Benign Download

Backdoor.Win32.Prorat.19.acz

High-entropy UPX1 packed payload sectionIsDebuggerPresent API name in PE strings
SHA-2565244b937cd742cfd8053e234afb42c7c627ba0e6a75f31ae07d1a88f66de0d5e
MaleculeH(Po₂)Md(Bi)

Evidence

High-entropy UPX1 packed payload section 0xfc0–0x10a0
⋯3 more rows
0xff000000000000000000000000000000000................
0x1000438400011132aa802a2808a8a020c8f5C....2..*(... ..
0x1010915191e93de7bb2d4f528586859ed254.Q..=..-OR.....T
0x1020b44c2cd4ca3532d2b03d87a08f4969a9.L,..52..=...Ii.
0x103064a9a9a4a49458a864a469a898fa8a59d.....X.d.i....Y
⋯7 more rows
IsDebuggerPresent API name in PE strings 0xaa624–0xaa6f4
⋯3 more rows
0xaa6546f6465202564290025583a4441460000ode %d).%X:DAF..
0xaa6644973446562756767657250726573656eIsDebuggerPresen
0xaa674740000004b65726e656c333200000000t...Kernel32....
0xaa684284c6f636174696f6e205845422c2065(Location XEB, e
⋯7 more rows
References the Windows debugger output API 0xaaca0–0xaad80
⋯3 more rows
0xaacd06d000000777269746520746f00000000m...write to....
0xaace04f75747075744465627567537472696eOutputDebugStrin
0xaacf0675700004f7574707574446562756753gW..OutputDebugS
0xaad007472696e674100005f52530025750000tringA.._RS.%u..
0xaad1053657450726f6365737353687574646fSetProcessShutdo
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.