Benign Download

Backdoor.Win32.Agobot.pvy

High-entropy UPX1 packed payload sectionIsDebuggerPresent API name in PE strings
SHA-25616058264511b098adb554fc4510a3ad821326ba9251aec81b1cc0216c2fa5a4c
MaleculeH(Po₂)Md(Bi)

Evidence

High-entropy UPX1 packed payload section 0x1c0–0x290
⋯3 more rows
0x1f000000000000000000000000000000000................
0x200db34ffff04104000010843617264696e[email protected]
0x210616c0500ff901c176cb7dfbe0a065374al......l.....St
0x220721667ff259c700d8bc0079832c82083r.g.%.p.....2. .
⋯7 more rows
IsDebuggerPresent API name in PE strings 0x558c4–0x55994
⋯3 more rows
0x558f46f6465202564290025583a4441460000ode %d).%X:DAF..
0x559044973446562756767657250726573656eIsDebuggerPresen
0x55914740000004b65726e656c333200000000t...Kernel32....
0x55924284c6f636174696f6e205845422c2065(Location XEB, e
⋯7 more rows
References the Windows debugger output API 0x55b8c–0x55c6c
⋯3 more rows
0x55bbc6d000000777269746520746f00000000m...write to....
0x55bcc4f75747075744465627567537472696eOutputDebugStrin
0x55bdc675700004f7574707574446562756753gW..OutputDebugS
0x55bec7472696e674100005f52530025750000tringA.._RS.%u..
0x55bfc53657450726f6365737353687574646fSetProcessShutdo
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.