Hostile ^100% Download

2026-09-27_b18dacaa4b30750efaa753941d46bfbd_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

C2, packed, embedded malware

Wecan Hasthe HTTP upload C2 endpointBinary has a high-entropy 64 KiB region

SHA-2568cb405e175c7f6de0077d16dca49dd79f52ee228019fbc30f4619847dceb2115

URLhttps://tria.ge/api/v0/samples/260928-bjrfla1v6k/sample

MaleculeO₃(CAs₄Er₂)H₆(Cm₉Db₄DsFMgOs)Md₂(Bi₇Si)

Evidence

Small code section in large PE 0x3c0–0x650

⋯3 more rows
0x3f000000000000000000000000000000000................
0x4008b4424042d0e000780f7d86a001bc06a.D$.-......j...j
0x4100083e00605170000c06a0150ff1500b0.........j.P....
0x4204100ccccccccccccccccccccccccccccA...............
⋯35 more rows

Indirect call followed by a compare branch 0xd00–0xdc0

⋯3 more rows
0xd301508b041008bf0f7de1bf683c6017456...A..........tV
0xd40ff1504b0410083f87a75428b5424186a....A...zuB.T$.j
0xd50006a0057556a0052ff1508b041008bf0.j.WUj.R....A...
⋯7 more rows

x86 indirect call through a global pointer 0x1629–0x16e9

⋯3 more rows
0x1659b241008d4c2444895c2438e807f6ffff.A..L$D.\$8.....
0x16698b356cb141008d84249400000050895c.5l.A...$....P.\
0x16792440ffd66880b241008d4c243ce8e5f5[email protected]$<...
⋯7 more rows

Inline MZ header validation constant 0xc52d–0xc5fd

⋯3 more rows
0xc55d59595dc36a1468c0114200e8ef150000YY].j.h..B......
0xc56db84d5a0000663905000040007538a13c[email protected].<
0xc57d00400081b800004000504500007527b9.@[email protected]'.
0xc58d0b01000066398818004000751983b874[email protected]
⋯7 more rows

Wecan Hasthe HTTP upload C2 endpoint 0x31950–0x31b00

0x3195040fd80282cde410086807a43ded0da41@..(,.A...zC...A
0x3196000d2095382fbf0d24100f00bf340fd2a...S....A....@.*
0x31970120644d3ffffbfa86c696267636a5f73..D.....libgcj_s
0x319802e646c6c005f4a765f526567ff1df0ff.dll._Jv_Reg....
0x319906973746572436c61737365731d726200isterClasses.rb.
0x319a06d61206e756d60ffffff207761207269ma num`... wa ri
0x319b0666169656e2079616e6a652076312e30faien yanje v1.0
0x319c0000013df1db0ff322d25732e6578652d.......2-%s.exe-
0x319d067792a6f726e2068dfbd73ff797a696bgy*orn h..s.yzik
0x319e0202573200f2263207765094e4f444525 %s ."c we.NODE%
0x319f0ffff9ffd690a007762000a0066696c65....i..wb...file
0x31a005b5d006e6f64650073656e640073ffff[].node.send.s..
0x31a10ffff75626d697400687474703a2f2f77..ubmit.http://w
0x31a206563616e2e6861737468652e74656368ecan.hasthe.tech
0x31a306e6fffffffff6c6f67792f75706c6f61no....logy/uploa
0x31a4064006375726c5f656173795f70657266d.curl_easy_perf
0x31a506f726d28292077ffba77ae6c65643a7borm() w..w.led:{
0x31a600a9861752067c57265200e2872ee6779..au g.re .(r.gy
0x31a7061c187dbffffffff5b5b554e49515545a.......[[UNIQUE
0x31a805d5d201710fe5ac33c21359bb5f82c82]] ...Z.<!5...,.
0x31a90dc2e000061626364ffffffff65666768....abcd....efgh
0x31aa0696a6b6c6d6e6f707172737475767778ijklmnopqrstuvwx
0x31ab0797a4142434445464748494affef88fayzABCDEFGHIJ....
0x31ac04b4c4d4e4f925455565758595a303132KLMNO.TUVWXYZ012
0x31ad03334ffffffff35363738390000434f4e34....56789..CON
0x31ae04e4543545f4f4e4c5920697320726571NECT_ONLY is req
0x31af0756972656421ff77ffee004661ee6420uired!.w...Fa.d 
0x31b0074                              t               