2026-10-14_f89f3635971817656e6ea707ec4ae6a8_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar
Cobalt Strike beacon and XMRig miner
Cobalt Strike reflective Beacon DLLDynamically resolved process-hollowing API chain
SHA-2568004de9cd2f9ad2cb5e532fd2c935bbeb8af70d84cc29f4e1489dc1bf1422b6f
Evidence
⋯7 more rows
0x39de98d9370b00b6370b0095370b0068370b00.7...7...7..h7..
0x39dea8433a2f55736572732f534b4f4c2d4e4fC:/Users/SKOL-NO
0x39deb854452f4465736b746f702f4c6f616465TE/Desktop/Loade
0x39dec8722f7363726970742e676f0000433a2fr/script.go..C:/
0x39ded8476f2f7372632f6f732f657865632f6cGo/src/os/exec/l
⋯15 more rows
⋯7 more rows
0x5a3b9d2a2f2a00256400002573257300000000*/*.%d..%s%s....
0x5a3bad63646e2e257825782e25730077777736cdn.%x%x.%s.www6
0x5a3bbd2e257825782e25730000000025732e31.%x%x.%s....%s.1
0x5a3bcd25782e257825782e2573000025732e34%x.%x%x.%s..%s.4
0x5a3bdd25303878253038782530387825303878%08x%08x%08x%08x
0x5a3bed253038782e2530387825303878253038%08x.%08x%08x%08
⋯4 more rows
0x5a3c3d30387825303878253038782e2578257808x%08x%08x.%x%x
0x5a3c4d2e25730025732e332530387825303878.%s.%s.3%08x%08x
0x5a3c5d25303878253038782530387825303878%08x%08x%08x%08x
0x5a3c6d253038782e2530387825303878253038%08x.%08x%08x%08
0x5a3c7d78253038782530387825303878253038x%08x%08x%08x%08
0x5a3c8d782e2530387825303878253038782530x.%08x%08x%08x%0
0x5a3c9d38782530387825303878253038782e258x%08x%08x%08x.%
0x5a3cad7825782e257300000000000025732e32x%x.%s......%s.2
0x5a3cbd25303878253038782530387825303878%08x%08x%08x%08x
0x5a3ccd2530387825303878253038782e253038%08x%08x%08x.%08
0x5a3cdd78253038782530387825303878253038x%08x%08x%08x%08
0x5a3ced7825303878253038782e257825782e25x%08x%08x.%x%x.%
0x5a3cfd7300000025732e322530387825303878s...%s.2%08x%08x
0x5a3d0d25303878253038782530387825303878%08x%08x%08x%08x
0x5a3d1d2e253038782530387825303878253038.%08x%08x%08x%08
0x5a3d2d7825303878253038782e257825782e25x%08x%08x.%x%x.%
0x5a3d3d7300000025732e322530387825303878s...%s.2%08x%08x
0x5a3d4d2530387825303878253038782e253038%08x%08x%08x.%08
0x5a3d5d78253038782530387825303878253038x%08x%08x%08x%08
0x5a3d6d782e257825782e257300000025732e31x.%x%x.%s...%s.1
0x5a3d7d25303878253038782530387825303878%08x%08x%08x%08x
⋯10 more rows
⋯9 more rows
0x5a44612e5c2a005c2a000025730a0044093009.\*.\*..%s..D.0.
0x5a4471253032642f253032642f253032642025%02d/%02d/%02d %
0x5a44813032643a253032643a2530326409257302d:%02d:%02d.%s
0x5a44910a000000460925493634640925303264....F.%I64d.%02d
0x5a44a12f253032642f2530326420253032643a/%02d/%02d %02d:
0x5a44b1253032643a253032640925730a000000%02d:%02d.%s....
0x5a44c1576f77363444697361626c65576f7736Wow64DisableWow6
0x5a44d13446735265646972656374696f6e00004FsRedirection..
0x5a44e1576f773634526576657274576f773634Wow64RevertWow64
⋯8 more rows
0x5a457174657320696e2070726f636573733a20tes in process:
0x5a458125640000636f756c64206e6f74207772%d..could not wr
0x5a459169746520746f2070726f63657373206dite to process m
0x5a45a1656d6f72793a202564000000636f756cemory: %d...coul
0x5a45b164206e6f742061646a75737420706572d not adjust per
⋯5 more rows
0x5a4611656e2070726f636573732025643a2025en process %d: %
0x5a462164000000256420697320616e20783634d...%d is an x64
0x5a46312070726f63657373202863616e277420 process (can't
0x5a4641696e6a6563742078383620636f6e7465inject x86 conte
0x5a46516e742900256420697320616e20783836nt).%d is an x86
0x5a46612070726f63657373202863616e277420 process (can't
0x5a4671696e6a6563742078363420636f6e7465inject x64 conte
0x5a46816e742900737973776f77363400000000nt).syswow64....
0x5a469173797374656d333200000000436f756csystem32....Coul
⋯3 more rows
⋯3 more rows
0x5a4829742062696e6420746f20256400000000t bind to %d....
0x5a483949455820284e65772d4f626a65637420IEX (New-Object
0x5a48494e65742e576562636c69656e74292e44Net.Webclient).D
0x5a48596f776e6c6f6164537472696e67282768ownloadString('h
0x5a48697474703a2f2f3132372e302e302e313attp://127.0.0.1:
0x5a487925752f27290000002525494d504f5254%u/')...%%IMPORT
0x5a488925250000436f6d6d616e64206c656e67%%..Command leng
0x5a48997468202825642920746f6f206c6f6e67th (%d) too long
0x5a48a9000000000000000049455820284e6577........IEX (New
0x5a48b92d4f626a656374204e65742e57656263-Object Net.Webc
0x5a48c96c69656e74292e446f776e6c6f616453lient).DownloadS
0x5a48d97472696e672827687474703a2f2f3132tring('http://12
0x5a48e9372e302e302e313a25752f27293b20257.0.0.1:%u/'); %
0x5a48f973000000706f7765727368656c6c202ds...powershell -
0x5a49096e6f70202d6578656320627970617373nop -exec bypass
0x5a4919202d456e636f646564436f6d6d616e64 -EncodedCommand
0x5a492920222573220000003f25733d25730000 "%s"...?%s=%s..
0x5a493925732625733d25730000000025732573%s&%s=%s....%s%s
0x5a49493a2025730d0a00003f25730025732625: %s....?%s.%s&%
⋯10 more rows
0x5a49f949276d20616c726561647920696e2053I'm already in S
0x5a4a094d42206d6f6465002573202861646d69MB mode.%s (admi
0x5a4a196e290000436f756c64206e6f74206f70n)..Could not op
0x5a4a29656e2070726f636573733a2025642028en process: %d (
0x5a4a39257529004661696c656420746f20696d%u).Failed to im
0x5a4a49706572736f6e61746520746f6b656e20personate token
0x5a4a5966726f6d202564202825752900000000from %d (%u)....
0x5a4a694661696c656420746f206475706c6963Failed to duplic
0x5a4a79617465207072696d61727920746f6b65ate primary toke
0x5a4a896e20666f722025642028257529000000n for %d (%u)...
0x5a4a994661696c656420746f20696d70657273Failed to impers
0x5a4aa96f6e617465206c6f67676564206f6e20onate logged on
0x5a4ab975736572202564202825752900000000user %d (%u)....
0x5a4ac9436f756c64206e6f7420637265617465Could not create
0x5a4ad920746f6b656e3a202564000000000000 token: %d......
0x5a4ae9485454502f312e3120323030204f4b0dHTTP/1.1 200 OK.
⋯8 more rows
0x5a711d28fb02002cfb020030fb0200798c0000(...,...0...y...
0x5a712d3dfb02000000626561636f6e2e646c6c=.....beacon.dll
0x5a713d005f5265666c6563746976654c6f6164._ReflectiveLoad
0x5a714d65724034000000000000000000000000er@4............
0x5a715d00000000000000000000000000000000................
⋯15 more rows