Hostile ^92% windows Download

Oscillicious.RocketBroadcaster.Free

Signed malware with C2 and evasion

GPU vendor enumeration checkCaptures keystrokes, screen and clipboard

SHA-256675d353fb2393dd0969f59276020356db732690168b62a0eedd568d5a7d2eaad

URLhttps://www.oscillicious.com/rocketbroadcaster/free/rocketbroadcaster_setup.exe

MaleculeK₃(Am₂Li₅Te₂)O₆(Al₂CoAsC₂ErPr)H₁₁(Cm₂₅Cr₁₄Db₉Ds₂F₂₁Hf₆Mg₄Os₂₈Po₂₁Ti₂U₅)Md₈(Bi₁₉LiPaPdPtSi₃)Th

Evidence

Borland locales registry key 0xa17c–0xa24c

⋯3 more rows
0xa1ac4c006f00630061006c00650073000000L.o.c.a.l.e.s...
0xa1bc53006f00660074007700610072006500S.o.f.t.w.a.r.e.
0xa1cc5c0042006f0072006c0061006e006400\.B.o.r.l.a.n.d.
0xa1dc5c004c006f00630061006c0065007300\.L.o.c.a.l.e.s.
⋯7 more rows

References the LZMA SDK LzmaDec routine 0x24720–0x247e0

⋯3 more rows
0x24750c3000000b0040200ffffffff16000000................
0x247604c007a006d0061004400650063006f00L.z.m.a.D.e.c.o.
0x247706400650020006600610069006c006500d.e. .f.a.i.l.e.
⋯7 more rows

GetMethods member-name token 0x32eee–0x32fae

⋯3 more rows
0x32f1e0001000101020002003500d07144000a.........5..qD..
0x32f2e4765744d6574686f6473030038804300GetMethods..8.C.
0x32f3e08000208383e430000000453656c6602....8>C....Self.
⋯7 more rows

References the GetMethod member name 0x32fcd–0x3308d

⋯3 more rows
0x32ffd430001000101020002003800146f4400C.........8..oD.
0x3300d094765744d6574686f640300845a4300.GetMethod...ZC.
0x3301d08000208383e430000000453656c6602....8>C....Self.
⋯7 more rows

Inno Setup self-extracting installer 0xb78d0–0xb79b0

⋯3 more rows
0xb790001000000030000000400000005000000................
0xb7910496e6e6f205365747570205365747570Inno Setup Setup
0xb792020446174612028362e312e3029202875 Data (6.1.0) (u
0xb793029000000000000000000000000000000)...............
0xb794000000000000000000000000000000000................
⋯7 more rows