient).DownloadS
0x5e3ed97472696e672827687474703a2f2f3132tring('http://12
0x5e3ee9372e302e302e313a25752f27293b20257.0.0.1:%u/'); %
0x5e3ef973000000706f7765727368656c6c202ds...powershell -
0x5e3f096e6f70202d6578656320627970617373nop -exec bypass
0x5e3f19202d456e636f646564436f6d6d616e64 -EncodedCommand
0x5e3f2920222573220000003f25733d25730000 "%s"...?%s=%s..
0x5e3f3925732625733d25730000000025732573%s&%s=%s....%s%s
0x5e3f493a2025730d0a00003f25730025732625: %s....?%s.%s&%
⋯10 more rows
0x5e3ff949276d20616c726561647920696e2053I'm already in S
0x5e40094d42206d6f6465002573202861646d69MB mode.%s (admi
0x5e40196e290000436f756c64206e6f74206f70n)..Could not op
0x5e4029656e2070726f636573733a2025642028en process: %d (
0x5e4039257529004661696c656420746f20696d%u).Failed to im
0x5e4049706572736f6e61746520746f6b656e20personate token
0x5e405966726f6d202564202825752900000000from %d (%u)....
0x5e40694661696c656420746f206475706c6963Failed to duplic
0x5e4079617465207072696d61727920746f6b65ate primary toke
0x5e40896e20666f722025642028257529000000n for %d (%u)...
0x5e40994661696c656420746f20696d70657273Failed to impers
0x5e40a96f6e617465206c6f67676564206f6e20onate logged on
0x5e40b975736572202564202825752900000000user %d (%u)....
0x5e40c9436f756c64206e6f7420637265617465Could not create
0x5e40d920746f6b656e3a202564000000000000 token: %d......
0x5e40e9485454502f312e3120323030204f4b0dHTTP/1.1 200 OK.
⋯8 more rows
0x5e671d28fb02002cfb020030fb0200798c0000(...,...0...y...
0x5e672d3dfb02000000626561636f6e2e646c6c=.....beacon.dll
0x5e673d005f5265666c6563746976654c6f6164._ReflectiveLoad
0x5e674d65724034000000000000000000000000er@4............
0x5e675d00000000000000000000000000000000................
⋯15 more rows