2026-10-03_8ffe5f4b768904ad3f3245b83729cc9b_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
Packed stealer with C2 and evasion
Packed PE posts a file array to Wecan Hasthe C2Snojan mutation and Wecan Hasthe upload markers in UPX data
SHA-256c0110e73651c55c9fc5e93124925534ae373b09625df2234de4f94caa12f9dce
Evidence
⋯3 more rows
0x16800000000000000000000000000000000................
0x17855505830000000000030010000100000UPX0.....0......
0x18800000000000200000000000000000000................
0x19800000000800000e05550583100000000........UPX1....
⋯3 more rows
0x1f8210d0902010db87db55bb25e878e6602!......}.[.^..f.
0x20800f2450100002c0200260900ab03fbff..E...,..&......
0x218ff558b0d0053420089e55dffe18d7426.U...SB...]...t&
0x22800558b0de4520fddeeffff89e55383ec.U...R.......S..
0x238206850114000e80901ccec83c40c07bd hP.@...........
0x2481404beffffeeff2483ec0c8d45f4c745.......$....E..E
0x258f40000508d45f88b1d1ce04100535068...P.E.....A.SPh
0x268043042fbbb77ee0068000427c97ca1d8.0B..w..h..'.|..
0x2780983c42085c0754410f3bfdbfd9c8b15... ..uD........
0x2882c2789100cbe3483e4f0e80900031cfd,'....4.........
0x2987dbf7fc9bc538b08518b153e52a13f50}....S..Q..>R.?P
0x2a81a9c89c3ffbaeffe1ccc891c2407ccfc............$...
0x2b88b1ddca4a3435151508b3ef6ffee5310.....CQQP.>...S.
0x2c85216c98c83c41083fbe0741950507050R.........t.PPpP
0x2d88b4330e49207eb3e0118c0748450fedf.C0....>...t.P..
0x2e8fd9fe90900006e89f68dbc27c3005589......n....'..U.
0x2f8e583ec146a02ff15d05cd87be7617b00....j....\.{.a{.
0x3081c8db6181f01ffbf21902f048b45088b........!./..E..
0x318008b003d910000c077f97ef7ee3b3d8d...=....w.~..;=.
0x32806724bbb014850506a006a08aeacffbb.rK..HPPj.j.....
0x338effef8010f84d61685c00f85900731c0..............1.
0x3488b5dfcc9c204008de6efddddb4260e00.]...........&..
0x3583d943a74493d9606173d938ceddefd75=.:tI=...=.....u
0x368dbebb53d050874393d1d0675cb5304fb...=..t9=..u.S..
0x3781bfe80745a85c074b49d6a04ffd083c8...tZ..t..j.....
0x388ff6919db7db8eba790df31dbef016d31.i..}.....1...m1
0x3980b0d799a033e820bb64bc8f7288e1108..y..>...K..(...
0x3a83a016a6c582c160b59271550ff97852c:.jlX,..Y'.P...,
0x3b815ecc8ff85db0f841bffffc0c676b8ff.............v..
0x3c8793dc8ff3b9000ae733c427f08a13c1dy=..;...s<B...<.
0x3d8903b7e1f3afef16800f0417acd0c89c2.;~.:..h..Az....
0x3e87cb81585d2d3fdc1fd740f5050680d19|........t.PPh..
0x3f8f9cd1c5a592d0d58f7debd39afc410c9...ZY-.X...9....
0x408c3ef4f5d0877bb0f84bf08a1045f8b00..O].w......._..
0x4183315ffd0843fec630c83c004a31475eb3....?.c......u.
0x428c9c3907fff9d69173f5653232f85c974......i.?VS#/..t
0x125749043322443888c9c2443322470583224.C2$C...$C2$pX2$
0x12584433254605c163224434c507b5d070639C2T`\.2$CLP{]..9
0x12594f00006ff070340fd80282cde41008680......@..(,.A...
0x125a47a43ded0da4100d2095382fbf0d24100zC...A...S....A.
0x125b4f00bf340fd2a120644d3ffffbfa86c69...@.*..D.....li
0x125c46267636a5f732e646c6c005f4a765f52bgcj_s.dll._Jv_R
0x125d46567ff1df0ff6973746572436c617373eg....isterClass
0x125e465731d7262006d61206e756d60ffffffes.rb.ma num`...
0x125f4207761207269666169656e2079616e6a wa rifaien yanj
0x12604652076312e30000013df1db0ff322d25e v1.0.......2-%
0x12614732e6578652d67792a6f726e2068dfbds.exe-gy*orn h..
0x1262473ff797a696b202573200f2263207765s.yzik %s ."c we
0x12634094e4f444525ffff9ffd690a00776200.NODE%....i..wb.
0x126440a0066696c655b5d006e6f6465007365..file[].node.se
0x126546e640073ffffffff75626d6974006874nd.s....ubmit.ht
0x1266474703a2f2f776563616e2e6861737468tp://wecan.hasth
0x12674652e746563686e6fffffffff6c6f6779e.techno....logy
0x126842f75706c6f6164006375726c5f656173/upload.curl_eas
0x12694795f706572666f726d28292077ffba77y_perform() w..w
0x126a4ae6c65643a7b0a9861752067c5726520.led:{..au g.re
0x126b40e2872ee677961c187dbffffffff5b5b.(r.gya.......[[
0x126c4554e495155455d5d4e04ee3aad03e2d1UNIQUE]]N..:....
0x126d4cb3ace9fef61d83e000061626364ffff.:...a.>..abcd..
0x126e4ffff65666768696a6b6c6d6e6f707172..efghijklmnopqr
0x126f4737475767778797a4142434445464748stuvwxyzABCDEFGH
0x12704494affef88fa4b4c4d4e4f9254555657IJ....KLMNO.TUVW
0x1271458595a3031323334ffffffff35363738XYZ01234....5678
0x12724390000434f4e4e4543545f4f4e4c59209..CONNECT_ONLY
0x12734697320726571756972656421ff77ffeeis required!.w..
0x12744004661ee6420746f206765741763656e.Fa.d to get.cen
0x127547420736f636b6574ffffffbf00c62068t socket...... h
0x12764616e646c6520616c7265616479207573andle already us
0x12774656420696e206d7584dd10ec6c74691ced in mu....lti.
0x127847e62002d00ffc3ff3e25303878030000~b.-....>%08x...
0x127942d003b205c6e616d653d2225fcd9effe-.; \name="%....
0x127a4732200436f6e746f2d547970653a5270s".Conto-Type:Rp
0x127b46172742ffbffff3f372d646174610025art/...?7-data.%
0x127c4733b20626f756e646172793d25730d0as; boundary=%s..
0x127d40002ffc39ca12de5063d446973706f73......-..=Dispos
0x127e46974b96727fb696f6e3a203a3b206700it.g'.ion: :; g.
0x127f42232cafec8862a686d69786564614fd8"2....*hmixedaO.
0x12804b0d960345f617474cc9d32f76163686d..`4_att..2.achm
0x12814b556257312043ec7ff5d9c636f756c64.V%s..>..].could
0x128246e2774206f7065f6206ee67ec7f20d0an't ope. n.~....
0x128345c2d2d2a082b6ff8fffe6170706c6963\--*.+o...applic
0x1284461c02f6f637465742d73746d6d00 a./octet-stmm.
0x128eb05ffb3ff2c0b556e6b6e6f776e192025....,.Unknown. %
0x128fb6420282523784ff7ff8e29023a256400d (%#xO...).:%d.
0x1290b253235355b5e3a5d0b3a73c3efffff00%255[^:].:s.....
0x1291b2f6574632f73736c2f63657274732f63/etc/ssl/certs/c
0x1292b612d086966497714d4ff65732e637274a-.ifIw...es.crt
0x1293b002a00046e6f5f14ec6ffa70726f7879.*..no_..o.proxy
0x1294be05f50524f5859000fecc11eecd10a61._PROXY........a
0x1295b6c6c09414c4c2582fdd414ec00097335ll.ALL%.......s5
0x1296b6807feb360cf0634610706005b252a34h...`..4a...[%*4
0x1297b355b3f69d2926eac983a2e5d25fe7dd75[?i..n..:.]%.}.
0x1298bf163 .c
⋯3 more rows
0x14c7b90909090909090909090909090909090................
0x14c8b4d5a90000300000004000000ffff0000MZ..............
0x14c9bb8000000000000004000000000000000........@.......
0x14cab00000000000000000000000000000000................
0x14cbb000000000000000000000000e0000000................
⋯7 more rows
⋯4 more rows
0x290548d4dfc51ff75f850ff15ecb041008945.M.Q.u.P....A..E
0x29064f83bc77513ff1504b0410085c0740950.;.u.....A...t.P
0x29074e8f96fffff59ebcf8bc6c1f8058b0485..o..Y..........
0x29084603f420083e61fc1e6068d4430048020`?B........D0..
0x29094fd8b45f88b55fc5f5ec9c36a1468f014..E..U._^..j.h..
⋯10 more rows