Hostile ^92% windows Download

AntiMicroX.antimicrox

Unsigned dropper, C2, anti-analysis

Staged PE loader plumbing profileAuthenticode chain CN: The QT Company Oy

SHA-256467648540ab4bcf83641cb22b3359669bf1b9130b87d4be0aa438221ef3eb06b

URLhttps://github.com/AntiMicroX/antimicrox/releases/download/3.6.1/antimicrox-3.6.1-Windows-AMD64.exe

MaleculeK(Li₃)O₄(C₂CoDyP)H₁₁(Cm₂₀Cr₁₅Db₃Ds₂F₁₅Hf₈Mg₂Os₂₀Po₁₄TiU₅)Md₇(Bi₉BkLiPaPtSi₃)

Evidence

NSIS self-extracting installer 0x3427–0x34f7

⋯3 more rows
0x345744242483f80f0f8790000000817c2428D$$..........|$(
0x3467efbeadde0f8582000000817c2434496e...........|$4In
0x347773747578817c2430736f6674756e817cstux.|$0softun.|
0x3487242c4e756c6c75648b15f371040009c5$,Nullud...q....
⋯7 more rows

NSIS runtime error title in rdata 0xa09c–0xa15c

⋯3 more rows
0xa0cc740061006c006c006500720000000000t.a.l.l.e.r.....
0xa0dc4e005300490053002000450072007200N.S.I.S. .E.r.r.
0xa0ec6f00720000005c00540065006d007000o.r...\.T.e.m.p.
⋯7 more rows

NSIS exehead assembly manifest 0x67980–0x67ab0

⋯3 more rows
0x679b000000100200028200400010000000000.... .( ........
0x679c03c3f786d6c2076657273696f6e3d2231<?xml version="1
0x679d02e302220656e636f64696e673d225554.0" encoding="UT
0x679e0462d3822207374616e64616c6f6e653dF-8" standalone=
0x679f022796573223f3e3c617373656d626c79"yes"?><assembly
0x67a0020786d6c6e733d2275726e3a73636865 xmlns="urn:sche
0x67a106d61732d6d6963726f736f66742d636fmas-microsoft-co
0x67a206d3a61736d2e763122206d616e696665m:asm.v1" manife
0x67a30737456657273696f6e3d22312e30223estVersion="1.0">
0x67a403c617373656d626c794964656e746974<assemblyIdentit
⋯7 more rows

Embedded manifest literal requests administrator 0x67bd9–0x67cc9

⋯3 more rows
0x67c09657374656450726976696c656765733eestedPrivileges>
0x67c193c726571756573746564457865637574<requestedExecut
0x67c29696f6e4c6576656c206c6576656c3d22ionLevel level="
0x67c397265717569726541646d696e69737472requireAdministr
0x67c4961746f72222075694163636573733d22ator" uiAccess="
0x67c5966616c7365222f3e3c2f726571756573false"/></reques
⋯7 more rows

Search executable path via Windows API 0x86780–0x86a70

⋯11 more rows
0x86830c4995487847e12c41f850dbfb2cb8106..T..~..........
0x86840054aa0ff39f9c10d5ff17e11e9ca9e2f.J..9..._.~..../
0x868505f0cfd656396ec72d9083a393cd7699a_..ec..r..:9<.i.
0x86860071242f633c72a1bb8ecefaacca457a0..B.3.*.......W.
⋯10 more rows
0x86910b296ca206acbfc3062440e7a55064f65... j..0bD.zU.Oe
0x869209ae2529334eae0ea96da2b6eaf1b323e..R.4.....+n..2>
0x86930e1bc6cfcc00b7ffac8e7edabdee31005..l.............
⋯10 more rows
0x869e0315a084000c70819094ac347c5020bd1[email protected]....
0x869f06619d0310c6e55f1df14e5efa191a517f..1.nU.........
0x86a0054c0e5f77232040d8af7f2d57df83d12T...r2......}.=.
⋯7 more rows