Hostile ^100% Download

2026-09-28_f0dfefea927c361175119c5772df393f_cobalt-strike_elex_hijackloader_icedid_njrat_vidar

Multi-stage malware with C2 and injection

MpCmdRun removes Defender signaturesUnsigned PE with a large anonymous section and VirtualAlloc

SHA-256afcc41f317c8192c4c648f6f914abd0494d2cee322a924aa4da60d62fb1f51f9

URLhttps://tria.ge/api/v0/samples/260928-1zm6jsvzfz/sample

MaleculeK₃(Li₄Mc₄Te)O₁₁(As₁₈CoEr₁₈Pr₄C₄Ca₂Dy₃LaP₅SXe)H₁₁(Db₉Po₂₃Cm₉Cr₃DsF₂₁HfMg₅Os₃₆TiU₂)Md₈(Bi₂₈Bk₂PaPt₂Si₄V₂)

Evidence

Large anonymous PE section 0x180–0x470

⋯7 more rows
0x1f000000000000000000000000000000000................
0x20043440000009cf190fe099952f6865903CD.........R..Y.
0x2103bd28172fa8e0632f48a00c26ffd3b8d;..r...2....o.;.
0x22002091a18bac57a81a94ff1ed2befcee1......z..O..+...
0x23086010060d4246aa6c5e437dbdc5f0b59...`.$j...7.._.Y
0x24021d9a3ba5014a7f80c010c8435197338!...P.......5.s8
0x2504a1a4a1914658d3256e47ab3038b4c25J.J..e.2V.z...L%
0x26027c41239613c366c1314eecc2033e590'..9a<6l.... 3..
0x270e47887c982a2b971f14d716684a6b87a.x.....q.Mqf...z
0x28080cb40313b1ad9d4003e238281d1a526..@1;....>#....&
0x290d90e4c62c48b01adc4841493474f7e60..Lb........GO~`
0x2a070cd88c375ce29b328ff6d0140f0c692p...u.).(.m.@...
0x2b0003482091847228c298e85918b0c90b2.4...G".).......
0x2c0fa3fb20ec46a0918f249aabe1ec33070.?...j...I....0p
0x2d0cef66ee9e335aed13c40528ed9e2985b..n..5..<@R....[
0x2e0d8c1601c4b8a4dc86686a62586b52ee7..`.K.M.f..%....
0x2f01dad3c43078332ad8bc360be35630031..<C..2...`.5c.1
0x300a0ac5a285049dc871a78c3dc16811cdd..Z(PI...x......
0x310a51d9fb6c4c262777d6d583c8e99119a......bw}mX<....
0x320a0c4267b213f6c0213147982c1dce53e..&{!?l...y....>
0x330d2420a0b859214b764333a028d4f6afa.B......d3:..Oj.
0x34055576c63a634399dbe32708096811f31UWlc.49..2p....1
0x350a6ed3be67dcd0ea581168006f29d5704..;.}.........W.
0x3609a16625224a1036af8b0eb1b7040dcec..bR$..j....p@..
0x370441537f916fd61301962cf0bdf4e5068D.7...a0.b...NPh
0x380fdb61dc4f1cf40259e0aeff0534a27dd......@%....SJ'.
0x3908e4719fac1e714c919f1ce91cace8101.G..............
0x3a0108ff4e784f482a4e37f74e311032247..........t..."G
0x3b04474ee82e5946f4026e425dfdc65b4d9Dt....o@&.%..e..
0x3c0209bc396c15114f9a19fca5d6a1b50ab ....Q.....]j.P.
0x3d0d6828a20611bd1527f7933b0f467a11d... a..R.y3..g..
0x3e074a4ac535e2f348871db235eb3d56314t..S^/4.q.#^..c.
0x3f024169fa82c03bf62a508b961b56afb5d$...,..b...a.j.]
0x400f8c632530eea8b611138eacb16342526..2S...a.8...4%&
0x4104b4144dc01881ab3def9de668a660d24KAD........f.f.$
0x420c9421ab00916537c3acd771a85c50723.B....S|:.w....#
0x43038c50c1220e82a606051c644304299328... .*``Q.D0B.2
0x4409f4686a82c8d0b4fa68f624c153a0c58.F..,..O..bL.:.X
0x450bc988762f3d09596bf5255f4181d585f...b.....RU...X_
0x4607cd16612812a13b8a9c45c7813ea71e4|.f..*....\x..q.
0x470a6035cf0a00cf22076ea6e284042779a..\.... v.n(@Bw.

Embedded PE binary at file offset 0x1481c (~122880 bytes) 0x14798–0x14908

⋯7 more rows
0x148084c4c33322e444c4c005753325f33322eLL32.DLL.WS2_32.
0x14818444c4c004d5a90000300000004000000DLL.MZ..........
0x14828ffff0000b80000000000000040000000............@...
0x1483800000000000000000000000000000000................
0x1484800000000000000000000000000000000................
0x14858f00000000e1fba0e00b409cd21b8014c............!..L
⋯11 more rows

Modify memory page protection 0x4910c–0x4928c

⋯6 more rows
0x4916ce8d3fdfeffffb5f4faffffff15c01000................
0x4917c0185c00f84ad0400006876040000e92c.........hv....,
0x4918c0200008d85f8fbffff5033db5353680f.........P3.SSh.
0x4919c6a01015353ff15881000013bc3a3e857j..SS......;...W
0x491ac02010f857e0400006885040000e91f02....~...h.......
0x491bc00008d85f8fbffff5033db5353680c6d........P3.SSh.m
0x491cc01015353ff15881000013bc3a3e85702..SS......;...W.
⋯12 more rows

Microsoft Defender command runner executable 0xb7778–0xb7a28

⋯3 more rows
0xb77a84e0055004c004c000000000000000000N.U.L.L.........
0xb77b82500740065006d00700025005c004d00%.t.e.m.p.%.\.M.
0xb77c8700043006d006400520075006e002e00p.C.m.d.R.u.n...
⋯6 more rows
0xb78386f0073006f0066007400200043006f00o.s.o.f.t. .C.o.
0xb7848720070000a0055007300650020007400r.p...U.s.e. .t.
0xb7858680069007300200074006f006f006c00h.i.s. .t.o.o.l.
0xb7868200074006f0020006100750074006f00 .t.o. .a.u.t.o.
⋯8 more rows
0xb78f869006f006e0073005d000a000a004300i.o.n.s.].....C.
0xb79086f006d006d0061006e00640020004400o.m.m.a.n.d. .D.
0xb791865007300630072006900700074006900e.s.c.r.i.p.t.i.
0xb79286f006e000a002000200020002d003f00o.n... . . .-.?.
0xb793820002f0020002d006800200020002000 ./. .-.h. . . .
⋯15 more rows

NtResumeProcess API name reference 0x457f6d–0x45809d

⋯5 more rows
0x457fbd636573735f73757370656e642e636300cess_suspend.cc.
0x457fcd4e7453757370656e6450726f63657373NtSuspendProcess
0x457fdd004e74526573756d6550726f63657373.NtResumeProcess
0x457fed003a3a4e744f70656e54687265616400.::NtOpenThread.
⋯11 more rows