Benign Download

Trojan.Win32.Agent.acof

CreateRemoteThread API stringEmbedded PE binary at file offset 0x21a8 (~16896 bytes)
SHA-25679264e973177511db55077e8538c5f88f5e69d8d6b1b814bfaf3b9a3ff39d5e6
MaleculeH(Po₂)Md(Bi)

Evidence

High-entropy read-only .rdata section 0x1fc0–0x20a0
⋯3 more rows
0x1ff000000000000000000000000000000000................
0x2000e0f30100ccf30100bef3010000000000................
0x20109ef2010046f1010054f1010060f10100....F...T...`...
0x20206cf101007af1010088f1010094f10100l...z...........
0x2030a2f10100b4f10100c0f10100ccf10100................
⋯7 more rows
Embedded PE binary at file offset 0x21a8 (~16896 bytes) 0x2160–0x2240
⋯3 more rows
0x2190746f725461626c650000000000000000torTable........
0x21a05c5c2e5c257300004d5a900003000000\\.\%s..MZ......
0x21b004000000ffff0000b800000000000000................
0x21c040000000000000000000000000000000@...............
0x21d000000000000000000000000000000000................
⋯7 more rows
References the Windows debugger output API 0x3a3a–0x3b4a
⋯3 more rows
0x3a6a700000006c737472636d706941000000p...lstrcmpiA...
0x3a7a4f75747075744465627567537472696eOutputDebugStrin
0x3a8a674100004f70656e50726f6365737300gA..OpenProcess.
0x3a9a5669727475616c416c6c6f6345780000VirtualAllocEx..
0x3aaa577269746550726f636573734d656d6fWriteProcessMemo
0x3aba7279000043726561746552656d6f7465ry..CreateRemote
0x3aca54687265616400004372656174654669Thread..CreateFi
0x3ada6c6541005265616446696c6500000000leA.ReadFile....
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.