> Family · unclassified-mingw64-https-stager_

~/packetpursuit $ cat /intel/families/unclassified-mingw64-https-stager.md

confidencemediumupdated2026-07-26

unclassified-mingw64-https-stager

MinGW-w64 PE32+ x64 stage-1 downloader with HTTPS C2, AES-GCM payload encryption, and in-memory reflective PE loader. Singleton observed as of July 2026; no sibling cluster confirmed.

Capabilities

  • mingw-w64-pe32plus-build
  • wininet-https-downloader
  • bcrypt-aes-gcm-payload-decryption
  • hmac-sha256-payload-integrity
  • registry-disk-enum-vm-detection
  • getcursorpos-sleep-gettickcount-timing-gate
  • virtualalloc-rwx-reflective-pe-loader
  • loadlibrary-getprocaddress-import-resolution
  • isdebuggerpresent-check
  • base64-encoded-transport
  • hardcoded-ip-c2
  • stage1-stage2-chain

Notes

Sample 60996777bf4f37e0eec2a99d450664278f103077f12a4b59178ff240ccb1b803 (1c67179f5185105599a045f76bdfcd56.exe) — 92,672 bytes, PE32+ x64, stripped, unsigned, no overlay. MinGW-w64 GCC 8.x toolchain with winpthreads runtime. C2 https://77.110.123.164/api/stage1. Static-only (CAPE skipped — no Windows guest). ^[/intel/analyses/60996777bf4f37e0eec2a99d450664278f103077f12a4b59178ff240ccb1b803.html]