Benign Download

Backdoor.Win32.Rbot.veo

High-entropy UPX1 packed payload sectionIsDebuggerPresent API name in PE strings

SHA-25657b29e657740db64392ccea9fa589972223ba3621750af8608b90c1ad6621602

Evidence

High-entropy UPX1 packed payload section 0xfc0–0x10a0

⋯3 more rows
0xff000000000000000000000000000000000................
0x1000fbf6ffffeb1066623a432b2b484f4f4b......fb:C++HOOK
0x101090e9f8a34b00a1eb08c1e002a3ef0e7b....K..........{
0x1020efef7f526a00e8230b7b308bd00d0953...Rj..#.{0....S
0x1030a45a0a0808e430373bccfe0968245968.Z....07;...h$Yh
⋯7 more rows

IsDebuggerPresent API name in PE strings 0xa8624–0xa86f4

⋯3 more rows
0xa86546f6465202564290025583a4441460000ode %d).%X:DAF..
0xa86644973446562756767657250726573656eIsDebuggerPresen
0xa8674740000004b65726e656c333200000000t...Kernel32....
0xa8684284c6f636174696f6e205845422c2065(Location XEB, e
⋯7 more rows

References the Windows debugger output API 0xa8ca0–0xa8d80

⋯3 more rows
0xa8cd06d000000777269746520746f00000000m...write to....
0xa8ce04f75747075744465627567537472696eOutputDebugStrin
0xa8cf0675700004f7574707574446562756753gW..OutputDebugS
0xa8d007472696e674100005f52530025750000tringA.._RS.%u..
0xa8d1053657450726f6365737353687574646fSetProcessShutdo
⋯7 more rows