Backdoor.Win32.Kbot.fm
Kbot backdoor with encoded payload
Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Detects an XORed URL in an executable
SHA-256346f8f8f06942b9a1271fde437fbff96c3e7a6f5d962b84fb59934006bc5f299
MaleculeMdTh
Evidence
⋯3 more rows
0x5c0455a504b3e504b191e42000000000000EZPK>PK..B......
0x5d02604110207070a445f455b4b43080406&......D_E[KC...
0x5e01b0a1f0209070e504b2638222e4b5d45.......PK&8".K]E
0x5f05b504b3c02050f041c184b253f4b5e45[PK<......K%?K^E
0x6005a504b383d5a504b45252e3f4b282739ZPK8=ZPKE%.?K('9
0x6104b5a455a455f58595942000000000000KZEZE_XYYB......
0x6202604110207070a445e455b4b433c0205&......D^E[KC<..
0x6300f041c18504b3e504b3c02050f041c18....PK>PK<......
⋯12 more rows
0x70018120500031f1f1b000000000f0a1f0a................
0x710000000001e0f1b003832383f2e263728........828?.&7(
0x7201e19190e051f2804051f190407380e1f......(......8..
0x73037380e191d02080e1800000006181e1b78..............
0x7400f0a1f0e00000000260208190418040d........&.......
0x7501f4b180e081e19021f124b1e1b0f0a1f.K........K.....
0x7600e4b180e191d02080e00000000000000.K..............
0x7703f0302184b180e191d02080e4b0f041c?...K.......K...
0x7800507040a0f02050c4b0a050f4b020518........K...K...
0x7901f0a070702050c4b3c02050f041c184b.......K<......K
0x7a0180e081e19021f124b1e1b0f0a1f0e18........K.......
0x7b0000000002704080a073812181f0e0600....'....8......
0x7c03832383f2e2637281e19190e051f2804828?.&7(......(.
0x7d0051f190407380e1f37380e191d02080e.....8..78......
0x7e0183706181e1b0f0a1f0e000022060a0c.7.........."...
0x7f00e3b0a1f030000002f02181b070a1225.;....../......%
0x8000a060e002f0e180819021b1f02040500..../...........
0x8102409010e081f250a060e0000381f0a19$.....%.....8...
0x8201f0000002e191904192804051f190407.........(......
0x830000000003f121b0e000000003832383f....?.......828?
0x8402e2637281e19190e051f2804051f1904.&7(......(.....
0x85007380e1f37380e191d02080e18372a0d.8..78.......7*.
0x8600f373b0a190a060e1f0e191800000000.7;.............
0x8702f02180a09070e390a1c380e081e1902/......9..8.....
0x8801f1200000d0704040f000000181f041b................