Benign Download

Trojan-PSW.Win32.QQPass.dru

Detects an XORed URL in an executable
SHA-2566478c007b2ae724b817a6974d7aed5f1f78e875a55cdcdaccd15bb294127f55e
MaleculeTh

Evidence

Detects an XORed URL in an executable 0x3fb8–0x4078
⋯3 more rows
0x3fe85e5b59595dc30000ffffffff23000000^[YY].......#...
0x3ff8687474703a2f2f666c6173682e636869http://flash.chi
0x40086e6172656e2e636f6d2f69702f69702enaren.com/ip/ip.
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.