Suspicious 80% Download

Backdoor.Win32.IRCBot.acl

Named IRC bot backdoor

Process analysis tool detectionIsDebuggerPresent API name in PE strings
SHA-256248056ca208a4700a8d2cdab42ad9a8039403487bc09c7ec4bf0822edc894d33
MaleculeO(Al)H(Po₂)

Evidence

Autoruns (Sysinternals) 0x1f3a–0x205a
⋯5 more rows
0x1f8aba72756e73898d60f8ffffb9632e6578.runs..`....c.ex
0x1f9a898558f9ffffb86500000089bd5cf9ff..X....e.....\..
0x1faaffbf2801000089b560f9ffff31f6899d..(.....`...1...
⋯11 more rows
IsDebuggerPresent API name in PE strings 0xf676–0xf746
⋯3 more rows
0xf6a66f64756c6548616e646c65410000ff01oduleHandleA....
0xf6b64973446562756767657250726573656eIsDebuggerPresen
0xf6c6740039024f70656e50726f6365737300t.9.OpenProcess.
0xf6d60000470250726f636573733332466972..G.Process32Fir
⋯7 more rows
Execute shell command (ShellExecuteA) 0x12218–0x12398
⋯3 more rows
0x12248800100000500000003002e6964617461...........idata
0x122582436840600000500000003002e746578$6...........tex
0x122687400000030bd00000100000003002e64t...0..........d
0x1227861746100000000260000020000000300ata....&........
⋯7 more rows
0x122f861000000002600000200000003002e62a....&.........b
0x12308737300000000400d0000040000000300ss....@.........
0x123182e69646174612437b408000005000000.idata$7........
0x1232803002e69646174612435f80200000500...idata$5......
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.