Hostile 100% Download

2026-09-29_bd942297de25e955f0596f1b6fe81db5_acrstealer_amadey_darkgate_datper_elex_floxif_gcleaner_glassworm_trigona

Named malware, C2, hooks, evasion

Resource anti-debug memory loaderKeyboard hook starts a hidden-window thread
SHA-256c430916f0d4c9c3e05c1a1cbd82b3f4c74b4cde5fbb5d4b60321ecd12c63a80b
URLhttps://tria.ge/api/v0/samples/260930-vhvamsywh1/sample
MaleculeK(Mc)O₈(C₂Co₃As₁₁DyEr₄IPPr)H₁₁(Cm₅CrDb₆DsF₁₁Hf₅Mg₂Os₁₄Po₁₁TiU₅)Md₆(Bi₁₅HePaPtSi)Th

Evidence

One .text section dominates file 0x3c0–0x670
⋯3 more rows
0x3f000000000000000000000000000000000................
0x400041040000307426f6f6c65616e010000[email protected]...
0x410000001000000001040000546616c7365[email protected]
0x42004547275650653797374656d02000000.True.System....
0x430341040000208416e7369436861720100[email protected]..
0x440000000ff000000020000000050104000............P.@.
0x4500904436861720300000000ffff000002..Char..........
0x4600000000068104000010853686f727449[email protected]
0x4706e740080ffffff7f0000000200000000nt..............
0x480841040000108536d616c6c496e740200[email protected]..
0x49080ffffff7f00000200000000a0104000..............@.
0x4a00107496e74656765720400000080ffff..Integer.......
0x4b0ff7f0200b81040000104427974650100[email protected]..
0x4c0000000ff0000000200000000d0104000..............@.
0x4d00104576f72640300000000ffff000002..Word..........
0x4e000000000e8104000010843617264696e[email protected]
0x4f0616c0500000000ffffffff0200000000al..............
0x500041140001407506f696e746572000000[email protected]...
0x51000020000181140001005496e74363400[email protected].
0x52000000000000080ffffffffffffff7f02................
0x5300000000038114000100655496e743634[email protected]
0x5400000000000000000ffffffffffffffff................
0x550020000005811400001094e6174697665[email protected]
0x560496e740400000080ffffff7f02000000Int.............
0x57074114000010a4e617469766555496e74[email protected]
0x5800500000000ffffffff02000090114000..............@.
0x590040653696e676c6500020000a0114000..Single......@.
0x5a00408457874656e646564020200000000..Extended......
0x5b0b41140000406446f75626c6501020000[email protected]....
0x5c0c41140000404436f6d70030200000000[email protected]......
0x5d0d4114000040843757272656e63790402[email protected]..
0x5e000000000e8114000050b53686f727453[email protected]
0x5f07472696e67ff0200fc11400014095041[email protected]
0x6006e736943686172301040000200000000nsiChar0.@......
0x6101412400014095057696465436861724c[email protected]
0x62010400002000000002c12400003084279.@......,[email protected]
0x6307465426f6f6c0000000080ffffff7f28teBool.........(
0x6401240000546616c736504547275650653[email protected]
0x650797374656d0200005c1240000308576fystem...\[email protected]
0x6607264426f6f6c0200000080ffffff7f58rdBool.........X
0x6701240000546616c736504547275650653[email protected]
Large PE with elevated code entropy 0x2235–0x22c5
0x2235000020000000cc104000000000000205.. .....@.......
0x224556547970650200cc1040000200000002VType....@......
0x2255095265736572766564310200cc104000.Reserved1....@.
0x226504000000020952657365727665643202......Reserved2.
0x227500cc1040000600000002095265736572[email protected]
0x228576656433020080104000080000000209ved3....@.......
0x229556536d616c6c496e7402009c10400008VSmallInt....@..
0x22a5000000020856496e746567657202008c.....VInteger...
0x22b51140000800000002075653696e676c65[email protected]
0x22c50200b0 ...
x86 CREATE_NO_WINDOW stack argument 0x13bb94–0x13bd14
0x13bb947411804b3c018973388d534c8bc38b08t..K<..s8.SL....
0x13bba4ff511c595a5e5bc35356518814248bf0.Q.YZ^[.SVQ..$..
0x13bbb40fb65e3cf7d3221c240fb60520c85300..^<..".$... .S.
0x13bbc43ac37453f6c30174278bc68b10ff929c:.tS...t'.......
0x13bbd4000000837e380075178b0d3880b100b2....~8.u...8....
0x13bbe401a164944400e8d14fefffe800e6ecff..d.D...O.......
0x13bbf4f6c30274078bc6e824000000f6c30474...t....$......t
0x13bc04078bc6e844000000f6c30874078bc6e8....D......t....
0x13bc1468000000085e3c5a5e5bc30000000000h....^<Z^[......
0x13bc24538bd88b4340e88de0ffff508b433850[email protected]
0x13bc34e8a3cbedff8b43408b4018e8c0d9ffff......C@.@......
0x13bc44508b433850e836ccedff5bc3538bd88bP.C8P.6...[.S...
0x13bc544344e8c1e8ffff508b433850e877cbedCD.....P.C8P.w..
0x13bc64ff8b43440fb640180fb704456087ae00[email protected]`...
0x13bc74508b433850e8e6cbedff5bc353568bd8P.C8P.....[.SV..
0x13bc848b4348e884ecffff50e86accedff8b43.CH.....P.j....C
0x13bc9448e876ecffff508b433850e838cbedffH.v...P.C8P.8...
0x13bca48b53488bc28b40108078200075258bf2[email protected] .u%..
0x13bcb48b46108b4018e845d9ffff508b433850[email protected]
0x13bcc4e833cbedff6a028b433850e830cbedff.3...j..C8P.0...
0x13bcd45e5bc38bf28b46108b4018e820d9ffff^[....F..@.. ...
0x13bce4f7d0508b433850e80ccbedff6a018b43..P.C8P.....j..C
0x13bcf43850e809cbedff5e5bc38bc0538bd8f68P.....^[...S...
0x13bd04433c02741380633cfda1f8eeb100508bC<.t..c<......P.
0x13bd14433850e8c0caedff5bc38bc0538b C8P.....[...S.
Detects Windows.Virus.Floxif 0x6e037a–0x6e04fa
⋯7 more rows
0x6e03ea508b44240483c004508b442404c20800P.D$....P.D$....
0x6e03fa8b542404807a030175048d4204c38d42.T$..z..u..B...B
0x6e040a04538bc88a5a0284db740230198a19f6.S...Z...t.0....
⋯15 more rows
Modify memory page protection 0x723cb4–0x723fa4
⋯3 more rows
0x723ce44c33b033b433b833bc33c033ce33dc33L3.3.3.3.3.3.3.3
0x723cf4ee33fd330c345f34633467346b347934.3.3.4_4c4g4k4y4
0x723d0487349334a434b034b434b834bc34c434.4.4.4.4.4.4.4.4
0x723d14cc34d034d434d834dc34e034e434e834.4.4.4.4.4.4.4.4
0x723d24ec34f034f434f834fc34003504350835.4.4.4.4.4.5.5.5
0x723d340c351035143518351c35203524353235.5.5.5.5.5 5$525
0x723d444335553568357b358e35a735c835de35C5U5h5{5.5.5.5.5
0x723d54fa3519362d364e366c369036a536b836.5.6-6N6l6.6.6.6
⋯4 more rows
0x723da4d837e037e837f037f837003808381038.7.7.7.7.7.8.8.8
0x723db418382038283830383838403848385038.8 8(80888@8H8P8
0x723dc4583860386838703878388c38a238b338X8`8h8p8x8.8.8.8
0x723dd4d138e238fb3809391b39383946395439.8.8.8.9.989F9T9
0x723de4663979398d39b039be39cc39de39f139f9y9.9.9.9.9.9.9
0x723df4053a153a1d3a2e3a4a3a5b3a793a8a3a.:.:.:.:J:[:y:.:
0x723e04a43ab53ac53acd3ade3af13a0f3b213b.:.:.:.:.:.:.;!;
0x723e14343b423b523b623b743b873b953ba53b4;B;R;b;t;.;.;.;
0x723e24b73bcd3bdb3beb3bfd3b133c213c313c.;.;.;.;.;.<!<1<
0x723e34433c593c673c773c893c9f3cad3cbd3cC<Y<g<w<.<.<.<.<
0x723e44cf3ce53cf33c033d153d2b3d393d493d.<.<.<.=.=+=9=I=
0x723e545b3d713d7f3d8f3da13db73dc53dd53d[=q=.=.=.=.=.=.=
0x723e64e73dfd3d0b3e1b3e2d3e433e513e613e.=.=.>.>->C>Q>a>
0x723e74733e893e973ea73eb93ecf3edd3eed3es>.>.>.>.>.>.>.>
0x723e84ff3e153f233f333f453f5b3f693f793f.>.?#?3?E?[?i?y?
0x723e948b3f9d3fa53fb63fc53fcd3fde3ff13f.?.?.?.?.?.?.?.?
0x723ea4f93f0000003005001c0200000a302730.?...0.......0'0
0x723eb435304c306030683076308c30a930b73050L0`0h0v0.0.0.0
0x723ec4c730d830e930f9300131123123312b31.0.0.0.0.1.1#1+1
0x723ed43c314d3155316631793181319231a131<1M1U1f1y1.1.1.1
0x723ee4a931ba31ca31d231e031ee3100320832.1.1.1.1.1.1.2.2
0x723ef419322932313242325e326f3289329a32.2)212B2^2o2.2.2
0x723f04b332c132d032e632fe32063314332533.2.2.2.2.2.3.3%3
0x723f1441335233603368337633843395339d33A3R3`3h3v3.3.3.3
0x723f24ab33b933ce33d633e433f23302340a34.3.3.3.3.3.3.4.4
0x723f341b342d34353443345134693477348a34.4-454C4Q4i4w4.4
0x723f44a234b434c134c534df34e634ed34f434.4.4.4.4.4.4.4.4
0x723f54fb3402350935103517351e3525352c35.4.5.5.5.5.5%5,5
0x723f643635563577357b357f359a35bc35e33565V5w5{5.5.5.5.5
0x723f741236363660368d36b936e8361c379837.666`6.6.6.6.7.7
0x723f849c37a037a437a837ac37ba37c837d937.7.7.7.7.7.7.7.7
0x723f94e537f537083859385d38613865387338.7.7.8Y8]8a8e8s8
0x723fa481389038a438b038b438b838bc38c438.8.8.8.8.8.8.8.8

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.