Hostile ^92% Download

4b86e44a8a722b54a4ffad3703a93310c24b97991fe60b0eb20a9bc7d0ee11b5.bin

PE loader, persistence, C2

Unsigned native Run-key replacement persistenceVB6 Run-key dropper stages an exe payload

SHA-2564b86e44a8a722b54a4ffad3703a93310c24b97991fe60b0eb20a9bc7d0ee11b5

URLhttps://tria.ge/api/v0/samples/260927-bncg8sxzdv/sample

MaleculeO₄(CP₂As₃Er)H₇(CrDb₂F₆MgOs₄PoTi)Md₃(Bi₃PtSi)

Evidence

x64 reads the PE e_lfanew field 0x3d0–0x690

⋯34 more rows
0x5f0488d0d09feffffe894190000e8cf1700H...............
0x60000488b05083300006681384d5a754148.H...3..f.8MZuAH
0x61063503c4801d081385045000075320fb7cP<H...8PE..u2..
0x62050186681fa0b010f84e80100006681faP.f..........f..
⋯7 more rows

UTF-16 exe filename suffix token 0x127c–0x140c

⋯7 more rows
0x12ec000066898c442004000031c948b82e00..f..D ...1.H...
0x12fc65007800650066898c249e0000008d4ae.x.e.f..$.....J
0x130c064863c948898424960000008d4205ba.Hc.H..$.....B..
0x131c2e0000004989c8489849f7d84d01c04d....I..H.I..M..M
⋯15 more rows

Accesses Windows CurrentVersion Run key 0x23b0–0x2550

⋯6 more rows
0x241000000000000000000000000000000000................
0x242041005000500044004100540041000000A.P.P.D.A.T.A...
0x243053006f00660074007700610072006500S.o.f.t.w.a.r.e.
0x24405c004d006900630072006f0073006f00\.M.i.c.r.o.s.o.
0x2450660074005c00570069006e0064006f00f.t.\.W.i.n.d.o.
0x2460770073005c0043007500720072006500w.s.\.C.u.r.r.e.
⋯4 more rows
0x24b01b360000000000000000000000000000.6..............
0x24c0637c777bf26b6fc53001672bfed7ab76c|w{.ko.0.g+...v
0x24d0ca82c97dfa5947f0add4a2af9ca472c0...}.YG.......r.
0x24e0b7fd9326363ff7cc34a5e5f171d83115...&6?..4...q.1.
⋯7 more rows

GetEnvironmentVariable profiler check 0x39b0–0x3b00

⋯3 more rows
0x39e05265674f70656e4b657945785700b402RegOpenKeyExW...
0x39f052656753657456616c75654578570000RegSetValueExW..
0x3a009700436c6f736548616e646c6500c100..CloseHandle...
⋯4 more rows
0x3a5044656c65746546696c655700b9014669DeleteFileW...Fi
0x3a606e645265736f75726365570062024765ndResourceW.b.Ge
0x3a7074456e7669726f6e6d656e7456617269tEnvironmentVari
0x3a8061626c6557008d024765744c61737445ableW...GetLastE
0x3a9072726f720000a2024765744d6f64756crror....GetModul
⋯7 more rows

DeleteFileW API symbol 0x81b8–0x8418

0x81b8d9092d430cebe6b69530995686bc8a2b..-C.....0.V...+
0x81c88773e008d38bcb060465c6c06c633688.s.......e..lc6.
0x81d876b1c0e1639f767a2c24e3be3894f74cv...c.vz,$..8..L
0x81e80e32be3552c9f49ceae8dbe7062f378a.2.5R......../7.
0x81f82ace7639dc983d3d18010d7370c7d572*.v9..==...sp..r
0x82086d2c9ad69f9f548088caf667ee0358bdm,....T....g..X.
0x821828629f0167468431049e3ac982c1369b(b..gF.1..:...6.
0x82286d994fee6b523d39a198a5bd8f7c3753m.O.kR=9.....|7S
0x8238ac47d5fa6b0eb46b485b00c5549ae9a7.G..k..kH[..T...
0x82480bfde49f8363e5a57e5b5597314c167b.....c..~[U.1L.{
0x82584cebe5b97cd61313501f89ab7156ef3dL...|...P...qV.=
0x8268921686e39e1483c34758aa5dda02c2bd........GX.]....
0x827869bce38f058339e64944e72d70cd64e4i.....9.ID.-p.d.
0x82889b3a4d75214e3521c0c5a6b2aaa45a6c.:Mu!N5!......Zl
0x8298fae2a537e0f6afad34d0d7a47287174e...7....4...r..N
0x82a8ccd95a48ffebd4630e48d5bc7356032f..ZH...c.H..sV./
0x82b84abd4d8e73940182feadd42ed15fa92eJ.M.s........_..
0x82c833afd205884f64c513f75068fac322da3....Od...Ph..".
0x82d8f9803bf9d726e64ee233335df31e62a4..;..&.N.33]..b.
0x82e84b5f807e43583323a6f71bc716893731K_.~CX3#......71
0x82f8cea2b22ac153343af9b850aa89c1979d...*.S4:..P.....
0x83081f8682d28e3d5cbc5991cfa91567192f.....=\.Y....g./
0x8318773781830cd0946c3bac7a4bd105cf37w7.....l;.zK...7
0x83281ec08bd64b05a2f842de2cddade06d92....K...B.,...m.
0x833857a6190b2d7177fed5bc16568100d2cfW...-qw....V....
0x8348e954384c06eb1bcc35f3a7f050f477ba.T8L....5...P.w.
0x8358fe453c6e8b1c9808435a2d25e2de815f.E<n....CZ-%..._
0x83681c4d4d025ba1c640e7831e1a4a7a3b9a.MM.[[email protected];.
0x837830d45a815f7d35febb80c302b3098c6a0.Z._}5........j
0x8388e9b4a010fbce92bc454105cd79667254........EA..yfrT
0x8398a960b7199f06e331851f3b5043568f64.`.....1..;PCV.d
0x83a8f62efd891971fcfb908c411a38bd9986.....q....A.8...
0x83b892396b4e79b8cd5ddb89abd6673d6f38.9kNy..]....g=o8
0x83c8d5520f60849f14e934c97ffbd05d141c.R.`....4....]..
0x83d8961cd53af60bd4279714263fecb7c5ab...:...'..&?....
0x83e88e0477449debc3f7fa4b58588f06b394..wD.....KXX....
0x83f83d9f3208ad5f63c9d45b8f2471b3af7b=.2.._c..[.$q..{
0x840840b213b229dc056471a820d647d97845@...)..dq. .G.xE
0x8418cb034e89da8e56ef488b677ec0617b79..N...V.H.g~.a{y