Hostile ^93% Download

2026-09-26_0e758c3d62ad59cbd809d37491ff61cf_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom

Trojanized Opera installer malware

Encrypted reloc payload launches processResource loader combines registry, command, anti-debug, and file cleanup

SHA-256fa84708cbfba9751734e4bdfe1e11304a7fdda4642e219bd8c01e5e84fd47cef

URLhttps://tria.ge/api/v0/samples/260927-eham8saa22/sample

MaleculeK(Li)O₁₃(As₁₀C₄Co₃Dy₃Er₁₀P₃Pr₂AlCa₂ILaSXe)H₁₀(Po₂₄Cm₁₁Cr₅Db₆F₁₆Hf₃Mg₃Os₂₃TiU₅)Md₇(Bi₁₄He₂PaPtSi)

Evidence

UTF-16 exe filename suffix token 0xe123c–0xe13cc

0xe123c0f841a1400004c8d71184c89eae8f280......L.q.L.....
0xe124c2600ebbdb920000000e8765a2f004889&.... ....vZ/.H.
0xe125c84243001000048c78424380100000c00.$0...H..$8.....
0xe126c000048b9ffffffffffffff7f4883c111..H.........H...
0xe127c48898c2440010000488d48184839c10f[email protected]..
0xe128c82cb130000488d15e03452004839d041.....H...4R.H9.A
0xe129c0f97c04839d10f96c14408c10f84ae13...H9....D......
0xe12ac00000f1005c33452000f110048b92e00......4R....H...
0xe12bc6500780065004889481066c740180000e.x.e.H.H.f.@...
0xe12cc0f57c00f2984241001000048c7842420.W..).$....H..$ 
0xe12dc01000000000000488db4242009000048.......H..$ ...H
0xe12ec89f1e82dd20500480fbe46174885c048...-...H..F.H..H
0xe12fc8b6c24287910488b842428090000488b.l$(y.H..$(...H.
0xe130cb42420090000488d9424000100004889.$ ...H..$....H.
0xe131c3248894208488d8c2410010000e812a82H.B.H..$.......
0xe132c260080bc2437090000007922488b9424&...$7....y"H..$
0xe133c3009000048b8ffffffffffffff7f48210...H.........H!
0xe134cc2488b8c2420090000e876ed2600488d.H..$ ....v.&.H.
0xe135c842430010000480fbe48174885c9480f.$0...H..H.H..H.
0xe136c484808480f4800488d9424f000000048HH.H.H.H..$....H
0xe137c890248894a08488d8c2420090000e811..H.J.H..$ .....
0xe138c802600488db42438090000488d9c2410.&.H..$8...H..$.
0xe139c0100004889f14889dae8967f2600488d...H..H.....&.H.
0xe13ac942450090000488d05df3352004c8d84.$P...H...3R.L..
0xe13bc24e000000049890049c7400804000000$....I..I.@.....
0xe13cc48                              H               

References Windows cmd.exe interpreter 0x5e54a8–0x5e5628

⋯7 more rows
0x5e5518726572726f722e00434f4d5350454300rerror..COMSPEC.
0x5e5528636d642e657865002f63000000000000cmd.exe./c......
0x5e55380000000000000000ffffffffffffff7f................
⋯15 more rows

Enumerate installed system locales 0x5e6ab0–0x5e6be0

⋯5 more rows
0x5e6b007472696e674578000500000012000000tringEx.........
0x5e6b10456e756d53797374656d4c6f63616c65EnumSystemLocale
0x5e6b2073457800000000000100000013000000sEx.............
0x5e6b30466c7347657456616c75653200000000FlsGetValue2....
⋯11 more rows

Create registry key via WinAPI 0x6b6afc–0x6b6dec

⋯7 more rows
0x6b6b6c1200426567696e5061696e7400002000..BeginPaint.. .
0x6b6b7c43616c6c4e657874486f6f6b45780000CallNextHookEx..
0x6b6b8c220043616c6c57696e646f7750726f63".CallWindowProc
⋯13 more rows
0x6b6c6c00001a0146696e6457696e646f774578....FindWindowEx
0x6b6c7c5700210147657441637469766557696eW.!.GetActiveWin
0x6b6c8c646f770028014765744173796e634b65dow.(.GetAsyncKe
0x6b6c9c79537461746500003a01476574436c69yState..:.GetCli
⋯10 more rows
0x6b6d4c97014765744e657874446c6747726f75..GetNextDlgGrou
0x6b6d5c704974656d009a01476574506172656epItem...GetParen
0x6b6d6c7400c001476574517565756553746174t...GetQueueStat
0x6b6d7c75730000cf014765745368656c6c5769us....GetShellWi
0x6b6d8c6e646f770000d4014765745379737465ndow....GetSyste
0x6b6d9c6d4d656e7500e90147657457696e646fmMenu...GetWindo
0x6b6dac7700f60147657457696e646f774c6f6ew...GetWindowLon
0x6b6dbc675074725700f70147657457696e646fgPtrW...GetWindo
0x6b6dcc774c6f6e67570000fe0147657457696ewLongW....GetWin
0x6b6ddc646f775265637400040247657457696edowRect...GetWin
0x6b6dec646f77546578744c656e677468570000dowTextLengthW..

RWX .reloc encrypted payload staging 0x7f9380–0x7f9520

⋯7 more rows
0x7f93f000000000000000000000000000000000................
0x7f940000205e001400000050a458a460a428a5. ^.....P.X.`.(.
0x7f9410e0a6000000305e0020000000b8a9d0a9.....0^. .......
0x7f9420d8a978aa80aa88aa90aa78af80af88af..x.......x.....
0x7f9430a0af000000405e004800000008a110a1.....@^.H.......
⋯15 more rows