Hostile 93% Download

2026-09-26_597596a5bbaa88db6c66a22e626469cc_amadey_coinminer_elex_glassworm_hawkeye_magniber_maze_remcos_smoke-loader_stealc_zxxz

Trojanized uTorrent with malware

LSASS memory dump via MiniDump APIResource anti-debug memory loader
SHA-25672bd06ca4bd455d268e59725f3390572ee0e474a3e68bb3484daa1bd962e3036
URLhttps://tria.ge/api/v0/samples/260927-tzt6jatxg1/sample
MaleculeK₂(LiTe)O₁₃(C₁₉CaCo₄Er₁₇P₄As₁₇Dy₈Pr₂Xe₂AlI₄LaS₂)H₁₀(Po₂₄Cm₄₀Cr₂Db₂₀F₁₇Hf₆Mg₂Os₂₉TiU₁₂)Md₈(Bi₂₀BkHePaPt₂Si₄)

Evidence

Modify memory page protection 0x222f98–0x223288
0x222f98a417400098174000801740001f174000..@...@...@...@.
0x222fa83e174000c8174000fd1640005e174000>.@...@...@.^.@.
0x222fb815174000e5164000481740006a174000..@[email protected][email protected].@.
0x222fc854174000f1164000b017400028184000T.@...@...@.(.@.
0x222fd8d4174000581840004c18400040184000[email protected][email protected].@.@.@.
0x222fe8e01740001c184000f817400034184000..@...@[email protected].@.
0x222ff81018400004184000ec17400064184000..@...@[email protected].@.
0x2230088b1840007f184000d3184000c7184000..@...@...@...@.
0x223018df184000f7184000eb184000bb184000..@...@...@...@.
0x223028af184000271940001b1940000f194000..@.'.@...@...@.
0x22303833194000a318400097184000031940003.@...@...@...@.
0x223048701940003f19400064194000c4194000p.@[email protected].@...@.
0x2230589d194000eb194000f7194000031a4000..@...@...@...@.
0x223068df1940000f1a40001b1a4000361a4000..@...@[email protected].@.
0x2230784c1a4000641a40007a1a4000861a4000[email protected][email protected].@...@.
0x223088401a4000581a40009c1a4000a81a4000@[email protected].@...@...@.
0x223098b41a4000c01a4000cc1a4000e71a4000..@...@...@...@.
0x2230a8071b4000121b40001e1b40002a1b4000..@...@...@.*.@.
0x2230b8361b4000421b40004e1b4000971b4000[email protected][email protected].@...@.
0x2230c88b1b4000751b4000811b4000c21b4000[email protected].@...@...@.
0x2230d8ce1b4000da1b4000f51b4000011c4000..@...@...@...@.
0x2230e80d1c40002f1c4000191c4000451c4000..@./.@[email protected].@.
0x2230f8511c4000801c40008c1c4000981c4000Q.@...@...@...@.
0x223108a41c4000bf1c4000de1c4000f81c4000..@...@...@...@.
0x223118df1e4000841f4000941d4000d0204000..@...@...@.. @.
0x2231282a2040003a1e4000501e4000f51e4000* @.:[email protected].@...@.
0x223138041d4000402040009a1f4000aa1d4000..@.@ @...@...@.
0x22314829224000ed214000f9214000e1214000)"@..!@..!@..!@.
0x2231584d224000882240000522400011224000M"@.."@.."@.."@.
0x2231681d224000352240007c22400041224000."@.5"@.|"@.A"@.
0x223178a6214000b2214000522140003a214000.!@[email protected]!@.:!@.
0x22318822214000f2204000e6204000fe204000"!@.. @.. @.. @.
0x2231982e214000162140000a2140009a214000.!@..!@..!@..!@.
0x2231a8462140006a2140005e21400076214000[email protected]!@.^[email protected]!@.
0x2231b88e214000822140009422400001244000.!@..!@.."@..$@.
0x2231c84d24400069234000db23400027244000[email protected]#@..#@.'$@.
0x2231d8f622400073244000b52340008f234000."@.s$@..#@..#@.
0x2231e8aa22400011234000d022400037234000."@..#@.."@.7#@.
0x2231f85d23400099244000bf24400020264000]#@..$@..$@. &@.
0x2232086c26400088254000fa25400046264000l&@..%@..%@.F&@.
0x2232182125400092264000d4254000ae254000!%@..&@..%@..%@.
0x223228d52440003c254000fb24400062254000.$@.<%@[email protected]%@.
0x22323875284000c1284000dd2740004f284000u(@..(@..'@.O(@.
0x2232489b28400076274000e728400029284000.(@.v'@..(@.)(@.
0x22325803284000de2640009127400004274000.(@..&@..'@..'@.
0x223268b7274000502740002a274000b8264000.'@.P'@.*'@..&@.
0x223278582a4000a42a4000c0294000322a4000X*@..*@..)@.2*@.
0x2232887e2a400059294000ca2a40000c2a4000~*@.Y)@..*@..*@.
Large PE with elevated code entropy 0x2241dc–0x22437c
0x2241dc7300000043006f006e00740065006e00s...C.o.n.t.e.n.
0x2241ec74002000540079007000650000000000t. .T.y.p.e.....
0x2241fc8d8a5500b98a550080885500b9885500..U...U...U...U.
0x22420c27644200e7de5b0065925500de6e4000'dB...[.e.U..n@.
0x22421c41174300e01b4a00a9a056009d7c4000A.C...J...V..|@.
0x22422c998f5500a31b4300a9a05600de6e4000..U...C...V..n@.
0x22423c9d7c40009e13430065006e0000000000.|@...C.e.n.....
0x22424c6164730075546f7272656e7400000000ads.uTorrent....
0x22425c687474703a2f2f7570646174652e7574http://update.ut
0x22426c6f7272656e742e636f6d2f756e696e73orrent.com/unins
0x22427c74616c6c3f747970653d25732d255526tall?type=%s-%U&
0x22428c683d257326763d256400000053006f00h=%s&v=%d...S.o.
0x22429c6600740077006100720065005c004d00f.t.w.a.r.e.\.M.
0x2242ac6900630072006f0073006f0066007400i.c.r.o.s.o.f.t.
0x2242bc5c00570069006e0064006f0077007300\.W.i.n.d.o.w.s.
0x2242cc5c00430075007200720065006e007400\.C.u.r.r.e.n.t.
0x2242dc560065007200730069006f006e005c00V.e.r.s.i.o.n.\.
0x2242ec4500780070006c006f00720065007200E.x.p.l.o.r.e.r.
0x2242fc5c00460069006c006500450078007400\.F.i.l.e.E.x.t.
0x22430c73005c00250073005c004f0070006500s.\.%.s.\.O.p.e.
0x22431c6e005700690074006800500072006f00n.W.i.t.h.P.r.o.
0x22432c67006900640073005c00250073000000g.i.d.s.\.%.s...
0x22433c0000000053006f006600740077006100....S.o.f.t.w.a.
0x22434c720065005c0043006c00610073007300r.e.\.C.l.a.s.s.
0x22435c650073005c004d0049004d0045005c00e.s.\.M.I.M.E.\.
0x22436c44006100740061006200610073006500D.a.t.a.b.a.s.e.
0x22437c5c004300 \.C.
URL targets .php endpoint 0x226a9c–0x226c3c
0x226a9c656e61626c6564007465787400000000enabled.text....
0x226aac6f6e4f66666572446f776e6c6f61643aonOfferDownload:
0x226abc2025730065756c615f75726c00000000 %s.eula_url....
0x226acc7375627469746c65000000006f6e4f66subtitle....onOf
0x226adc666572446f776e6c6f61643a20476574ferDownload: Get
0x226aec416374697665546f6f6c626172446963ActiveToolbarDic
0x226afc74204e554c4c2100687474703a2f2f25t NULL!.http://%
0x226b0c25732f6f66666572732f257300000000%s/offers/%s....
0x226b1c687474703a2f2f7570646174652e7574http://update.ut
0x226b2c6f7272656e742e636f6d2f696e737461orrent.com/insta
0x226b3c6c6c6f666665722e7068700052657472lloffer.php.Retr
0x226b4c696576654f666665722062726f777365ieveOffer browse
0x226b5c7220255300000000683d257300000000r %S....h=%s....
0x226b6c763d254c64000000773d255800000000v=%Ld...w=%X....
0x226b7c6c3d255500000000633d255500000000l=%U....c=%U....
0x226b8c74623d254c64000063643d254c640000tb=%Ld..cd=%Ld..
0x226b9c62753d254c6400007736343d254c7500bu=%Ld..w64=%Lu.
0x226bac64623d2555000000636c3d2573000000db=%U...cl=%s...
0x226bbc61753d254c640000747375623d256400au=%Ld..tsub=%d.
0x226bcc7376703d254c6400636d703d254c6400svp=%Ld.cmp=%Ld.
0x226bdc6f636d703d254c640000000052657472ocmp=%Ld....Retr
0x226bec696576654f6666657220257300000000ieveOffer %s....
0x226bfc54425265717565737454687265616400TBRequestThread.
0x226c0c44656661756c74005365727665720000Default.Server..
0x226c1c4e6f7450726f7669646564004f666665NotProvided.Offe
0x226c2c724e6f7452656164790000003c002000rNotReady...<. .
0x226c3c26004200610063006b0000 &.B.a.c.k..
Accesses Windows CurrentVersion Run key 0x229b88–0x229d28
0x229b8864000000250073005c00410070007000d...%.s.\.A.p.p.
0x229b986c00690063006100740069006f006e00l.i.c.a.t.i.o.n.
0x229ba800000000250073005c00500072006f00....%.s.\.P.r.o.
0x229bb86700690064000000250073005c005500g.i.d...%.s.\.U.
0x229bc8730065007200430068006f0069006300s.e.r.C.h.o.i.c.
0x229bd865000000250073005c004f0070006500e...%.s.\.O.p.e.
0x229be86e005700690074006800500072006f00n.W.i.t.h.P.r.o.
0x229bf867006900640073000000000000000000g.i.d.s.........
0x229c0853006f00660074007700610072006500S.o.f.t.w.a.r.e.
0x229c185c004d006900630072006f0073006f00\.M.i.c.r.o.s.o.
0x229c28660074005c00570069006e0064006f00f.t.\.W.i.n.d.o.
0x229c38770073005c0043007500720072006500w.s.\.C.u.r.r.e.
0x229c486e007400560065007200730069006f00n.t.V.e.r.s.i.o.
0x229c586e005c00520075006e00000022002500n.\.R.u.n...".%.
0x229c6873002200000000002e006c006e006b00s.".......l.n.k.
0x229c7800000000220020002200250031002200....". .".%.1.".
0x229c8800000000500072006f00670072006100....P.r.o.g.r.a.
0x229c986d002000460069006c00650073000000m. .F.i.l.e.s...
0x229ca85400650072006d0069006e0061007400T.e.r.m.i.n.a.t.
0x229cb86500530065007300730069006f006e00e.S.e.s.s.i.o.n.
0x229cc843006c00690065006e00740049006e00C.l.i.e.n.t.I.n.
0x229cd87300740061006e006300650073002000s.t.a.n.c.e.s. .
0x229ce86600610069006c00650064003b002000f.a.i.l.e.d.;. .
0x229cf8680070003a0030007800250058002000h.p.:.0.x.%.X. .
0x229d0872006500730075006c0074003a002500r.e.s.u.l.t.:.%.
0x229d1864000a000000000049004e0053005400d.......I.N.S.T.
0x229d2841004c004c0044004500420055 A.L.L.D.E.B.U
LSASS or dump-file target reference 0x2d4768–0x2d4a08
0x2d476800000000000000000000000000000000................
0x2d477800000000000000000000000000000000................
0x2d4788630073007200730073002e0065007800c.s.r.s.s...e.x.
0x2d479865000000000000000000000000000000e...............
0x2d47a800000000000000000000000000000000................
0x2d47b800000000000000000000000000000000................
0x2d47c873006d00730073002e00650078006500s.m.s.s...e.x.e.
0x2d47d800000000000000000000000000000000................
0x2d47e800000000000000000000000000000000................
0x2d47f800000000000000000000000000000000................
0x2d480873007600630068006f00730074002e00s.v.c.h.o.s.t...
0x2d481865007800650000000000000000000000e.x.e...........
0x2d482800000000000000000000000000000000................
0x2d483800000000000000000000000000000000................
0x2d484873006500720076006900630065007300s.e.r.v.i.c.e.s.
0x2d48582e006500780065000000000000000000..e.x.e.........
0x2d486800000000000000000000000000000000................
0x2d487800000000000000000000000000000000................
0x2d48886500780070006c006f00720065007200e.x.p.l.o.r.e.r.
0x2d48982e006500780065000000000000000000..e.x.e.........
0x2d48a800000000000000000000000000000000................
0x2d48b800000000000000000000000000000000................
0x2d48c8770069006e0069006e00690074002e00w.i.n.i.n.i.t...
0x2d48d865007800650000000000000000000000e.x.e...........
0x2d48e800000000000000000000000000000000................
0x2d48f800000000000000000000000000000000................
0x2d49086c0073006100730073002e0065007800l.s.a.s.s...e.x.
0x2d491865000000000000000000000000000000e...............
0x2d492800000000000000000000000000000000................
0x2d493800000000000000000000000000000000................
0x2d494806000000080000000000000000000000................
0x2d495806000000200000000000000000000000.... ...........
0x2d496855030000188867002c01000001000000U.....g.,.......
0x2d49784b030000248867002c01000000000000K...$.g.,.......
0x2d49885e030000388867003c00010000000000^...8.g.<.......
0x2d49984d030000cc0f69003c00010000000000M.....i.<.......
0x2d49a858030000d80f69003c00010000000000X.....i.<.......
0x2d49b851030000e40f69004100010001000000Q.....i.A.......
0x2d49c856030000f40f69004100010000000000V.....i.A.......
0x2d49d859030000001069007800000000000000Y.....i.x.......
0x2d49e85b030000101069003c00000000000000[.....i.<.......
0x2d49f8540300001c1069002800000001000000T.....i.(.......
0x2d4a08490300002810690050 I...(.i.P

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.