Trojan.Win32.Agent2.bhe
Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Detects an XORed URL in an executable
SHA-2561220c33c233dd6c138ab96f4b10b6d000ec06d306da8f7375012bbae3d51657b
MaleculeMdTh
Evidence
⋯3 more rows
0xbe4442607d71776161467d79777c12121212B`}qwaaF}yw|....
0xbe54537e7e7d71736677537c765b7c7b667bS~~}qsfwS|v[|{f{
0xbe64737e7b6877417b761212121273766473s~{hwA{v....svds
0xbe74627b21203c767e7e12121212776a7712b{! <v~~....wjw.
0xbe841812121237612d617b762f3761121212....7a-a{v/7a...
0xbe9437614e3761121212666a66123c1212127aN7a...fjf.<...
0xbea4377612125371717762662832383d381f7v..Sqqwbf(28=8.
0xbeb4181f18476177603f5375777c6628325f...Gaw`?Suw|f(2_
0xbec47d687b7e7e733d273c22323a457b7c76}h{~~s='<"2:E{|v
0xbed47d65612932472932457b7c767d656132}ea)2G)2E{|v}ea2
0xbee45c4632273c2329326067293260642823\F2'<#)2`g)2`d(#
0xbef43c2b3c223c213b32557771797d3d2022<+<"<!;2Uwqy}= "
⋯7 more rows
0xbf747c7d6761121212125e7d757d74741212|}ga....^}u}tt..
0xbf845e7d757d7c121212417d746665736077^}u}|...A}tfes`w
0xbf944e5f7b71607d617d74664e457b7c767dN_{q`}a}tfNE{|v}
0xbfa46561325c464e51676060777c66447760ea2\FNQg``w|fDw`
0xbfb4617b7d7c4e457b7c7e7d757d7c4e5c7da{}|NE{|~}u}|N\}
0xbfc4667b746b4e12121260677c767e7e2120f{tkN...`g|v~~!
0xbfd43c776a773237613e611212125f414177<wjw27a>a..._AAw
0xbfe46064776012121212415d544645534057`dw`....A]TFES@W
0xbff44e5f7b71607d617d74664e457b7c767dN_{q`}a}tfNE{|v}
0xc00465614e51676060777c66447760617b7deaNQg``w|fDw`a{}
0xc0147c4e40677c4e1212576477606b7d7c77|N@g|N..Wdw`k}|w
0xc0241212121251474040575c464d47415740....QG@@W\FMGAW@
⋯7 more rows