Benign Download

Backdoor.Win32.Prorat.btg

Embedded PE binary at file offset 0x5acb8 (~164096 bytes)References the Windows debugger output API
SHA-25603df1982287d9c35289edaa183e4ef0584d0b88c014947a5109e6658af63bca5
MaleculeO(Er)H(Po)

Evidence

Embedded PE binary at file offset 0x5acb8 (~164096 bytes) 0x5ac78–0x5ad48
⋯3 more rows
0x5aca8706170692e646c6c0000000000000000papi.dll........
0x5acb84d5a90000300000004000000ffff0000MZ..............
0x5acc8b8000000000000004000000000000000........@.......
0x5acd800000000000000000000000000000000................
⋯7 more rows
References the Windows debugger output API 0x65d54–0x65e24
⋯3 more rows
0x65d844973426164577269746550747200f501IsBadWritePtr...
0x65d944f75747075744465627567537472696eOutputDebugStrin
0x65da467410000ff026c737472636d70694100gA....lstrcmpiA.
0x65db4c3025669727475616c50726f74656374..VirtualProtect
⋯7 more rows
Detour-style InstallHook helper name 0x661a9–0x66269
⋯3 more rows
0x661d94c4c2e646c6c00486f6f6b50726f6300LL.dll.HookProc.
0x661e9496e7374616c6c486f6f6b0052656d6fInstallHook.Remo
0x661f97665486f6f6b00000000000000000000veHook..........
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.