2026-09-30_15fc202aca1bccfccedb56689f60529f_amadey_coinminer_cryptolocker_elex_smoke-loader_stealc_stop_tofsee
Multi-malware loader with C2 and injection
Redundant numbered C2 domain pools resolved over DoHSfuzuan downloader C2 and host-report profile
SHA-256e9b5a10913a6899e9c5f2465eae6021ee78d0db623a770913c0a7ac938e41a49
Evidence
⋯17 more rows
0x24fef00068080868081800000100386808682................
0x24fff80140505454545858585050000303080....EEE......00.
0x2500f50808800080028273850578000070037P.....('8PW....7
0x2501f3030505088000000202880888080000000PP.... (......
0x2502f00606860686868080807787070777070.`h`hhh...xppwpp
0x2503f08080000080008000708000000000000................
0x2504f0015c24100d15c4100d15c41000bd141...A..\A..\A...A
0x2506f20657863657074696f6e000000630063 exception...c.c
0x2507f00730000005500540046002d00380000.s...U.T.F.-.8..
0x2508f005500540046002d00310036004c0045.U.T.F.-.1.6.L.E
0x2509f000000000055004e00490043004f0044.....U.N.I.C.O.D
0x250af004500000047657450726f6365737357.E...GetProcessW
0x250bf696e646f7753746174696f6e00476574indowStation.Get
0x250cf557365724f626a656374496e666f726dUserObjectInform
0x250df6174696f6e410000004765744c617374ationA...GetLast
0x250ef416374697665506f7075700000476574ActivePopup..Get
0x250ff41637469766557696e646f77004d6573ActiveWindow.Mes
0x2510f73616765426f7841005553455233322esageBoxA.USER32.
0x2511f444c4c000020436f6d706c657465204fDLL.. Complete O
0x2512f626a656374204c6f6361746f72270000bject Locator'..
0x2513f0020436c617373204869657261726368. Class Hierarch
0x2514f792044657363726970746f7227000000y Descriptor'...
0x2515f00204261736520436c61737320417272. Base Class Arr
0x2516f6179270000204261736520436c617373ay'.. Base Class
0x2517f2044657363726970746f722061742028 Descriptor at (
0x2518f0020547970652044657363726970746f. Type Descripto
0x2519f7227000000606c6f63616c2073746174r'...`local stat
0x251af69632074687265616420677561726427ic thread guard'
0x251bf00606d616e6167656420766563746f72.`managed vector
0x251cf20636f707920636f6e7374727563746f copy constructo
⋯5 more rows
0x2624447006c006f00620061006c005c000000G.l.o.b.a.l.\...
0x2625453006500440065006200750067005000S.e.D.e.b.u.g.P.
0x2626472006900760069006c00650067006500r.i.v.i.l.e.g.e.
0x2627400000000530065005400630062005000....S.e.T.c.b.P.
0x2628472006900760069006c00650067006500r.i.v.i.l.e.g.e.
0x2629400000000450078006300650070007400....E.x.c.e.p.t.
⋯13 more rows
0x2637474797065000000006461746100000000type....data....
0x26384770069006e006c006f0067006f006e00w.i.n.l.o.g.o.n.
0x263942e006500780065000000000051756572..e.x.e.....Quer
⋯3 more rows
0x263d4000000007069645b25645d2070706964....pid[%d] ppid
0x263e45b25645d202573000000000075007300[%d] %s.....u.s.
0x263f4650072006e0061006d0065003d002500e.r.n.a.m.e.=.%.
0x2640473002400260024006d00610063003d00s.$.&.$.m.a.c.=.
0x2641425007300240026002400650072007200%.s.$.&.$.e.r.r.
0x264246f0072003d00250073007c0025007300o.r.=.%.s.|.%.s.
0x2643424002600240077006f0072006b007400$.&.$.w.o.r.k.t.
0x264447900700065003d002500640025006400y.p.e.=.%.d.%.d.
0x2645424002600240076006500720073006900$.&.$.v.e.r.s.i.
0x264646f006e003d002500730000002f007200o.n.=.%.s.../.r.
0x26474650070006f00720074002e0070006800e.p.o.r.t...p.h.
0x2648470003f0074007900700065003d006300p.?.t.y.p.e.=.c.
0x264946c00690065006e007400260064006100l.i.e.n.t.&.d.a.
0x264a4740061003d002500730000006e007200t.a.=.%.s...n.r.
0x264b46500700072006f0074002e0000000000e.p.r.o.t.......
0x264c464006f0077006e002e00000068007400d.o.w.n.....h.t.
0x264d47400700073003a002f002f0025007300t.p.s.:././.%.s.
0x264e42f007200650070006f00720074002e00/.r.e.p.o.r.t...
⋯3 more rows
0x265fb004700450054000000000000002f0063.G.E.T......./.c
0x2660b002000740069006d0065006f00750074. .t.i.m.e.o.u.t
0x2661b0020002f007400200031002000260020. ./.t. .1. .&.
0x2662b00640065006c0020002f00510020002f.d.e.l. ./.Q. ./
0x2663b00460020002200250073002200000000.F. .".%.s."....
0x2664b0063006d0064002e0065007800650000.c.m.d...e.x.e..
0x2665b006f00700065006e0000000000250078.o.p.e.n.....%.x
0x2666b0000000000696e76616c6964206d6170.....invalid map
0x2667b2f7365743c543e206974657261746f72/set<T> iterator
0x2668b00000000003131342e3131342e313134.....114.114.114
0x2669b2e313134003232332e352e352e350000.114.223.5.5.5..
0x266ab00680071006400300020002500640000.h.q.d.0. .%.d..
⋯10 more rows
⋯3 more rows
0x305d0727300004e54444c4c2e444c4c000000rs..NTDLL.DLL...
0x305e0720075006e0061007300000057534854r.u.n.a.s...WSHT
0x305f0435049502e444c4c000000002e000000CPIP.DLL........
⋯4 more rows
0x30640350030003400390000000000000000005.0.4.9.........
0x30650680074007400700073003a002f002f00h.t.t.p.s.:././.
0x3066064006e0073002e0061006c0069006400d.n.s...a.l.i.d.
0x306706e0073002e0063006f006d002f007200n.s...c.o.m./.r.
0x30680650073006f006c00760065003f006e00e.s.o.l.v.e.?.n.
0x3069061006d0065003d002500730026007400a.m.e.=.%.s.&.t.
0x306a07900700065003d002500640000000000y.p.e.=.%.d.....
0x306b068007400740070003a002f002f006400h.t.t.p.:././.d.
0x306c06e0073002e0061006c00690064006e00n.s...a.l.i.d.n.
0x306d073002e0063006f006d002f0072006500s...c.o.m./.r.e.
0x306e073006f006c00760065003f006e006100s.o.l.v.e.?.n.a.
0x306f06d0065003d0025007300260074007900m.e.=.%.s.&.t.y.
0x30700700065003d0025006400000000000000p.e.=.%.d.......
0x30710680074007400700073003a002f002f00h.t.t.p.s.:././.
0x307203200320033002e0035002e0035002e002.2.3...5...5...
0x3073035002f007200650073006f006c0076005./.r.e.s.o.l.v.
0x3074065003f006e0061006d0065003d002500e.?.n.a.m.e.=.%.
0x307507300260074007900700065003d002500s.&.t.y.p.e.=.%.
0x3076064000000000000006800740074007000d.......h.t.t.p.
0x307703a002f002f003200320033002e003500:././.2.2.3...5.
0x307802e0035002e0035002f00720065007300..5...5./.r.e.s.
0x307906f006c00760065003f006e0061006d00o.l.v.e.?.n.a.m.
⋯14 more rows
0x3088066006d006e0020002500730020000000f.m.n. .%.s. ...
0x30890496e69744d4b00007300700069003100InitMK..s.p.i.1.
⋯7 more rows
0x5c69301536c65657000014372656174655072.Sleep..CreatePr
0x5c6a36f636573735700015465726d696e6174ocessW..Terminat
0x5c6b36550726f6365737300014c6f61644c69eProcess..LoadLi
0x5c6c362726172794100014765745665727369braryA..GetVersi
⋯15 more rows