Hostile ^92% Download

2026-09-17_89752f51cf22021e8feeb6de24b763f8_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_remcos_smoke-loader_stealc_stop_tofsee

Multiple malware families, embedded PE

Detection of CryptoLocker VariantsDetection of Cryptolocker Samples

SHA-256c64e52fa65b3cea0333c79f80db2da7a9bda4f8fab3a4898f36dd371dfb59140

URLhttps://tria.ge/api/v0/samples/260917-hj53baab62/sample

MaleculeMdTh

Evidence

Detection of Cryptolocker Samples 0x2512b–0x252ab

⋯7 more rows
0x2519b6970746f7227000000606c6f63616c20iptor'...`local 
0x251ab73746174696320746872656164206775static thread gu
0x251bb6172642700606d616e61676564207665ard'.`managed ve
⋯15 more rows

Embedded PE binary at file offset 0x5f8f4 (~163840 bytes) 0x5f8b4–0x5f984

⋯3 more rows
0x5f8e400000000030056004d005000f0e00300......V.M.P.....
0x5f8f44d5a90000300000004000000ffff0000MZ..............
0x5f904b8000000000000004000000000000000........@.......
0x5f91400000000000000000000000000000000................
⋯7 more rows

Detection of CryptoLocker Variants 0x7ff4f–0x8018f

⋯7 more rows
0x7ffbf742d636f6d3a61736d2e7633223e0d0at-com:asm.v3">..
0x7ffcf202020203c73656375726974793e0d0a    <security>..
0x7ffdf2020202020203c726571756573746564      <requested
0x7ffef50726976696c656765733e0d0a202020Privileges>..   
0x7ffff20202020203c72657175657374656445     <requestedE
0x8000f7865637574696f6e4c6576656c206c65xecutionLevel le
0x8001f76656c3d226173496e766f6b65722220vel="asInvoker" 
0x8002f75694163636573733d2266616c736522uiAccess="false"
0x8003f3e3c2f72657175657374656445786563></requestedExec
0x8004f7574696f6e4c6576656c3e0d0a202020utionLevel>..   
0x8005f2020203c2f7265717565737465645072   </requestedPr
0x8006f6976696c656765733e0d0a202020203civileges>..    <
0x8007f2f73656375726974793e0d0a20203c2f/security>..  </
0x8008f7472757374496e666f3e0d0a3c2f6173trustInfo>..</as
0x8009f73656d626c793e504150414444494e47sembly>PAPADDING
⋯15 more rows

Percent-encoded content decoded 0x14cd98–0x14ce68

⋯3 more rows
0x14cdc874006500720000000000000000000000t.e.r...........
0x14cdd825003000380058002d00250030003400%.0.8.X.-.%.0.4.
0x14cde858002d0025003000340058002d002500X.-.%.0.4.X.-.%.
0x14cdf830003200580025003000320058002d000.2.X.%.0.2.X.-.
⋯7 more rows

Encoded content decoded: base64 0x155ca5–0x155d95

⋯3 more rows
0x155cd57970617373202d772031202d656e6320ypass -w 1 -enc 
0x155ce54a67416f414349416577417741483041JgAoACIAewAwAH0A
0x155cf565774178414830416577417941483041ewAxAH0AewAyAH0A
0x155d0549674174414759414a77425441436341IgAtAGYAJwBTACcA
0x155d154c41416e414555415641417441456b41LAAnAEUAVAAtAEkA
0x155d2564414246414363414c41416e41473041dABFACcALAAnAG0A
⋯7 more rows