Benign Download

Backdoor.Win32.Agent.iqi

CreateRemoteThread API referenceCreateRemoteThread API string
SHA-2560fb2de5d3343a6cc1582607a8453c47f91190a131e2db55de6c9681a04de870b
MaleculeO(Er)H(Po)

Evidence

CreateRemoteThread API string 0x15c1–0x1691
⋯3 more rows
0x15f10200dc0a020074100200000000004600......t.......F.
0x160143726561746552656d6f746554687265CreateRemoteThre
0x161161640071025365744c6173744572726fad.q.SetLastErro
0x162172005301476574537472696e67547970r.S.GetStringTyp
⋯7 more rows
Detour-style InstallHook helper name 0xe2c0–0xe380
⋯3 more rows
0xe2f0fd8c42fc09ff25a42e451501bfaef600..B...%..E......
0xe300496e7374616c6c486f6f6b00df025772InstallHook...Wr
0xe31069746546696c6500cb080200ed0a0200iteFile.........
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.