Benign Download

Backdoor.Win32.Prorat.ct

References the Windows debugger output APIDetour-style InstallHook helper name
SHA-25627280ac5b0fc69549310ef3de941f729cae17aa00e6c5ced1d15630ada4cad29
MaleculeO(Er)H(Po)

Evidence

References the Windows debugger output API 0x5136–0x5206
⋯3 more rows
0x51664973426164577269746550747200f501IsBadWritePtr...
0x51764f75747075744465627567537472696eOutputDebugStrin
0x518667410000ff026c737472636d70694100gA....lstrcmpiA.
0x5196c3025669727475616c50726f74656374..VirtualProtect
⋯7 more rows
Detour-style InstallHook helper name 0x558b–0x564b
⋯3 more rows
0x55bb4c4c2e646c6c00486f6f6b50726f6300LL.dll.HookProc.
0x55cb496e7374616c6c486f6f6b0052656d6fInstallHook.Remo
0x55db7665486f6f6b00000000000000000000veHook..........
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.