2026-09-29_aa399fd370411e7d28b9df8c6a9bd9e2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_remcos_smoke-loader_stealc_stop_tofsee
Multi-stage malware with C2 and injection
Redundant numbered C2 domain pools resolved over DoHDynamically resolved process-hollowing API chain
SHA-2567cdf47ad232b829f5eee97f85bca4421827e50a8a4301fbda0410f2b8c2206af
Evidence
0x24edf416c6c6f6300000000f0b8430048b943Alloc......C.H.C
0x24eef000102030405060708090a0b0c0d0e0f................
0x24eff101112131415161718191a1b1c1d1e1f................
0x24f0f202122232425262728292a2b2c2d2e2f !"#$%&'()*+,-./
0x24f1f303132333435363738393a3b3c3d3e3f0123456789:;<=>?
0x24f2f404142434445464748494a4b4c4d4e4f@ABCDEFGHIJKLMNO
0x24f3f505152535455565758595a5b5c5d5e5fPQRSTUVWXYZ[\]^_
0x24f4f606162636465666768696a6b6c6d6e6f`abcdefghijklmno
0x24f5f707172737475767778797a7b7c7d7e7fpqrstuvwxyz{|}~.
0x24f6f003d00000028006e0075006c006c0029.=...(.n.u.l.l.)
0x24f7f0000000000286e756c6c290000000000.....(null).....
0x24f8f00060000060001000010000306000602................
0x24f9f10044545450505050505353000500000..EEE.....50.P..
0x24faf00002820385058070800373030575007..( 8PX...700WP.
0x24fbf00002020080000000008606860606060.. ......`h````
0x24fcf00007870787878780807080000070008..xpxxxx........
0x24fdf08080000080008000708000000000000................
0x24fef00068080868081800000100386808682................
0x24fff80140505454545858585050000303080....EEE......00.
0x2500f50808800080028273850578000070037P.....('8PW....7
0x2501f3030505088000000202880888080000000PP.... (......
0x2502f00606860686868080807787070777070.`h`hhh...xppwpp
0x2503f08080000080008000708000000000000................
0x2504f0015c24100d15c4100d15c41000bd141...A..\A..\A...A
0x2506f20657863657074696f6e000000630063 exception...c.c
0x2507f00730000005500540046002d00380000.s...U.T.F.-.8..
0x2508f005500540046002d00310036004c0045.U.T.F.-.1.6.L.E
0x2509f000000000055004e00490043004f0044.....U.N.I.C.O.D
0x250af004500000047657450726f6365737357.E...GetProcessW
0x250bf696e646f7753746174696f6e00476574indowStation.Get
0x250cf557365724f626a656374496e666f726dUserObjectInform
0x250df6174696f6e410000004765744c617374ationA...GetLast
0x250ef416374697665506f7075700000476574ActivePopup..Get
0x250ff41637469766557696e646f77004d6573ActiveWindow.Mes
0x2510f73616765426f7841005553455233322esageBoxA.USER32.
0x2511f444c4c000020436f6d706c657465204fDLL.. Complete O
0x2512f626a656374204c6f6361746f72270000bject Locator'..
0x2513f0020436c617373204869657261726368. Class Hierarch
0x2514f792044657363726970746f7227000000y Descriptor'...
0x2515f00204261736520436c61737320417272. Base Class Arr
0x2516f6179270000204261736520436c617373ay'.. Base Class
0x2517f2044657363726970746f722061742028 Descriptor at (
0x2518f0020547970652044657363726970746f. Type Descripto
0x2519f7227000000606c6f63616c2073746174r'...`local stat
0x251af69632074687265616420677561726427ic thread guard'
0x251bf00606d616e6167656420766563746f72.`managed vector
0x251cf20636f707920636f6e7374727563746f copy constructo
0x261f4555424003123514e414e00003123494eUT$.1#QNAN..1#IN
0x26204460000003123494e440000003123534eF...1#IND...1#SN
0x26214414e000063005f00250073005f002500AN..c._.%.s._.%.
0x2622473005f00250073000000000025007300s._.%.s.....%.s.
0x262345f00250073005f002500730000000000_.%.s._.%.s.....
0x2624447006c006f00620061006c005c000000G.l.o.b.a.l.\...
0x2625453006500440065006200750067005000S.e.D.e.b.u.g.P.
0x2626472006900760069006c00650067006500r.i.v.i.l.e.g.e.
0x2627400000000530065005400630062005000....S.e.T.c.b.P.
0x2628472006900760069006c00650067006500r.i.v.i.l.e.g.e.
0x2629400000000450078006300650070007400....E.x.c.e.p.t.
0x262a469006f006e003a002000250058002000i.o.n.:. .%.X. .
0x262b42500580020002500580000002564095b%.X. .%.X...%d.[
0x262c425645d000d0a000043003a005c005700%d].....C.:.\.W.
0x262d469006e0064006f00770073005c002500i.n.d.o.w.s.\.%.
0x262e478000000200000000000000041006300x... .......A.c.
0x262f463006500700074002d0045006e006300c.e.p.t.-.E.n.c.
0x263046f00640069006e0067003a0020006700o.d.i.n.g.:. .g.
0x263147a00690070002c002000640065006600z.i.p.,. .d.e.f.
0x263246c006100740065000d000a0043006f00l.a.t.e.....C.o.
0x263346e006e0065006300740069006f006e00n.n.e.c.t.i.o.n.
0x263443a00200043006c006f00730065000d00:. .C.l.o.s.e...
0x263540a000000680074007400700073003a00....h.t.t.p.s.:.
0x263642f002f0000000000416e737765720000/./.....Answer..
0x2637474797065000000006461746100000000type....data....
0x26384770069006e006c006f0067006f006e00w.i.n.l.o.g.o.n.
0x263942e006500780065000000000051756572..e.x.e.....Quer
0x263a47946756c6c50726f63657373496d6167yFullProcessImag
0x263b4654e616d655700006b00650072006e00eNameW..k.e.r.n.
0x263c465006c00330032002e0064006c006c00e.l.3.2...d.l.l.
0x263d4000000007069645b25645d2070706964....pid[%d] ppid
0x263e45b25645d202573000000000075007300[%d] %s.....u.s.
0x263f4650072006e0061006d0065003d002500e.r.n.a.m.e.=.%.
0x2640473002400260024006d00610063003d00s.$.&.$.m.a.c.=.
0x2641425007300240026002400650072007200%.s.$.&.$.e.r.r.
0x264246f0072003d00250073007c0025007300o.r.=.%.s.|.%.s.
0x2643424002600240077006f0072006b007400$.&.$.w.o.r.k.t.
0x264447900700065003d002500640025006400y.p.e.=.%.d.%.d.
0x2645424002600240076006500720073006900$.&.$.v.e.r.s.i.
0x264646f006e003d002500730000002f007200o.n.=.%.s.../.r.
0x26474650070006f00720074002e0070006800e.p.o.r.t...p.h.
0x2648470003f0074007900700065003d006300p.?.t.y.p.e.=.c.
0x264946c00690065006e007400260064006100l.i.e.n.t.&.d.a.
0x264a4740061003d002500730000006e007200t.a.=.%.s...n.r.
0x264b46500700072006f0074002e0000000000e.p.r.o.t.......
0x264c464006f0077006e002e00000068007400d.o.w.n.....h.t.
0x264d47400700073003a002f002f0025007300t.p.s.:././.%.s.
0x264e42f007200650070006f00720074002e00/.r.e.p.o.r.t...
0x265cb00610062006400370062006500630065.a.b.d.7.b.e.c.e
0x265db00640063003300340062006400660033.d.c.3.4.b.d.f.3
0x265eb00630035006600660064003900000000.c.5.f.f.d.9....
0x265fb004700450054000000000000002f0063.G.E.T......./.c
0x2660b002000740069006d0065006f00750074. .t.i.m.e.o.u.t
0x2661b0020002f007400200031002000260020. ./.t. .1. .&.
0x2662b00640065006c0020002f00510020002f.d.e.l. ./.Q. ./
0x2663b00460020002200250073002200000000.F. .".%.s."....
0x2664b0063006d0064002e0065007800650000.c.m.d...e.x.e..
0x2665b006f00700065006e0000000000250078.o.p.e.n.....%.x
0x2666b0000000000696e76616c6964206d6170.....invalid map
0x2667b2f7365743c543e206974657261746f72/set<T> iterator
0x2668b00000000003131342e3131342e313134.....114.114.114
0x2669b2e313134003232332e352e352e350000.114.223.5.5.5..
0x266ab00680071006400300020002500640000.h.q.d.0. .%.d..
0x266bb00680071006400310020002500640000.h.q.d.1. .%.d..
0x266cb00680071006400320020002500640000.h.q.d.2. .%.d..
0x266db0068006f0073007400000000003a0000.h.o.s.t.....:..
0x266eb000d000a000000000068007100640033.........h.q.d.3
0x266fb00200025006400000068007100640034. .%.d...h.q.d.4
0x2670b00200025006400000000000000410063. .%.d.......A.c
0x2671b0063006500700074002d0045006e0063.c.e.p.t.-.E.n.c
0x2672b006f00640069006e0067003a00200067.o.d.i.n.g.:. .g
0x2673b007a00690070002c0020006400650066.z.i.p.,. .d.e.f
0x2674b006c006100740065 .l.a.t.e
0x303bc360030006500350035006300340032006.0.e.5.5.c.4.2.
0x303cc310031003500320062003300660065001.1.5.2.b.3.f.e.
0x303dc320032003700310034003500340037002.2.7.1.4.5.4.7.
0x303ec660032000000000052756e446c6c0000f.2.....RunDll..
0x303fc576f77363444697361626c65576f7736Wow64DisableWow6
0x3040c3446735265646972656374696f6e00004FsRedirection..
0x3041c2d657379730000002d656e616d650000-esys...-ename..
0x3042c2d696e30000000004500580050004c00-in0....E.X.P.L.
0x3043c4f005200450052002e00450058004500O.R.E.R...E.X.E.
0x3044c00000000570069006e00530074006100....W.i.n.S.t.a.
0x3045c30005c00440065006600610075006c000.\.D.e.f.a.u.l.
0x3046c740000002d696e31000000002d656300t...-in1....-ec.
0x3047c2d6569002d6f0000576f773634526576-ei.-o..Wow64Rev
0x3048c657274576f7736344673526564697265ertWow64FsRedire
0x3049c6374696f6e0000005700540053004100ction...W.T.S.A.
0x304ac50004900330032002e0044004c004c00P.I.3.2...D.L.L.
0x304bc000000005754534f70656e5365727665....WTSOpenServe
0x304cc72410000575453456e756d6572617465rA..WTSEnumerate
0x304dc50726f63657373657341000025005300ProcessesA..%.S.
0x304ec000000006500780070006c006f007200....e.x.p.l.o.r.
0x304fc650072002e0065007800650000000000e.r...e.x.e.....
0x3050c440065006600610075006c0074000000D.e.f.a.u.l.t...
0x3051c500072006f0067004d0061006e000000P.r.o.g.M.a.n...
0x3052c5300480045004c004c0044004c004c00S.H.E.L.L.D.L.L.
0x3053c5f004400650066005600690065007700_.D.e.f.V.i.e.w.
0x3054c000000005300790073004c0069007300....S.y.s.L.i.s.
0x3055c74005600690065007700330032000000t.V.i.e.w.3.2...
0x3056c2d667376650000002d66736465000000-fsve...-fsde...
0x3057c2d66706d650000002d666f6b00000000-fpme...-fok....
0x3058c2d666572000000002d6900002d667470-fer....-i..-ftp
0x3059c740000002d667470660000004765744et...-ftpf...GetN
0x305ac617469766553797374656d496e666f00ativeSystemInfo.
0x305bc52746c4765744e7456657273696f6e4eRtlGetNtVersionN
0x305cc756d6265727300004e54444c4c2e444cumbers..NTDLL.DL
0x305dc4c000000720075006e00610073000000L...r.u.n.a.s...
0x305ec57534854435049502e444c4c00000000WSHTCPIP.DLL....
0x305fc2e0000002e0000000000000064003900............d.9.
0x3060c340032003300360062003400340065004.2.3.6.b.4.4.e.
0x3061c360033003700640035003100630034006.3.7.d.5.1.c.4.
0x3062c380033003900340064003300330062008.3.9.4.d.3.3.b.
0x3063c330066003500300034003900000000003.f.5.0.4.9.....
0x3064c00000000680074007400700073003a00....h.t.t.p.s.:.
0x3065c2f002f0064006e0073002e0061006c00/./.d.n.s...a.l.
0x3066c690064006e0073002e0063006f006d00i.d.n.s...c.o.m.
0x3067c2f007200650073006f006c0076006500/.r.e.s.o.l.v.e.
0x3068c3f006e0061006d0065003d0025007300?.n.a.m.e.=.%.s.
0x3069c260074007900700065003d0025006400&.t.y.p.e.=.%.d.
0x306ac0000000068007400740070003a002f00....h.t.t.p.:./.
⋯3 more rows
0x5c64300014c6f61644c696272617279570001..LoadLibraryW..
0x5c65347657453797374656d4469726563746fGetSystemDirecto
0x5c663727957000153657443757272656e7444ryW..SetCurrentD
0x5c67369726563746f727957000150726f6365irectoryW..Proce
0x5c68373734964546f53657373696f6e496400ssIdToSessionId.
0x5c69301536c65657000014372656174655072.Sleep..CreatePr
0x5c6a36f636573735700015465726d696e6174ocessW..Terminat
0x5c6b36550726f6365737300014c6f61644c69eProcess..LoadLi
0x5c6c362726172794100014765745665727369braryA..GetVersi
0x5c6d36f6e457857000143726561746546696conExW..CreateFil
0x5c6e3654d617070696e675700014d61705669eMappingW..MapVi
⋯13 more rows