Hostile 92% windows Download

Drovio.Drovio

Keylogger, injection, evasion, C2

Installs and starts Windows serviceObfuscated WinHTTP staged updater dropper
SHA-2564eab6feb7c7dfdf1c302606022c81ddf032cb8fc6f1bfe837158d8fcfd0b6e7f
URLhttps://repository.drovio.com/stable/drovio/win64/3.x/3.6.1/drovio-win64.exe
MaleculeK₃(Am₂Li₃Te)O₈(AsC₃Co₂PAlDy₂Er₂Pr₂)H₁₁(Po₂₄Cm₂₄Cr₁₅Db₇Ds₂F₁₆Hf₇Mg₄Os₃₇TiU₇)Md₈(Bi₁₆BkHeLiPaPt₂Si₄)

Evidence

NSIS self-extracting installer 0x2570–0x2640
⋯3 more rows
0x25a02e00008b45d8a9f0ffffff757c817ddc....E......u|.}.
0x25b0efbeadde7573817de8496e7374756a81....us.}.Instuj.
0x25c07de4736f66747561817de04e756c6c75}.softua.}.Nullu
0x25d0580945088b45088b0db8ce400083e002X.E..E.....@....
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.