Hostile ^92% Download

2026-10-01_55fb29ef04f034a0f659303f91dcbdb6_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

Packed malware with evasion and C2

Detects native packer stub for version 4.5-4.7 of .NET Reactor. A pirated copy of version 4.5 of this commercial obfuscation solution is used by various malware families like BlackBit, RedLine, AgentTesla etc.PE resource loader via ANSI resource APIs

SHA-256bcc5ea7d899e7a689412ce4d88d8f0c0e1f5b74394db2ab1ded46295e920bec5

URLhttps://tria.ge/api/v0/samples/261002-rrm15szfmd/sample

MaleculeO₃(C₃As₅Er)H₆(Db₃MgOs₂Po₃TiU)Md₃(Bi₈PaSi)Th₂

Evidence

Small code section in large PE 0x3c0–0x650

⋯3 more rows
0x3f000000000000000000000000000000000................
0x4008b4424042d0e000780f7d86a001bc06a.D$.-......j...j
0x4100083e00605170000c06a0150ff1500b0.........j.P....
0x4204100ccccccccccccccccccccccccccccA...............
⋯35 more rows

⋯7 more rows
0xe00b141008d842414010000508d4c241451.A...$....P.L$.Q
0xe10c6442418e0c64424193bc644241a8dc6.D$...D$.;.D$...
0xe2044241b2ac644241ca2c644241d2ac644D$.*.D$...D$.*.D
⋯15 more rows

x86 indirect call through a global pointer 0x1629–0x16e9

⋯3 more rows
0x1659b241008d4c2444895c2438e807f6ffff.A..L$D.\$8.....
0x16698b356cb141008d84249400000050895c.5l.A...$....P.\
0x16792440ffd66880b241008d4c243ce8e5f5[email protected]$<...
⋯7 more rows

PE imports ordinal 16 by number 0x1afc0–0x1b1f0

⋯4 more rows
0x1b0006c0695ed1b01a57b8208f4c1f50fc457l......{.......W
0x1b01065b0d9c612b7e9508bbeb8eafcb9887ce......P.......|
0x1b02062dd1ddf15da2d498cd37cf3fbd44c65b.....-I..|...Le
0x1b0304db261583ab551cea3bc0074d4bb30e2M.aX:.Q....t..0.
0x1b0404adfa5413dd895d7a4d1c46dd3d6f4fbJ..A=......m....
0x1b0504369e96a346ed9fcad678846da60b8d0Ci.j4n...g.F.`..
0x1b06044042d7333031de5aa0a4c5fdd0d7cc9D.-s3.....L_..|.
0x1b0705005713c270241aabe0b1010c90c2086P.q<'.A....... .
0x1b0805768b525206f85b3b966d409ce61e49fWh.% o...f...a..
0x1b0905edef90e29d9c998b0d09822c7d7a8b4^...)......"....
0x1b0a059b33d172eb40d81b7bd5c3bc0ba6cadY.=.......\;..l.
0x1b0b0edb883209abfb3b603b6e20c74b1d29a... ........t...
0x1b0c0ead547399dd277af04db261573dc1683..G9..w...&.s...
0x1b0d0e3630b1294643b840d6d6a3e7a6a5aa8.c...d;..mj>zjZ.
0x1b0e0e40ecf0b9309ff9d0a00ae277d079eb1...........'}...
0x1b0f0f00f93448708a3d21e01f2686906c2fe...D.......hi...
0x1b100f762575d806567cb196c36716e6b06e7.bW].eg..l6qnk..
0x1b110fed41b7689d32be010da7a5a67dd4acc...v..+...zZg.J.
0x1b120f9b9df6f8ebeeff917b7be4360b08ed5...o.......C`...
0x1b130d6d6a3e8a1d1937e38d8c2c44fdff252.......~8...O..R
0x1b140d1bb67f1a6bc57673fb506dd48b2364b..g...Wg?...H.6K
0x1b150d80d2bdaaf0a1b4c36034af641047a60..+....L6.J.A.z`
0x1b160df60efc3a867df55316e8eef4669be79.`...g.U1n..Fi.y
0x1b170cb61b38cbc66831a256fd2a05268e236.a...f..%o..Rh.6
0x1b180cc0c7795bb0b4703220216b95505262f..w...G."...U.&/
⋯7 more rows

PE resource entropy is at least 6.6 0x21fa0–0x22270

⋯5 more rows
0x21ff000000000000000000000000000000000................
0x2200000000000000000000400000000000300................
0x220100a000000280000800e00000048000080....(.......H...
0x2202010000000600000800000000000000000....`...........
0x2203004000000020000003001008078000080........0...x...
0x22040360100809000008000000000000000006...............
0x22050040000000000010001000000a8000080................
0x2206000000000000000000400000000000100................
0x2207001000000c00000800000000000000000................
0x22080040000000000010000000000e0000000................
0x2209000000000000000000400000000000100................
0x220a000000000f00000000000000000000000................
0x220b004000000000001000000000000010000................
0x220c000000000000000000400000000000200................
0x220d000000000100100000904000020010000............ ...
0x220e03c610200db901d00e404000000000000<a..............
0x220f018f21f0020000000e404000000000000.... ...........
0x2210038f21f0006000000e4040000000000008...............
0x2211040f21f00c0010000e404000000000000@...............
0x2212000f41f00e0020000e404000000000000................
0x2213002005f005f0001007e00000081baab9c.._._...~.......
0x221403e13a81e38befcdfcdce1e70ef927048>...8......p..pH
0x2215048c17a54e06382d60eabc78f5f79a86eH.zT.c......_y.n
0x221600131af4211af20f1f3af750b2e77b41c.1.B.. ...u..w..
0x22170752ef1660bac044e2738c73ae30aca1cu..f...N'8.:....
0x22180f2ec1ab1f1bb8ec51a79c9009d3a20a5.........y...: .
0x221904a8545b81f135d954e746b8abe3efba9J.E...].Ntk..>..
0x221a0668f50047a575fb292a01ec55872c261f.P.zW_.....Xr.a
0x221b06c3edeca0d8f568c1c2501f13b215b60l>....V..%..;![`
0x221c09246d3ec0dd55e5334e34d6f4efb5ac1.F....^S4.MoN.Z.
0x221d0d1345707d36a83e1098a7029f26fde5b.4W..j....p).o.[
0x221e0f0755a9808cac74b1b0a911596fc604f.uZ....K......`O
0x221f0619420d214660a0479e73d9aa34fe6dda. ..f..y.=..O..
0x22200c8fb8588f354770ec5da204b2e59524c.....Tw... K.YRL
0x222107970443d627d14d1752e37a09a5229d9ypD=b}..u.7..R).
0x2222034ade3a8f7683da5efcd76db74d7de714....h=...v.t..q
0x22230a6408221a79712aa64699d5067323fa9.@.!....di.Pg2?.
0x22240cde965eccb95e6303033f245c47b7c10..e....003.E.{|.
0x22250c77ffe2421350367fe6f78ce83b2dacd...$!5.g.ox.....
0x22260771ba5662fac29c95bb38101f5f86a13w..f/.).[.....j.
0x222708c9a3ab8bd1cf9d359411a28e49d75e3..:.....YA.(..u.