2026-09-26_47e02d662e3d2ff5a47b366fc0b1a1c0_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos_rhadamanthys_sliver_smoke-loader_wannacry
Multi-stage malware with evasion
Steals and impersonates a LocalSystem token obtained from LSASSVB6 concealed downloader wraps appended PE payload
SHA-256a049b585eee732e43f7290fee9f085718880212ef3e5b02bf3e8e609f8684ce2
Evidence
⋯7 more rows
0x22824a79147100000000000000000000000$..G............
0x2384d535642564d36302e444c4c00000000MSVBVM60.DLL....
0x24800000000000000000000000000000000................
⋯15 more rows
⋯7 more rows
0xff000000000000000000000000000000000................
0x1000199a76724403787232757972c6917972..vrD.xr2uyr..yr
0x101039087972740378728d727a7231687a729.yrt.xr.rzr1hzr
0x102066177872df687872748b7a723e557872f.xr.hxrt.zr>Uxr
0x1030e3bc767262727a72fa00797277557872..vrbrzr..yrwUxr
0x1040379a76728f8b7a720f9e7772fb6e78727.vr..zr..wr.nxr
0x1050b9187872ad73787281077972e3b57772..xr.sxr..yr..wr
0x1060457478723f9f7772ba68787229757872Etxr?.wr.hxr)uxr
0x107050b5777295c17672ed237772c0a07772P.wr..vr.#wr..wr
0x10904ac07772a3a16a7251cb77722a0e7872J.wr..jrQ.wr*.xr
0x10a08d487872484b787286cb7772e2477872.HxrHKxr..wr.Gxr
0x10b03d9e777246017972549e777246027972=.wrF.yrT.wrF.yr
0x10c051df767287757a729f62797296947872Q.vr.uzr.byr..xr
0x10d02e93797249bf7772266e7872d9807972..yrI.wr&nxr..yr
0x10e0fd7b78722a617972ca3f7772cf997672.{xr*ayr.?wr..vr
0x10f05cc2777222557872da9378728e5b7772\.wr"Uxr..xr.[wr
0x110059557872b0557872f6977a72fac47772YUxr.Uxr..zr..wr
0x1110f59f777245187872e5a06a72c78d7a72..wrE.xr..jr..zr
0x112034757a7285c17772a4037872360879724uzr..wr..xr6.yr
0x11305c947872258b7a72bcb0767256c17772\.xr%.zr..vrV.wr
0x1140a9b57772e299767250a07772c3cc7672..wr..vrP.wr..vr
0x115019187872d3937972e098767224467872..xr..yr..vr$Fxr
0x11601b7c79720488797278bd76726a7c7872.|yr..yrx.vrj|xr
0x1170c9047972fa017972b8df77721d967772..yr..yr..wr..wr
0x11809621777213757a722d8e78725f5d7972.!wr.uzr-.xr_]yr
0x119094557872a6c47772a9c677720f537872.Uxr..wr..wr.Sxr
0x11a0e5dc7772fb0c78726b927972c1e67672..wr..xrk.yr..vr
0x11b05d3b7772a88d7a72c24077725c547872];wr..zr.@wr\Txr
0x11c083a077727ea26a727a017972cd107872..wr~.jrz.yr..xr
0x11d07a0279728e6a78729b0e7872456a7872z.yr.jxr..xrEjxr
0x11e0ae017972e9fb787245607772a4356a72..yr..xrE`wr.5jr
0x11f0139f7772744c78727c737972b88c7a72..wrtLxr|syr..zr
0x1200c1777a725822777225c57772e15f7972.wzrX"wr%.wr._yr
0x12102d7a7872f66d7a72bfa36a72b6607972-zxr.mzr..jr.`yr
0x122059757a7270757a728c8d7a72de6b7872Yuzrpuzr..zr.kxr
0x1230959e77721db677724d8c7a7200917972..wr..wrM.zr..yr
0x124068c07672746a7872e26c7872ed5d7a72h.vrtjxr.lxr.]zr
0x12504e967872886179722ded7872e28d7a72N.xr.ayr-.xr..zr
0x126084947972661b777248c5777251db7872..yrf.wrH.wrQ.xr
0x1270fb9d7772306a78729a607772a7307772..wr0jxr.`wr.0wr
0x37fb00000000000000800000800000008080................
0x380b00800000008000800080800000c0c0c0................
0x381b00808080000000ff0000ff000000ffff................
0x382b00ff000000ff00ff00ffff0000ffffff................
0x383b00000000000000000000000000000000................
0x384b00000000000000000000000000000000................
0x385b00000000000000000000000000000000................
0x386b00000000000000000000000000000000................
0x387b00000000000000000000000000000000................
0x388b00000000000000000000000000000000................
0x389b00000000000000000000000000000000................
0x38ab00000000000000000000000000000000................
0x38bb00000000000000000000000000000000................
0x38cb00000000000000000000000000000000................
0x38db00000000000000000000000000000000................
0x38eb00000000000000000000000000000000................
0x38fb00000000000000000000000000000000................
0x390b00000000000000000000000000000000................
0x391b00000000000000000000000000000000................
0x392b00000000000000000000000000000000................
0x393b00000000000000000000000000000000................
0x394b00000000000000000000000000000000................
0x395b00000000000000000000000000000000................
0x396b000000000000000000000000000000 ...............
⋯5 more rows
0x2d1bc340030003900300034004200300000004.0.9.0.4.B.0...
0x2d1cc34001400010043006f006d00700061004.....C.o.m.p.a.
0x2d1dc6e0079004e0061006d00650000000000n.y.N.a.m.e.....
0x2d1ec4d006900630072006f0073006f006600M.i.c.r.o.s.o.f.
0x2d1fc74000000280008000100500072006f00t...(.....P.r.o.
0x2d20c64007500630074004e0061006d006500d.u.c.t.N.a.m.e.
0x2d21c00000000570069006e0000002c000a00....W.i.n...,...
0x2d22c0100460069006c006500560065007200..F.i.l.e.V.e.r.
0x2d23c730069006f006e000000000031002e00s.i.o.n.....1...
0x2d24c300030000000000030000a00010050000.0.....0.....P.
0x2d25c72006f00640075006300740056006500r.o.d.u.c.t.V.e.
0x2d26c7200730069006f006e00000031002e00r.s.i.o.n...1...
0x2d27c300030000000000028000800010049000.0.....(.....I.
0x2d28c6e007400650072006e0061006c004e00n.t.e.r.n.a.l.N.
0x2d29c61006d0065000000570069006e000000a.m.e...W.i.n...
⋯8 more rows
0x33ac9d257387c653bfb25d009a04972391232.W8|e;.%...Ir9.2
0x33ad9407a8f340aec0c85fe90d45073fc7405@z.4.......Ps.t.
0x33ae9e054d4f12b75a6172a7304366246542b.T..+u..*s.6bFT+
0x33af915c0707b7bc204bd3268fbd012b97363..p{{...2h....sc
0x33b09af279ae38ac08c13326bea160791c8c9.'......2k......
0x33b194218c7573a917f08e0b1205a8c065853B..W:..... Z..XS
0x33b29fce277169a9cd1305b0000100e157d64..w....0[.....}d
0x33b39671a2f27c8979ecea09a415132868166g./'......AQ2..f
0x33b494d5a90000300000004000000ffff0000MZ..............
0x33b59b8000000000000004000000000000000........@.......
0x33b6900000000000000000000000000000000................
0x33b7900000000000000000000000080000000................
0x33b890e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x33b9969732070726f6772616d2063616e6e6fis program canno
0x33ba9742062652072756e20696e20444f5320t be run in DOS
0x33bb96d6f64652e0d0d0a2400000000000000mode....$.......
0x33bc95045000064860c0067a39a6500000000PE..d...g..e....
0x33bd900000000f0002f000b02023200e01500....../....2....
0x33be900421c01000000001026080000100000.B.......&......
0x33bf900000040010000000010000000020000...@............
0x33c0905000000000000000500000000000000................
0x33c1900f03201000400006f882a0102000000..2.....o.*.....
0x33c2900001000000000000010000000000000................
0x33c3900001000000000000010000000000000................
0x33c4900000000100000000000000000000000................
0x33c598cdb28011801000000e03001cc560100..(.......0..V..
0x33c6900901900d4a9000000622a01b01700 .........b*....