Suspicious ^80% Download

Backdoor.Win32.DarkMoon.41

Named backdoor, encoded C2, shell exec

Percent-encoded content decodedExecute shell command (ShellExecuteA)

SHA-25604f727a69acf671305d9f5ac706fcf59ae9de2edccd0882ef5dcf76d7c4ad27c

Evidence

Percent-encoded content decoded 0x10d6c–0x10e4c

⋯3 more rows
0x10d9c0300000025343000ffffffff59000000....%40.....Y...
0x10dac417574686f72697a6174696f6e3a2050Authorization: P
0x10dbc617373706f7274312e34204f72675665assport1.4 OrgVe
0x10dcc72623d4745542c4f726755524c3d6874rb=GET,OrgURL=ht
0x10ddc74702533412532462532466d65737365tp%3A%2F%2Fmesse
⋯7 more rows

Query/set system parameters (string) 0x17d2c–0x17dcc

0x17d2c00006b657962645f6576656e74000000..keybd_event...
0x17d3c55706461746557696e646f7700005472UpdateWindow..Tr
0x17d4c616e736c6174654d6573736167650000anslateMessage..
0x17d5c53797374656d506172616d6574657273SystemParameters
0x17d6c496e666f41000000537761704d6f7573InfoA...SwapMous
0x17d7c65427574746f6e00000053686f775769eButton...ShowWi
⋯5 more rows

Execute shell command (ShellExecuteA) 0x1b2b4–0x1b3f4

0x1b2b47676376352496b574f765667727a6736vv7cRIkWOvVgrzg6
0x1b2c4464f794e47725a3234434f78544b4d42FOyNGrZ24COxTKMB
0x1b2d46e61346175572f2b536c7153632b6373na4auW/+SlqSc+cs
0x1b2e46f644651453055354b4977354b2b366aodFQE0U5KIw5K+6j
0x1b2f4507249754d304975502b71694a6d4570PrIuM0IuP+qiJmEp
⋯5 more rows
0x1b354366a643679786f6c784d3672576b59546jd6yxolxM6rWkYT
0x1b3645166735870684f33685531765831676dQfsXphO3hU1vX1gm
0x1b37454764b34487a446a2f2b75556b6d514fTvK4HzDj/+uUkmQO
0x1b384667741393255554f2b75396b48717342fwA92UUO+u9kHqsB
⋯7 more rows