Hostile ^92% windows

ScreenWings.exe

Massive crypto-wallet credential stealer

Detects binaries and memory artifacts referencing sandbox product IDsMultiple browser wallet extension IDs

SHA-256e4ade0eccfadfcddd5e661ff81df733a961e6d16cd0b154ecf2f93f21259affa

URLhttps://tria.ge/api/v0/samples/260824-rchg4svtbt/sample

MaleculeK(Am)O₄(AlCa₂AsPr)H₁₀(Cm₄Cr₃Db₄DsF₉Hf₄Mg₂Os₁₃Po₁₀Ti)Md₃(Bi₂Bk)Th

Evidence

Large overlay with very low entropy 0x0–0xe0

0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x3000000000000000000000000018010000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯9 more rows

Multiple browser wallet extension IDs 0x5fc–0x72c

⋯5 more rows
0x64c4d80e84db0030090ba382d00004803d7M..M.....8-..H..
0x65cc7026668626fc7420468696d61c74208..fhbo.B.hima.B.
0x66c656c626fc7420c68706a62c74210626celbo.B.hpjb.B.bl
0x67c6463c742146e67636ec7421861706e64dc.B.ngcn.B.apnd
⋯11 more rows

Nami wallet extension ID (Cardano) 0x1a90–0x1bc0

⋯5 more rows
0x1ae00000e8b99b030090bad02900004803d7..........)..H..
0x1af0c7026c706663c74204626a6b6ec74208..lpfc.B.bjkn.B.
0x1b00696a7065c7420c65696c6cc742106966ijpe.B.eill.B.if
0x1b106e6bc74214696b676ec7421863696b67nk.B.ikgn.B.cikg
⋯11 more rows

Petra wallet extension ID (Aptos) 0x1d84–0x2034

⋯5 more rows
0x1dd40000e8c598030090ba982500004803d7..........%..H..
0x1de4c702656a6a6cc742046164696ec74208..ejjl.B.adin.B.
0x1df46e636b64c7420c676a656dc74210656bnckd.B.gjem.B.ek
0x1e046562c742146470656fc742186b62696beb.B.dpeo.B.kbik
⋯7 more rows
0x1e8449ffc042803c020075f6488d8dc00700I..B.<..u.H.....
0x1e9400e80698030090bac02500004803d7c7.........%..H...
0x1ea40262666e61c74204656c6d6fc742086d.bfna.B.elmo.B.m
0x1eb465696dc7420c686c706dc74210676a6eeim.B.hlpm.B.gjn
0x1ec46ac742146f706868c74218706b6b6fc7j.B.ophh.B.pkko.
⋯7 more rows
0x1f44803c020075f6488d8d00080000e84a97.<..u.H.......J.
0x1f54030090ba582e00004803d7c70270686b....X...H....phk
0x1f6462c74204616d6566c74208696e6767c7b.B.amef.B.ingg.
0x1f74420c6d616b67c742106b6c706bc74214B.makg.B.klpk.B.
0x1f846c6a6a6dc742186769626fc7421c686eljjm.B.gibo.B.hn
⋯11 more rows

Native sandbox-injection DLL marker 0x2608b8–0x260ba8

⋯5 more rows
0x26090877006100720065004900440000000000w.a.r.e.I.D.....
0x26091873626965646c6c2e646c6c0000000000sbiedll.dll.....
0x2609287073746f7265632e646c6c0000000000pstorec.dll.....
⋯4 more rows
0x2609785378496e2e646c6c0000000000000000SxIn.dll........
0x2609887770657370792e646c6c000000000000wpespy.dll......
0x2609984e74506f776572496e666f726d617469NtPowerInformati
⋯13 more rows
0x260a7875006300740049006400000000000000u.c.t.I.d.......
0x260a8835353237342d3634302d32363733303655274-640-267306
0x260a98342d32333935300037363438372d36344-23950.76487-64
0x260aa8342d333137373033372d3233353130004-3177037-23510.
0x260ab837363438372d3333372d38343239393576487-337-842995
0x260ac8352d3232363134004e744f70656e4d755-22614.NtOpenMu
0x260ad874616e7400000000530061006e006400tant....S.a.n.d.
⋯13 more rows