Hostile ^100% datamaliciousorder Download

Virus.Hijack_Dropped.Backdoor.Padodor.BJ_215.vir

Padodor backdoor with credential theft

Berbew/Karton card-phishing backdoor identityCard-verification phishing prompt set

SHA-25612e3f9f3546ef334df9d30729d8b6a6cee001b2d60ed646e330b32ad935c0435

MaleculeK(Mc₂)O₆(Ca₂P₃As₅Er₄AlC₄)H₈(Cm₃DbF₂MgOs₈Po₆TiU)Md₆(Bi₈HePtSi)

Evidence

Detached or malformed signature in overlay 0x0–0xd0

0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
⋯11 more rows

ATM PIN phishing prompt 0xab84–0xae74

⋯7 more rows
0xabf4317a7c32317a7c32317a7c32317a7c321z|21z|21z|21z|2
0xac0465121541113139657d5a2f66643c3a12e..A.19e}Z/fd<:.
0xac14461b0f1252151857555a1e4b112c5212F...R..WUZ.K.,R.
0xac2467545c62642a377b7f565c5f5e1e1940gT\bd*7{.V\_^..@
0xac34500e134011151a12520809465e0a525c[email protected]^.R\
0xac44447a2b575d19135f545a085d11150940Dz+W].._TZ.]...@
0xac54111c134044175012701e095e455a2b57[email protected]..^EZ+W
0xac64535a3153420e1940425b5c5a450e0c08SZ1SB..@B[\ZE...
0xac741e551f40440e13421f140932702d311e[email protected].
0xac84110d195e52151157110e131272282966...^R..W....r()f
0xac947e2a527c645a5112793b2e7672352e77~*R|dZQ.y;.vr5.w
0xaca41e39337c653f32661e39347b7d3e5c62.93|e?2f.94{}>\b
0xacb47e28327d1e36337e782e3d611e283d62~(2}.63~x.=a.(=b
0xacc4747a2e7770365c717029341e11283973tz.wp6\qp)4..(9s
0xacd47d5a3e7b653934776b5a511272282966}Z>{e94wkZQ.r()f
0xace47e2a527c647a7c32317a355c52150e40~*R|dz|21z5\R..@
0xacf454190812702e31126133321e110a1057T...p.1.a32....W
0xad045009191e11191340431f1f46312a1057[email protected]*.W
0xad145009191e111f124654085c4b5e0f0e12P......FT.\K^...
0xad24702e31126133323278141f5d43081951p.1.a322x..]C..Q
0xad34455a3f6467485c1a0257185b56130812EZ?dgH\..W.[V...
0xad445215185711151212531b1f5911151a12R..W....S..Y....
0xad54521b0e5618565c425d1f1d4154565c51R..V.V\B]..ATV\Q
0xad645e080e57520e7c625d1f1d4154565c57^..WR.|b]..ATV\W
0xad745f0e194011031347435a3f6467485c1a[email protected]?dgH\.
0xad840257185b561308125215185711151212.W.[V...R..W....
0xad94531b1f5911151a12521b0e56187a5941S..Y....R..V.zYA
0xada41c5f0f3261161953421f5012421f1057._.2a..SB.P.B..W
⋯4 more rows
0xadf4555a32475c1819401d5a0c5e541b0f57UZ2G\[email protected].^T..W
0xae041d5a1f5d43081951457a2c5e541b0f57.Z.]C..QEz,^T..W
0xae141d5a195c451f0e124815094011391d40.Z.\[email protected].@
0xae24555a32475c181940315f0f1214097c62UZ2G\..@1_....|b
0xae345d1f1d4154565c575f0e194011191340]..ATV\W_..@...@
0xae44431f1f46113c095e5d5a32535c1f7c62C..F.<.^]Z2S\.|b
0xae545d1f1d4154565c4154161951455a3f53]..ATV\AT..QEZ?S
0xae64431e5c1a67130f531e371d41451f0e71C.\.g..S.7.AE..q
0xae745008181b311c0e5f037a2e5756130f46P...1.._.z.WV..F

References the COM ThreadingModel registry value 0xb4ec–0xb71c

⋯7 more rows
0xb55c141959513118105b5f1e2347421f0e32..YQ1..[_.#GB..2
0xb56c661f1e12740c195c455a305d561d1940f...t..\EZ0]V..@
0xb57c31291354450d1d405426315b520813411).TE..@T&1[R..A
0xb58c5e1c086e661312565e0d0f6e720f0e40^..nf..V^..nr..@
0xb59c5414086454080f5b5e142061591f105eT..dT..[^. aY..^
0xb5ac621f0e445819197d53101951453e195eb..DX..}S..QE>.^
0xb5bc5003305d501e7c73411b0e465c1f1246P.0]P.|sA..F\..F
0xb5cc312e1440541b185b5f1d315d551f10321..@T..[_.1]U..2
0xb5dc31393061783e20174226355c61081351190ax> .B&5\a..Q
0xb5ec621f0e4454084f00315f0f6e14095256b..DT.O.1_.n..RV
0xb5fc5d167c4906433a7770393a741c3c3a71].|I.C:wp9:t.<:q
0xb60c74574403043f5173084a4c1f024b4a00tWD..?Qs.JL..KJ.
0xb61c084a3e07734d4f0a4c7a76323b2e2466.J>.sMO.Lzv2;.$f
0xb62c0b5a5b17425d7638315f4c00695a7c7a.Z[.B]v81_L.iZ|z
⋯15 more rows

Create registry key ANSI 0xc26a–0xc41a

⋯10 more rows
0xc30a476574557365724e616d654100007101GetUserNameA..q.
0xc31a5265674372656174654b657945784100RegCreateKeyExA.
0xc32a00007401526567436c6f73654b657900..t.RegCloseKey.
0xc33a000079015265674f70656e4b65794578..y.RegOpenKeyEx
0xc34a41008401526567517565727956616c75A...RegQueryValu
0xc35a65457841000090015265675365745661eExA....RegSetVa
0xc36a6c756545784100000000ca0147657453lueExA......GetS
0xc37a65637572697479496e666f000000cd01ecurityInfo.....
⋯10 more rows

GetStockObject import symbol 0x3126c–0x3153c

⋯5 more rows
0x312bc7b90c9b442ea36a1801a80cf42ebc9b5{...B.6.....B...
0x312cc3791334b42eac9768d693276846b16207.3KB..v.i2v.k. 
0x312dcbd7f362291cc744ad715de7fb51536b5..6"..tJ......6.
0x312ec883da90bbdfdd44dbd15df82bf1536ca.=.....M......6.
0x312fc38eac8b54214bccf42ebc9b5811644f38...B...B.....D.
0x3130c34ed37b234d2bbcfbceac9b5ed98b3bf4.7.4...........
0x3131c40eac91ad538ec08bd98b3bf40eac91a@....8......@...
0x3132c55f23f4abd96f25ad5ea364abd98b34bU.?J...Z..6J...K
0x3133c42eac91a422016d5fc15de1bba1536caB...B ........6.
0x3134c0014c9b54215436ad7155c4ad504ef08....B.Cj..\J....
0x3135cbd7f36a20112364a422016d5fc15de23..6...6JB .....#
0x3136cba1536a3f217364a7b90c8b442ea36a1..6...6J{...B.6.
0x3137c801a80cf43ebc9b53791334b42eac976....C...7.3KB..v
0x3138c8d693276846b1620bd7f362253cd744a.i2v.k. ..6"S.tJ
0x3139cd715de37ba1536b58835a90bbdfd1c4d...7..6..5.....M
0x313acbd15df5abf1536ca38ebc8b54214bbc7...Z..6.8...B...
0x313bcbceac9b53eddc90a3d29374ac8ec39fc....>...=)7J..9.
0x313cc28ebc8b5422cf438159ccebd5a9cb3a2(...B,.8....Z...
0x313dc40eac9c138fdcbb5429cf1c73814c9b5@...8...B...8...
0x313ec4245bbcf48e8c9b5ed7d1b90ff15bbcfBE..H....}......
0x313fc48e8c9b5edfd2443bd15b58ead9ccebdH.....$C........
0x3140c5a9cb3ae40eac9c138f1cbb5429cf120[email protected].. 
0x3141cbd7f3620b97f3620bd7d364abd555e0a..6 ..6 .}6J.U^.
0x3142c225436a22110364a3490c2b442ea5c48"T6.!.6J4...B.\H
0x3143cd7155c4a42a0c2b442eadee3b81536ca..\JB...B.....6.
0x3144c80658208bd15430d301806d3fd15b582.e....C.0.......
0x3145c4255b676bc1543b334d65c4a3080c6b7BU.v..C.4.\J0...
0x3146c42ea6419d525af0abdea83be43eac9a2B.d..%......C...
0x3147c5d10364ad715bbcf4de8c9b5ed7f3422].6J....M.....4"
⋯12 more rows