Hostile ^92% Download

2026-10-01_04323a3e1d131c4d2dc5f41a2e21b1ab_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

Packed malware with evasion

Detects native packer stub for version 4.5-4.7 of .NET Reactor. A pirated copy of version 4.5 of this commercial obfuscation solution is used by various malware families like BlackBit, RedLine, AgentTesla etc.PE resource loader via ANSI resource APIs

SHA-256a23b6762e548b82fa20dc16e7efcc341253dfd2fc68c78f237c2c6cfde73f925

URLhttps://tria.ge/api/v0/samples/261003-13fwmsfg83/sample

MaleculeO₃(C₃As₅Er)H₆(Db₃MgOs₂Po₃TiU)Md₃(Bi₈PaSi)Th₂

Evidence

Small code section in large PE 0x3c0–0x650

⋯3 more rows
0x3f000000000000000000000000000000000................
0x4008b4424042d0e000780f7d86a001bc06a.D$.-......j...j
0x4100083e00605170000c06a0150ff1500b0.........j.P....
0x4204100ccccccccccccccccccccccccccccA...............
⋯35 more rows

⋯7 more rows
0xe00b141008d842414010000508d4c241451.A...$....P.L$.Q
0xe10c6442418e0c64424193bc644241a8dc6.D$...D$.;.D$...
0xe2044241b2ac644241ca2c644241d2ac644D$.*.D$...D$.*.D
⋯15 more rows

x86 indirect call through a global pointer 0x1629–0x16e9

⋯3 more rows
0x1659b241008d4c2444895c2438e807f6ffff.A..L$D.\$8.....
0x16698b356cb141008d84249400000050895c.5l.A...$....P.\
0x16792440ffd66880b241008d4c243ce8e5f5[email protected]$<...
⋯7 more rows

PE imports ordinal 16 by number 0x1afc0–0x1b1f0

⋯4 more rows
0x1b0006c0695ed1b01a57b8208f4c1f50fc457l......{.......W
0x1b01065b0d9c612b7e9508bbeb8eafcb9887ce......P.......|
0x1b02062dd1ddf15da2d498cd37cf3fbd44c65b.....-I..|...Le
0x1b0304db261583ab551cea3bc0074d4bb30e2M.aX:.Q....t..0.
0x1b0404adfa5413dd895d7a4d1c46dd3d6f4fbJ..A=......m....
0x1b0504369e96a346ed9fcad678846da60b8d0Ci.j4n...g.F.`..
0x1b06044042d7333031de5aa0a4c5fdd0d7cc9D.-s3.....L_..|.
0x1b0705005713c270241aabe0b1010c90c2086P.q<'.A....... .
0x1b0805768b525206f85b3b966d409ce61e49fWh.% o...f...a..
0x1b0905edef90e29d9c998b0d09822c7d7a8b4^...)......"....
0x1b0a059b33d172eb40d81b7bd5c3bc0ba6cadY.=.......\;..l.
0x1b0b0edb883209abfb3b603b6e20c74b1d29a... ........t...
0x1b0c0ead547399dd277af04db261573dc1683..G9..w...&.s...
0x1b0d0e3630b1294643b840d6d6a3e7a6a5aa8.c...d;..mj>zjZ.
0x1b0e0e40ecf0b9309ff9d0a00ae277d079eb1...........'}...
0x1b0f0f00f93448708a3d21e01f2686906c2fe...D.......hi...
0x1b100f762575d806567cb196c36716e6b06e7.bW].eg..l6qnk..
0x1b110fed41b7689d32be010da7a5a67dd4acc...v..+...zZg.J.
0x1b120f9b9df6f8ebeeff917b7be4360b08ed5...o.......C`...
0x1b130d6d6a3e8a1d1937e38d8c2c44fdff252.......~8...O..R
0x1b140d1bb67f1a6bc57673fb506dd48b2364b..g...Wg?...H.6K
0x1b150d80d2bdaaf0a1b4c36034af641047a60..+....L6.J.A.z`
0x1b160df60efc3a867df55316e8eef4669be79.`...g.U1n..Fi.y
0x1b170cb61b38cbc66831a256fd2a05268e236.a...f..%o..Rh.6
0x1b180cc0c7795bb0b4703220216b95505262f..w...G."...U.&/
⋯7 more rows

PE resource entropy is at least 6.6 0x21fa0–0x22270

⋯5 more rows
0x21ff000000000000000000000000000000000................
0x2200000000000000000000400000000000300................
0x220100a000000280000800e00000048000080....(.......H...
0x2202010000000600000800000000000000000....`...........
0x2203004000000020000003001008078000080........0...x...
0x22040360100809000008000000000000000006...............
0x22050040000000000010001000000a8000080................
0x2206000000000000000000400000000000100................
0x2207001000000c00000800000000000000000................
0x22080040000000000010000000000e0000000................
0x2209000000000000000000400000000000100................
0x220a000000000f00000000000000000000000................
0x220b004000000000001000000000000010000................
0x220c000000000000000000400000000000200................
0x220d000000000100100000904000020010000............ ...
0x220e03c61020009e81800e404000000000000<a..............
0x220f048491b0020000000e404000000000000HI.. ...........
0x2210068491b0006000000e404000000000000hI..............
0x2211070491b00c0010000e404000000000000pI..............
0x22120304b1b00e0020000e4040000000000000K..............
0x2213002005f005f0001007e000000e25cba3f.._._...~....\.?
0x2214066c23e72b7a353a742411c0600ec5eaff.>r..S.BA....^.
0x22150d1030bfeedc6d9747a47fc0f41c4ff71.......tzG..A..q
0x221609e81ef8bacd338620a372545580cf09f......8b.7%EX...
0x22170002d4a280e9d6a01c765e141ddbab234.-J(..j..e.A...4
0x2218035b97661040379b14960d25a6fc101865.va..y.I`.Zo...
0x22190be826fb5cc79e19997a59035bde19577..o..y.....5...w
0x221a093983aeb814604231c48f365d5b2d215..:..F.#.H.e....
0x221b0abf421f664bb2c5e56bd49733820167b..!.d.,^V.Is8 .{
0x221c041311a3324fbae21417cc3e2462f462cA1.3$..!A|..F/F,
0x221d0f93e6c2437cf277f95cd2cdfb218112c.>l$7.'...,....,
0x221e06149ee9bb8752008ba4f0066a89265dcaI...u ..O.f..e.
0x221f0050f72bd15e6dca9c858975621308695..r......X.V!0..
0x22200019005dc00b951d125379184e971d1fa......Q.%7...q..
0x22210a1e56e6359b19a98cd401ab4f21f74f6[email protected].
0x222202b3f7f492b3233cb2f161fc38021c5e6+?.I+23./....!..
0x2223024a8c1dd8837aa37e276bfe114110124$....7.7.v.....$
0x222407b5f8786b9c12a02b9a66db0d55e21ae{_....*...m..^!.
0x22250cd02625be6a7b9929c2bc5d20c8eea58..b[.....+.....X
0x22260cae5f11b1d001d9bea5a2b914ab85140.........Z+.J.Q@
0x22270b5a762fe0892dc478ce8a8c80e6aeb28..b....G.....j.(