Hostile ^92% Download

Main.exe

Ransomware with credential theft

Discord webhook receives potentially sensitive dataIndicators of Discord exfiltration

SHA-2567030690f5b12e41b5957190a95922d615ba5e95a1589adad10b1eba76387a4df

URLhttps://tria.ge/api/v0/samples/261002-sn8n4svt9q/sample

MaleculeK₃(Li₁₈Mc₄Te₂)O₁₃(Eu₂I₇Al₃As₁₆C₉Ca₃CoDy₂Er₉La₂P₃PrS₂)H₁₁(Cm₃₆Cr₂₂Db₂₂DsF₃₇Hf₉Mg₉Os₃₄Po₃₄Ti₃U₆)Md₈(Bi₃₀Bk₂In₂Pa₆PmPt₃Si₄)Th

Evidence

Convert SID to string representation 0x2dfd8–0x2e258

⋯3 more rows
0x2e00854636c5f4e6577537472696e674f626aTcl_NewStringObj
0x2e018000000000000000054636c5f4e657742........Tcl_NewB
0x2e02879746541727261794f626a0000000000yteArrayObj.....
0x2e03854636c5f536574566172324578000000Tcl_SetVar2Ex...
⋯10 more rows
0x2e0e870006f00720074002000730079006d00p.o.r.t. .s.y.m.
0x2e0f862006f006c0020002500680073002000b.o.l. .%.h.s. .
0x2e108660072006f006d00200054006b002000f.r.o.m. .T.k. .
⋯5 more rows
0x2e1684b207374727563747572652e0a000000K structure.....
0x2e17800000000000000004600610069006c00........F.a.i.l.
0x2e18865006400200074006f00200065007800e.d. .t.o. .e.x.
⋯13 more rows

PyInstaller contents directory option 0x2e910–0x2e9f0

⋯3 more rows
0x2e94050795f47494c5f44495341424c454400Py_GIL_DISABLED.
0x2e9507079692d72756e74696d652d746d7064pyi-runtime-tmpd
0x2e96069720000000000007079692d636f6e74ir......pyi-cont
0x2e970656e74732d6469726563746f72790000ents-directory..
0x2e9807079692d64697361626c652d77696e64pyi-disable-wind
⋯7 more rows

PyInstaller embedded PKG archive error 0x2eba0–0x2eca0

⋯3 more rows
0x2ebd02d0038002e000a000000000000000000-.8.............
0x2ebe0436f756c64206e6f74206c6f61642050Could not load P
0x2ebf079496e7374616c6c6572277320656d62yInstaller's emb
0x2ec00656464656420504b4720617263686976edded PKG archiv
0x2ec10652066726f6d20746865206578656375e from the execu
0x2ec207461626c6520282573290a0000000000table (%s)......
0x2ec30436f756c64206e6f7420736964652d6cCould not side-l
⋯7 more rows

PyInstaller base library ZIP path 0x2ee30–0x2ef00

⋯3 more rows
0x2ee6064000000757466380000000064657600d...utf8....dev.
0x2ee7025735c626173655f6c6962726172792e%s\base_library.
0x2ee807a6970000000000025735c707974686fzip.....%s\pytho
0x2ee906e25642e25645c6c69622d64796e6c6fn%d.%d\lib-dynlo
⋯7 more rows

PyInstaller MEIPASS runtime directory 0x2f4be–0x2f62e

⋯3 more rows
0x2f4ee00004661696c656420746f2067657420..Failed to get 
0x2f4fe5f4d4549504153532061732050794f62_MEIPASS as PyOb
0x2f50e6a6563742e0a000000005f4d45495041ject......_MEIPA
⋯6 more rows
0x2f57e74616c6c65725f70797a000000000000taller_pyz......
0x2f58e000050595a206172636869766520656e..PYZ archive en
0x2f59e747279206e6f7420666f756e6420696etry not found in
0x2f5ae2074686520544f43210a000000000000 the TOC!.......
0x2f5be000025553f256c6c75004661696c6564..%U?%llu.Failed
⋯7 more rows