Hostile ^100% vxunderground-inthewild Download

2026-04-25_c5c155c4f0cb6bd33274bfb9e61f6ebf_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_hawkeye_hellokitty_hijackloader_luca-stealer_lynx_njrat_remcos_rhadamanthys_smoke-loader_stealc_stop_vidar

Multi-stage dropper with malware payloads

Windows binary downloads a file, executes a process, and cleans up a fileRepeated PE images appended by a self-enumerating file rewriter

SHA-2567749ecd774325f31d20f9927f2ac2eb30c7f6586f3f73e6c39e6f186a17ec3c1

MaleculeK₂(Am₄Li)O₆(C₂I₃Er₄As₃Dy₂Pr)H₁₁(Cm₁₄Cr₃Db₇DsF₁₄Hf₇Mg₃Os₃₂Po₁₇TiU₇)Md₈(Bi₁₀BkPaPt₂Si₃V)Th₃

Evidence

English function-word token "this" 0x0–0x130

0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x3000000000000000000000000020010000............ ...
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯14 more rows

Peek at pipe data without reading 0x5afc4–0x5b2b4

⋯3 more rows
0x5aff47d340640a5beac0cb05671927a65d247}[email protected]
0x5b004277bd0118ca900a0c92dbfe8ee140200'{.......-......
0x5b01400000000c000000000000046fd3470a0...........F.4p.
0x5b024aa6c5449ac3f97a27216f98aef140200.lTI.?..r.......
0x5b03400000000c000000000000046ccddd694...........F....
0x5b044684a7541a374bd584a510b78803bf2fbhJuA.t.XJQ.x.;..
0x5b054f0e31b10848800aa003e56f86692a34e.........>V.f..N
0x5b06411729f40b622f63dbd16c5337577832d.r.@.".=...3uw.-
0x5b074cdf64e46a745482fd0b47493f3140200..NF.EH/..t.....
0x5b08400000000c000000000000046354b179b...........F5K..
0x5b094ff40d211a27e00c04fc30871e1140200.@...~..O..q....
0x5b0a400000000c0000000000000461b3974d6...........F.9t.
0x5b0b4d952074e834e67c98610f39d9aab4e5f.R.N.Ng.......N_
0x5b0c43368614f899d31cf46979d49a146e3d53haO..1.F..I.F..
0x5b0d453f73249b4034574800e2498b6635e90S.2I..Et..$..c^.
0x5b0e4bfc14e49b29c65b732d3d21ae8812435..NI..e.2.....$5
0x5b0f4be335142ba856007caedcf9df3bf6b28.3QB..`.......k(
0x5b104d4ba8f43b00779b7267c3d4891140200...C..y.&|=H....
0x5b11400000000c00000000000004635eaa582...........F5...
0x5b124cdd9c5479629e15d2f714e6e7793806d...G.).]/qNnw..m
0x5b134f06a4b448957a3773f02200e949a6a59.jKD.W.w?. ...jY
0x5b1443e01d1118d3400a0c90f27190017e872>....4....'....r
0x5b154ece36046bf243c3b7b648806d0140200..`F.$<;{d......
0x5b16400000000c000000000000046b3f35030...........F..P0
0x5b174b598cf11bb8200aa00bdce0bf6140200................
0x5b18400000000c0000000000000463accbfb4...........F:...
0x5b1942cdb4c42b0297fe99a87c64198788057,.LB.).....A.x.W
0x5b1a44f8c6244bb6371042380b109db85b63eO.bD.cq.#......>
0x5b1b4f965f64ca03ae3ef65729f3d05edf1f7.e.L.:..er.=....
0x5b1c46d9fa247aaae29d317c6f06610ab529em..G..)....f..R.
0x5b1d40df8df49acb84330f5687855902a54c0...I..C0.hxU.*T.
0x5b1e4f04bd11183ee00a0c90dc849809ee388.K.........I....
0x5b1f47835cf11ae6908002b2e1262a20ff1fex5...i..+..b....
0x5b2045e35064e93819b24d7f7cc88d1633c89^5.N...$.....c<.
0x5b214c845174dbe19223be71be365d0b089b6.E.M..";...e....
0x5b224d376bb4c87f7585d0e0ce0703081e233.v.L..X]...p0..3
0x5b2341e4e7646835a98395c3bc3bba11db814.NvF.Z.9\;......
0x5b2443501314d96d96cbfc9671a99448a4d835.1M..l..g..D.M.
0x5b2547409d64e866ef203d80b3810eb140200t..N.n....8.....
0x5b26400000000c0000000000000468f856c5e...........F..l^
0x5b274220e60479afeea3317b67173a7d56563".`G...3..qs..ec
0x5b2840d0fe54587f60da56b6a4f7d0e8bcd7e...E....kjO}...~
0x5b29436c19b4a94114ebd6673ccc34fdebc656..J..N.fs..O..e
0x5b2a4074f274f83a71afca4df7ddd8bdbe9b4.O'O......}.....
0x5b2b4ba34394cb5cc16a1bd2c411c46ba2ba5.49L.....,A.F.+.

Windows ResumeThread API name reference 0x6a022–0x6a1e2

⋯3 more rows
0x6a0527446696c65506f696e7465720000a804tFilePointer....
0x6a062526573756d6554687265616400006402ResumeThread..d.
0x6a0724765744d6f64756c6548616e646c6541GetModuleHandleA
0x6a0820000d1034d756c746942797465546f57....MultiByteToW
0x6a0926964654368617200e20247657454656dideChar...GetTem
0x6a0a270506174684100000d02476574437572pPathA....GetCur
0x6a0b272656e745468726561640000a5034c6frentThread....Lo
⋯8 more rows
0x6a14250726f636573734100009901466f726dProcessA....Form
0x6a15261744d657373616765410000e0024765atMessageA....Ge
0x6a1627454656d7046696c654e616d65410000tTempFileNameA..
0x6a17293024765745072697661746550726f66..GetPrivateProf
⋯7 more rows

Four or more embedded standard PE images 0x6fd80–0x6ff20

⋯7 more rows
0x6fdf000000000000000000000000000000000................
0x6fe004d5a90000300000004000000ffff0000MZ..............
0x6fe10b8000000000000004000000000000000........@.......
0x6fe2000000000000000000000000000000000................
0x6fe30000000000000000000000000f0000000................
⋯15 more rows

URLDownloadToFile API name as string 0x42f188–0x42f258

⋯3 more rows
0x42f1b84f4c4541555433322e646c6c00006800OLEAUT32.dll..h.
0x42f1c855524c446f776e6c6f6164546f46696cURLDownloadToFil
0x42f1d86557000075726c6d6f6e2e646c6c0000eW..urlmon.dll..
0x42f1e800000000000000000000000000000000................
⋯7 more rows