Hostile ^93% datamaliciousorder Download

Virus.Hijack_GenPack.Backdoor.Hangup.B_210_1.vir

Backdoor with file destruction

Kawaii-Unicorn writes randomized executable replicasKawaii-Unicorn family identity

SHA-2563510a55bb51fd545240416e7feb1e10fa6929cdaf91d52ff7a97c7725db819a5

MaleculeK(Mc)O(I)H₆(F₂DbDsPo₄TiU)Md₆(Bi₄BkPaPt₂Si)

Evidence

MSVBVM60.DLL runtime reference 0x1b8–0x338

⋯7 more rows
0x2286cda5b4a100000000000000000000000l.[J............
0x2384d535642564d36302e444c4c00000000MSVBVM60.DLL....
0x24800000000000000000000000000000000................
⋯15 more rows

VB6 runtime binary file write 0xfb8–0x11a8

⋯3 more rows
0xfe800000000000000000000000000000007................
0xff800000000000000008693a372f909a372...........r...r
0x1008ee6aa4723168a4728dcca1726272a472.j.r1h.r...rbr.r
0x101888bea072ba02a372c39fa1724109a372...r...r...rA..r
0x1028766aa2723ac3a07274a2a1726e02a372vj.r:..rt..rn..r
0x1038fec1a17205cda1723acda1729d49a272...r...r:..r.I.r
0x1048f19fa1720603a3720604a372ee94a372...r...r...r...r
0x1058ea62a3727d41a172749ba0726c57a272.b.r}A.rt..rlW.r
0x1068fda09472f609a3720ac3a1729b05a272...r...r...r...r
0x1078879ba07269cea0729395a372859aa072...ri..r...r...r
0x1088df47a2728906a372ba03a3721375a472.G.r...r...r.u.r
0x10985057a2725ac6a1724819a2727d69a272PW.rZ..rH..r}i.r
0x10a82b94a372103da17237a2a1721856a272+..r.=.r7..r.V.r
0x10b8ea10a2723a03a3723a04a372016ca272...r:..r:..r.l.r
⋯15 more rows

Kawaii-Unicorn embedded product marker 0x2919c–0x2937c

⋯9 more rows
0x2922c0000000000000000000000004b6177cf............Kaw.
0x2923c69692d556e69636f726e004b61776169ii-Unicorn.Kawai
0x2924c692d556e69636f726e00005662310000i-Unicorn..Vb1..
0x2925cf4010000d497420000000000409e4200[email protected].
⋯18 more rows

Embedded cmd rename with quoted source 0x298a9–0x29b99

⋯3 more rows
0x298d93dfbfcfaa06810a73808002b3371b583=....h..8..+3q..
0x298e93a5c50726f6772616d2046696c657320:\Program Files 
0x298f928783836295c4d6963726f736f667420(x86)\Microsoft 
0x2990956697375616c2053747564696f5c5642Visual Studio\VB
0x2991939385c5642362e4f4c420056420000d898\VB6.OLB.VB...
0x29929984200000000000600000009000000e8.B..............
⋯6 more rows
0x29999696d65723100003c0000007573657233imer1..<...user3
0x299a93200001b0000005365744c61796572652......SetLayere
0x299b96457696e646f77417474726962757465dWindowAttribute
0x299c9730000a4994200b099420000000400d4s....B...B......
0x299d9c242000000000000000000a1dcc24200.B............B.
0x299e90bc07402ffe068cc994200b8c0124000..t...h..B....@.
0x299f9ffd0ffe00000000f0000004765745769...........GetWi
0x29a096e646f774c6f6e67410000a499420004ndowLongA....B..
0x29a199a420000000400e0c242000000000000.B.......B......
0x29a29000000a1e8c242000bc07402ffe06814......B...t...h.
0x29a399a4200b8c0124000ffd0ffe00000000f.B....@.........
0x29a4900000053657457696e646f774c6f6e67...SetWindowLong
0x29a59410000a49942004c9a420000000400ecA....B.L.B......
0x29a69c242000000000000000000a1f4c24200.B............B.
⋯9 more rows
0x29b09ffffff01000000d94ead339966cf11b7........N.3.f...
0x29b190c00aa0060d393120000005c0055006e....`......\.U.n
0x29b2900690063006f0072006e002d000000e1.i.c.o.r.n.-....
0x29b394ead339966cf11b70c00e00060d3931eN.3.f.......`...
0x29b4900000063006d00640020002f00630020...c.m.d. ./.c. 
0x29b5900720065006e0061006d006500200022.r.e.n.a.m.e. ."
0x29b690000000c0000002e0065007800650022.........e.x.e."
0x29b7900200000000000080000002e00640069. ...........d.i
0x29b8900650000000000564241362e444c4c00.e.....VBA6.DLL.
0x29b990000005f5f766261456e64000000005f...__vbaEnd...._

PE version metadata includes CompanyName 0x2d1d6–0x2d476

⋯4 more rows
0x2d21600000100300038003000340030003400....0.8.0.4.0.4.
0x2d2264200300000002c000a00010043006f00B.0...,.....C.o.
0x2d2366d00700061006e0079004e0061006d00m.p.a.n.y.N.a.m.
0x2d24665000000000061006100610061000000e.....a.a.a.a...
0x2d256000040001e000100500072006f006400[email protected].
0x2d2667500630074004e0061006d0065000000u.c.t.N.a.m.e...
0x2d27600004b00610077006100690069002d00..K.a.w.a.i.i.-.
0x2d28655006e00690063006f0072006e000000U.n.i.c.o.r.n...
0x2d29600002c000a000100460069006c006500..,.....F.i.l.e.
0x2d2a6560065007200730069006f006e000000V.e.r.s.i.o.n...
0x2d2b6000031002e0030003000000000003000..1...0.0.....0.
0x2d2c60a000100500072006f00640075006300....P.r.o.d.u.c.
0x2d2d67400560065007200730069006f006e00t.V.e.r.s.i.o.n.
0x2d2e6000031002e0030003000000000004000..1...0.0.....@.
0x2d2f61e00010049006e007400650072006e00....I.n.t.e.r.n.
0x2d30661006c004e0061006d00650000004b00a.l.N.a.m.e...K.
⋯3 more rows
0x2d34661006c00460069006c0065006e006100a.l.F.i.l.e.n.a.
0x2d3566d00650000004b006100770061006900m.e...K.a.w.a.i.
0x2d36669002d0055006e00690063006f007200i.-.U.n.i.c.o.r.
0x2d3766e002e00650078006500000000000000n...e.x.e.......
0x2d38601000300202002000100010030010000....  ......0...
⋯15 more rows