Hostile 92% Download

Trojan.Win32.Dialer.aev

Named Trojan, RAT indicators

Detects Gh0st RAT mentioned in Cylance' Ghost Dragon ReportPercent-encoded content decoded
SHA-25676db1d92fc45611d62f8de608cf5ee517d8a3ff69e791d60252a8621dbb3205a
MaleculeMdTh

Evidence

Query/set system parameters (symbol) 0xf288–0xf3e8
⋯10 more rows
0xf32801600000000000000000000000000000.`..............
0xf33800000000010000000100000002000000................
0xf34802000000030000000300000004000000................
⋯10 more rows
Query/set system parameters (string) 0x1057e–0x1061e
0x1057e6f700000480147657450726f63657373op..H.GetProcess
0x1058e57696e646f7753746174696f6e003b02WindowStation.;.
0x1059e53656e644d6573736167654100009902SendMessageA....
0x105ae53797374656d506172616d6574657273SystemParameters
0x105be496e666f4100d6026b657962645f6576InfoA...keybd_ev
0x105ce656e7400d3014d61705669727475616cent...MapVirtual
⋯5 more rows
Percent-encoded content decoded 0x113f8–0x114c8
⋯3 more rows
0x114286e74726f6c5365745c53657276696365ntrolSet\Service
0x11438735c2573000000000d0a5b253032642fs\%s......[%02d/
0x11448253032642f256420253032643a253032%02d/%d %02d:%02
0x11458643a253032645d20282573290d0a0000d:%02d] (%s)....
⋯7 more rows
Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report 0x1152c–0x116ec
⋯7 more rows
0x1159c53746172740000005479706500000000Start...Type....
0x115ac52656753657456616c75654578287374RegSetValueEx(st
0x115bc61727429000000004572726f72436f6eart)....ErrorCon
0x115cc74726f6c000000004f626a6563744e61trol....ObjectNa
⋯18 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.