Hostile ^93% windows Download

XClient.exe

XWorm RAT with C2, keylogger, DDoS

.NET surveillance RAT stages a network payload.NET screen and webcam capture with network C2

SHA-25653c3b05c1e871ee9aad4cb587e13d930545137bfdda5fc58db5132a422da0503

URLhttps://tria.ge/api/v0/samples/260824-rmqlgayhnf/sample

MaleculeO₄(CCoDyEr₂)H₇(Cm₄Cr₃Db₃F₂Hf₃Os₃Po₈)Md₃(Bi₂BkPa)Th₅

Evidence

.NET screen and webcam capture with network C2 0x2b14–0x2c94

⋯7 more rows
0x2b84046ffb00000a1480270000042a000000.o......'...*...
0x2b9442534a4201000100000000000c000000BSJB............
0x2ba476342e302e3330333139000000000500v4.0.30319......
⋯15 more rows

Prevents system sleep 0x47f3–0x48e3

0x47f37441637400757365724167656e747300tAct.userAgents.
0x4803476574466f726567726f756e6457696eGetForegroundWin
0x4813646f770053797374656d2e5465787400dow.System.Text.
0x4823537472696e674275696c646572004765StringBuilder.Ge
0x48337457696e646f77546578740068576e64tWindowText.hWnd
0x4843007465787400636f756e740053657454.text.count.SetT
0x48536872656164457865637574696f6e5374hreadExecutionSt
0x4863617465006573466c6167730050726576ate.esFlags.Prev
0x4873656e74536c6565700047657441637469entSleep.GetActi
⋯7 more rows

.NET Activator type reference 0x4abe–0x4bae

⋯3 more rows
0x4aee745479706546726f6d48616e646c6500tTypeFromHandle.
0x4afe416374697661746f7200437265617465Activator.Create
0x4b0e496e7374616e6365004d7947726f7570Instance.MyGroup
⋯10 more rows

HTTP header field delimiter 0x5c66–0x5f56

⋯7 more rows
0x5cd66500000b360034006200690074000015e...6.4.b.i.t...
0x5ce6580057006f0072006d00200056003300X.W.o.r.m. .V.3.
0x5cf62e0030000013640064002f004d004d00..0...d.d./.M.M.
0x5d062f00790079007900000b450072007200/.y.y.y...E.r.r.
0x5d166f00720000055c005c00002b5c007200o.r...\.\..+\.r.
0x5d266f006f0074005c005300650063007500o.o.t.\.S.e.c.u.
0x5d367200690074007900430065006e007400r.i.t.y.C.e.n.t.
0x5d46650072003200003d530065006c006500e.r.2..=S.e.l.e.
0x5d566300740020002a002000660072006f00c.t. .*. .f.r.o.
0x5d666d00200041006e007400690076006900m. .A.n.t.i.v.i.
0x5d76720075007300500072006f0064007500r.u.s.P.r.o.d.u.
0x5d8663007400001764006900730070006c00c.t...d.i.s.p.l.
0x5d96610079004e0061006d00650000032c00a.y.N.a.m.e...,.
0x5da600094e006f006e00650000030000010b..N.o.n.e.......
0x5db6500049004e0047002100000772006500P.I.N.G.!...r.e.
0x5dc66300000b43004c004f00530045000013c...C.L.O.S.E...
⋯3 more rows
0x5e064e00000f550072006c006f0070006500N...U.r.l.o.p.e.
0x5e166e00000f550072006c00680069006400n...U.r.l.h.i.d.
0x5e2665000015500043005300680075007400e...P.C.S.h.u.t.
0x5e3664006f0077006e00002f730068007500d.o.w.n../s.h.u.
0x5e46740064006f0077006e002e0065007800t.d.o.w.n...e.x.
0x5e56650020002f00660020002f0073002000e. ./.f. ./.s. .
0x5e662f007400200030000013500043005200/.t. .0...P.C.R.
0x5e76650073007400610072007400002f7300e.s.t.a.r.t../s.
0x5e8668007500740064006f0077006e002e00h.u.t.d.o.w.n...
0x5e9665007800650020002f00660020002f00e.x.e. ./.f. ./.
⋯3 more rows
0x5ed62e0065007800650020002d004c000113..e.x.e. .-.L...
0x5ee653007400610072007400440044006f00S.t.a.r.t.D.D.o.
0x5ef673000011530074006f00700044004400s...S.t.o.p.D.D.
0x5f066f007300001753007400610072007400o.s...S.t.a.r.t.
0x5f165200650070006f007200740000155300R.e.p.o.r.t...S.
0x5f2674006f0070005200650070006f007200t.o.p.R.e.p.o.r.
0x5f367400000b580063006800610074000009t...X.c.h.a.t...
0x5f46440044006f007300000b6e0067007200D.D.o.s...n.g.r.
0x5f566f006b00000d70006c00750067006900o.k...p.l.u.g.i.

References Mozilla/5.0 User-Agent prefix 0x6263–0x6453

⋯8 more rows
0x62e30001001353006f006600740077006100....S.o.f.t.w.a.
0x62f3720065005c0000809b4d006f007a0069r.e.\....M.o.z.i
0x6303006c006c0061002f0035002e00300020.l.l.a./.5...0. 
0x6313002800570069006e0064006f00770073.(.W.i.n.d.o.w.s
⋯6 more rows
0x638300650066006f0078002f00360036002e.e.f.o.x./.6.6..
0x63930030000081134d006f007a0069006c00.0....M.o.z.i.l.
0x63a36c0061002f0035002e00300020002800l.a./.5...0. .(.
0x63b36900500068006f006e0065003b002000i.P.h.o.n.e.;. .
⋯10 more rows