Benign Download

Rootkit.Win32.Agent.xi

Detects an XORed URL in an executableEmbedded PE binary at file offset 0x5838 (~5632 bytes)

SHA-25628485095db7ccc9fb61f6d9c57b0e9a3ff60008fafe4aad791af89afea2348c6

MaleculeMdTh

Evidence

Encoded content decoded: xor 0x4b78–0x4cf8

⋯3 more rows
0x4ba800000000e2fef3aa0000000000000000................
0x4bb8ffe3e3e7adb8b80000000000b1f1fefb................
0x4bc8f2f9f6faf2aa000000000000e0e0e0b9................
⋯4 more rows
0x4c18f8e5f4fbf8e3fff2e4b9f5feed000000................
0x4c2800000000a3a0a2aeaea5aeaea6a7b9f2................
0x4c38e5fef4f5e5f8e0f9fff8faf2e7f6f0f2................
0x4c48b9f5feed0000000000000000a3a0a2ae................
0x4c58aea5aeaea6a7b9f6fbf6e3f6f9fef9f3................
0x4c68fee1fef3e4fee3f2b9f9f2e300000000................
0x4c7800000000b8f4fbf6e4e4f2e4a4b8f4f8................
0x4c88fab8f0f2e3f4f8f9f1fee5fab9e7ffe7................
⋯7 more rows

Embedded PE binary at file offset 0x5838 (~5632 bytes) 0x57f8–0x58c8

⋯3 more rows
0x5828305540000000000000624000f8614000[email protected]@..a@.
0x58384d5a90000300000004000000ffff0000MZ..............
0x5848b8000000000000004000000000000000........@.......
0x585800000000000000000000000000000000................
⋯7 more rows