Hostile ^100% Download

2026-10-01_f503b5a1b4c7d38f6cc9a87df1b36f17_glassworm_icedid_luca-stealer_njrat_stealc

Multi-family stealer with evasion

Detects binaries and memory artifacts referencing sandbox product IDsMultiple browser wallet extension IDs

SHA-2567ce4b1db425bc881a4cbbce7178d25db41db1a4e2b50f31f81373bd925dcd417

URLhttps://tria.ge/api/v0/samples/261003-w588ravcpd/sample

MaleculeK₂(Am₃Li)O₈(Al₂CaDy₂As₄CCoEr₄Pr)H₁₀(Cm₃Cr₄Db₅DsF₁₁Hf₄Mg₃Os₂₁Po₁₃Ti)Md₄(Bi₇BkSi)Th

Evidence

Binance Wallet extension ID 0x3c0–0x6b0

⋯3 more rows
0x3f000000000000000000000000000000000................
0x40040534883ec20b948000000e864811e00@SH.. .H....d...
0x410488900488940084889401066c7401801[email protected][email protected].@..
⋯17 more rows
0x53048895c241848897c242055488dac24c0H.\$.H.|$ UH..$.
0x540f2ffff4881ec400e000065488b042558[email protected]..%X
0x550000000488b38bab02b00004803d7c702...H.8..+..H....
0x56041757468c74204656e7469c742086361Auth.B.enti.B.ca
0x570746f66c7420c72000f57c00f11442440tof.B.r..W...D$@
0x5800f57c9660f7f4c245048c7c3ffffffff.W.f..L$PH......
0x5904c8bc349ffc042803c020075f6488d4cL..I..B.<..u.H.L
⋯10 more rows
0x64049ffc042803c020075f6488d4d80e84dI..B.<..u.H.M..M
0x650b0030090ba382d00004803d7c7026668.....8-..H....fh
0x660626fc7420468696d61c74208656c626fbo.B.hima.B.elbo
0x670c7420c68706a62c74210626c6463c742.B.hpjb.B.bldc.B
0x680146e67636ec7421861706e64c7421c6f.ngcn.B.apnd.B.o
⋯3 more rows

Coin98 Wallet extension ID 0x80c–0x9fc

⋯5 more rows
0x85c4d40e83dae030090ba682c00004803d7M@.=.....h,..H..
0x86cc70261656163c74204686b6e6dc74208..aeac.B.hknm.B.
0x87c65667068c7420c65706363c74210696fefph.B.epcc.B.io
0x88c6e62c742146f6f6863c742186b6f6e6fnb.B.oohc.B.kono
⋯3 more rows
0x8cc4d60e8cdad030090ba803100004803d7M`........1..H..
0x8dcc702436f696ec7420462617365c64208..Coin.B.base.B.
0x8ec000f57c00f1185800000000f57c9660f..W.........W.f.
0x8fc7f8d900000004c8bc349ffc042803c02......L..I..B.<.
0x90c0075f6488d8d80000000e885ad030090.u.H............
0x91cba882600004803d7c702686e6661c742..&..H....hnfa.B
0x92c046e6b6e6fc742086366656fc7420c66.nkno.B.cfeo.B.f
0x93c626464c742106763696ac742146e6d68bdd.B.gcij.B.nmh
0x94c6ec74218666e6b64c7421c6e616164c6n.B.fnkd.B.naad.
⋯11 more rows

Exodus wallet extension ID 0xc70–0xda0

⋯5 more rows
0xcc00000e8d9a9030090bab82f00004803d7........../..H..
0xcd0c70261686f6cc7420470666469c74208..ahol.B.pfdi.B.
0xce0616c6a67c7420c6a66686fc742106d69aljg.B.jfho.B.mi
0xcf0686bc742146a626d67c742186a69646chk.B.jbmg.B.jidl
⋯11 more rows

SafePal extension ID 0x126f–0x139f

⋯5 more rows
0x12bf0000e8daa3030090ba782b00004803d7.........x+..H..
0x12cfc7026a626c6ec74204646c6970c74208..jbln.B.dlip.B.
0x12df656f6770c7420c61666e6cc742106468eogp.B.afnl.B.dh
0x12ef676dc7421461706167c7421863636366gm.B.apag.B.cccf
⋯11 more rows

Sandbox instrumentation module name 0x2608b8–0x260ba8

⋯5 more rows
0x26090877006100720065004900440000000000w.a.r.e.I.D.....
0x26091873626965646c6c2e646c6c0000000000sbiedll.dll.....
0x2609287073746f7265632e646c6c0000000000pstorec.dll.....
⋯4 more rows
0x2609785378496e2e646c6c0000000000000000SxIn.dll........
0x2609887770657370792e646c6c000000000000wpespy.dll......
0x2609984e74506f776572496e666f726d617469NtPowerInformati
⋯13 more rows
0x260a7875006300740049006400000000000000u.c.t.I.d.......
0x260a8835353237342d3634302d32363733303655274-640-267306
0x260a98342d32333935300037363438372d36344-23950.76487-64
0x260aa8342d333137373033372d3233353130004-3177037-23510.
0x260ab837363438372d3333372d38343239393576487-337-842995
0x260ac8352d3232363134004e744f70656e4d755-22614.NtOpenMu
0x260ad874616e7400000000530061006e006400tant....S.a.n.d.
⋯13 more rows