Suspicious 80% Download

Backdoor.Win32.Optix.tpcy

Backdoor with embedded PE and hooks

Binary contains a UPX packing markerUPX decompression I/O error
SHA-25622662280aa5accd040ff5be807204403bc31a33df7944e3997e8e5a4b288d263
MaleculeO(Er)

Evidence

Embedded PE binary at file offset 0x5a5ac (~28871 bytes) 0x5a56c–0x5a63c
⋯3 more rows
0x5a59c7465044c65667403c800000000000000te.Left.........
0x5a5ac4d5a50000200000004000f00ffff0000MZP.............
0x5a5bcb80000000000000040001a0000000000........@.......
0x5a5cc00000000000000000000000000000000................
⋯7 more rows
Detour-style InstallHook helper name 0x5c1b0–0x5c270
⋯3 more rows
0x5c1e050600000000001004b6d642e646c6c00P`......Kmd.dll.
0x5c1f0496e7374616c6c486f6f6b00556e696eInstallHook.Unin
0x5c2007374616c6c486f6f6b00000000000000stallHook.......
⋯7 more rows
Embedded PE binary at file offset 0x5a5ac (~28871 bytes) Backdoor.Win32.Optix.tpcy · 0x5a56c–0x5a63c
⋯3 more rows
0x5a59c7465044c65667403c800000000000000te.Left.........
0x5a5ac4d5a50000200000004000f00ffff0000MZP.............
0x5a5bcb80000000000000040001a0000000000........@.......
0x5a5cc00000000000000000000000000000000................
⋯7 more rows
Detour-style InstallHook helper name Backdoor.Win32.Optix.tpcy · 0x5c1b0–0x5c270
⋯3 more rows
0x5c1e050600000000001004b6d642e646c6c00P`......Kmd.dll.
0x5c1f0496e7374616c6c486f6f6b00556e696eInstallHook.Unin
0x5c2007374616c6c486f6f6b00000000000000stallHook.......
⋯7 more rows
Detour-style InstallHook helper name embedded:pe@0x5a5ac · 0x1c04–0x1cc4
⋯3 more rows
0x1c3450600000000001004b6d642e646c6c00P`......Kmd.dll.
0x1c44496e7374616c6c486f6f6b00556e696eInstallHook.Unin
0x1c547374616c6c486f6f6b00000000000000stallHook.......
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.