Benign Download

Trojan.Win32.Agent.ryj

Detects an XORed URL in an executableEncoded content decoded: xor
SHA-2562af76e1d8212c1e82176f6febcbe2317ac6896c569a85cc4a06a686855aefade
MaleculeMdTh

Evidence

Encoded content decoded: xor 0x2038–0x2118
⋯3 more rows
0x20684200004d5cf94d00f74a8e62fb420f8eB..M\.M..J.b.B..
0x207862172b2a306333312c2431222e632022b.+*0c31,$1".c "
0x20882d2d2c376321266331362d632a2d6307--,7c!&c16-c*-c.
0x20980c10632e2c27266d4e4e496700000000..c.,'&mNNIg....
0x20a80000008423127bc0427c28c0427c28c0....#.{.B|(.B|(.
⋯7 more rows
Detects an XORed URL in an executable 0x1a57a–0x1a63a
⋯3 more rows
0x1a5aa31210000130c101700000000100210001!..............
0x1a5ba2b373733796c6c006c00000002060000+773yll.l.......
0x1a5ca34210000302a000034370000021000004!..0*..47......
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.