Hostile 100% Download

2026-09-26_614b160185152c81daab71b889d1cdff_coinminer_elex_wannacry

UPX-packed ransomware dropper

Unsigned VirtualAlloc stub shells cmd.exeUnsigned WinExec payload deletes a file
SHA-256f690d2755d05f80760a494485eec453844407bcbc5abdbcbf423f2840019fdd9
URLhttps://tria.ge/api/v0/samples/260927-tl44ks1gne/sample
MaleculeO₄(C₃As₁₀Er₂Xe)H₈(Cm₂DbDsF₆MgOs₃Po₅Ti)Md₃(Bi₇HeSi)

Evidence

UPX packed section name 0x3a0–0x650
⋯5 more rows
0x3f000000000000000000000000000000000................
0x400558bec6aff682448400064a100000000[email protected].....
0x410506489250000000051894df08b450850Pd.%....Q.M..E.P
0x42068820000008b4df0e885330000c745fch.....M...3...E.
⋯35 more rows
WinExec command execution API 0x4f90–0x5130
⋯6 more rows
0x4ff0085c4000000000000000000000000000.\@.............
0x50000000000000000000ffffffffe0484000.............H@.
0x501000000000e94840002005931904000000.....H@. .......
0x5020385c40000000000000000000000000008\@.............
0x50300000000000000000ffffffffff484000.............H@.
0x504000000000084940000100000014494000[email protected]@.
0x505002000000234940002005931902000000....#I@. .......
0x5060785c4000000000000000000000000000x\@.............
0x50700000000000000000ffffffff3c494000............<I@.
0x5080ffffffff454940002005931901000000....EI@. .......
⋯11 more rows
References Windows cmd.exe interpreter 0x64f0–0x6690
⋯7 more rows
0x65607762000025735c25732e657865000000wb..%s\%s.exe...
0x6570636d642e657865202f632070696e6720cmd.exe /c ping
0x65803132372e302e302e31202d6e20322625127.0.0.1 -n 2&%
0x65907320222573220000633a5c776973656ds "%s"..c:\wisem
⋯5 more rows
0x65f06c0000004d5a0000633a5c77696e646fl...MZ..c:\windo
0x660077735c73797374656d33325c72756e64ws\system32\rund
0x66106c6c33322e6578650000000025732022ll32.exe....%s "
0x66202573222c47657450726f632025730000%s",GetProc %s..
⋯7 more rows
PE resource entropy is at least 6.6 0x9ba0–0x9e70
⋯5 more rows
0x9bf000000000000000000000000000000000................
0x9c000000000000000000426f6d6501000300........Bome....
0x9c1020020080300000800300000070000080 ...0.......p...
0x9c2005000000a00100800e000000e0010080................
0x9c3000000000000000000000000000000100................
0x9c4093000000480000800000000000000000....H...........
0x9c5000000000000001000408000060000000............`...
0x9c6048620400006803000000000000000000Hb...h..........
0x9c7000000000d89f3a56426f6d6500000600......:VBome....
0x9c8001000000b000008002000000d8000080................
0x9c9003000000000100800400000028010080............(...
0x9ca005000000500100800600000078010080....P.......x...
0x9cb000000000d89f3a56426f6d6500000100......:VBome....
0x9cc000000000c80000004cca0700a80e0000........L.......
0x9cd0000000000000000000000000d89f3a56..............:V
0x9ce0426f6d650000010000000000f0000000Bome............
0x9cf0f8d80700a80800000000000000000000................
0x9d0000000000d89f3a56426f6d6500000100......:VBome....
0x9d100000000018010000a4e1070068050000............h...
0x9d20000000000000000000000000d89f3a56..............:V
0x9d30426f6d65000001000000000040010000Bome........@...
0x9d4010e70700e81e00000000000000000000................
0x9d5000000000d89f3a56426f6d6500000100......:VBome....
0x9d600000000068010000fc050800a8100000....h...........
0x9d70000000000000000000000000d89f3a56..............:V
0x9d80426f6d65000001000000000090010000Bome............
0x9d90a8160800680400000000000000000000....h...........
0x9da000000000d89f3a56426f6d6500000100......:VBome....
0x9db08c2b0000b801008000000000d89f3a56.+............:V
0x9dc0426f6d650000010009040000d0010000Bome............
0x9dd0141b0800ba0100000000000000000000................
0x9de000000000d89f3a56426f6d6501000000......:VBome....
0x9df02a020080f801008000000000d89f3a56*.............:V
0x9e00426f6d65000001000000000010020000Bome............
0x9e10d41c08005a0000000000000000000000....Z...........
0x9e2004004c0049004e004b000b0053004800..L.I.N.K...S.H.
0x9e3045004c004c00330032005f0032003200E.L.L.3.2._.2.2.
0x9e40350000004482000026cab6f0cd26f0ca5...D...&....&..
0x9e502af0ca26efc926f08226f0ca26f0ca26*..&..&..&..&..&
0x9e6030ca26f0ca26f0ca26f0ca26f0ca26f00.&..&..&..&..&.
0x9e70ca26f0ca26f0ca26f0ca26f0ca26f0ca.&..&..&..&..&..
VirtualAlloc API string reference 0x459dd–0x45b7d
0x459dd0000002806008000000000a81e080000...(............
0x459ed000000ae1e0800000000001500008000................
0x459fd0000004b45524e454c33322e444c4c00...KERNEL32.DLL.
0x45a0d47444933322e646c6c004d464334322eGDI32.dll.MFC42.
0x45a1d444c4c004d53564352542e646c6c0055DLL.MSVCRT.dll.U
0x45a2d53455233322e646c6c005753325f3332SER32.dll.WS2_32
0x45a3d2e646c6c0000004c6f61644c69627261.dll...LoadLibra
0x45a4d727941000047657450726f6341646472ryA..GetProcAddr
0x45a5d65737300005669727475616c50726f74ess..VirtualProt
0x45a6d65637400005669727475616c416c6c6fect..VirtualAllo
0x45a7d6300005669727475616c467265650000c..VirtualFree..
0x45a8d004578697450726f6365737300000044.ExitProcess...D
0x45a9d656c6574654f626a6563740000657869eleteObject..exi
0x45aad740000497349636f6e69630000000000t..IsIconic.....
0x45abd00000000000000000000000000000000................
0x45acd00000000000000000000000000000000................
0x45add00000000000000000000000000000000................
0x45aed00000000000000000000000000000000................
0x45afd00000000000000000000000000000000................
0x45b0d00000000000000000000000000000000................
0x45b1d00000000000000000000000000000000................
0x45b2d00000000000000000000000000000000................
0x45b3d00000000000000000000000000000000................
0x45b4d00000000000000000000000000000000................
0x45b5d00000000000000000000000000000000................
0x45b6d00000000000000000000000000000000................
0x45b7d00 .

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.