Hostile ^93% datamaliciousorder Download

Virus.Hijack_Trojan.Agent.DQQO_218_1.vir

Trojan with destructive file rename

Kawaii-Unicorn writes randomized executable replicasKawaii-Unicorn family identity

SHA-2567b256fde503325ebf94673d9afc5d45b15bdef8b8f71b0d1b9d1244b1c701544

MaleculeK(Mc)O(I)H₆(F₂DbDsPo₄TiU)Md₆(Bi₄BkPaPt₂Si)

Evidence

MSVBVM60.DLL runtime reference 0x1b8–0x338

⋯7 more rows
0x2286cda5b4a100000000000000000000000l.[J............
0x2384d535642564d36302e444c4c00000000MSVBVM60.DLL....
0x24800000000000000000000000000000000................
⋯15 more rows

VB6 runtime binary file write 0xfbc–0x11ac

⋯3 more rows
0xfec00000000000000000000000700000000................
0xffc000000008693a372f909a372ee6aa472.......r...r.j.r
0x100c3168a4728dcca1726272a47288bea0721h.r...rbr.r...r
0x101cba02a372c39fa1724109a372766aa272...r...rA..rvj.r
0x102c3ac3a07274a2a1726e02a372fec1a172:..rt..rn..r...r
0x103c05cda1723acda1729d49a272f19fa172...r:..r.I.r...r
0x104c0603a3720604a372ee94a372ea62a372...r...r...r.b.r
0x105c7d41a172749ba0726c57a272fda09472}A.rt..rlW.r...r
0x106cf609a3720ac3a1729b05a272879ba072...r...r...r...r
0x107c69cea0729395a372859aa072df47a272i..r...r...r.G.r
0x108c8906a372ba03a3721375a4725057a272...r...r.u.rPW.r
0x109c5ac6a1724819a2727d69a2722b94a372Z..rH..r}i.r+..r
0x10ac103da17237a2a1721856a272ea10a2cb.=.r7..r.V.r....
0x10bc3a03a3723a04a372016ca2726e03a372:..r:..r.l.rn..r
⋯15 more rows

Kawaii-Unicorn embedded product marker 0x2919c–0x2937c

⋯9 more rows
0x2922c0000000000000000000000004b6177cf............Kaw.
0x2923c69692d556e69636f726e004b61776169ii-Unicorn.Kawai
0x2924c692d556e69636f726e00005662310000i-Unicorn..Vb1..
0x2925cf4010000d497420000000000409e4200[email protected].
⋯18 more rows

Embedded cmd rename with quoted source 0x298ad–0x29b9d

⋯3 more rows
0x298dda06810a73808002b3371b5433a5c5087.h..8..+3q.C:\P.
0x298ed6f6772616d2046696c65732028783836ogram Files (x86
0x298fd295c4d6963726f736f66742056697375)\Microsoft Visu
0x2990d616c2053747564696f5c564239385c56al Studio\VB98\V
0x2991d42362e4f4c420056420000d898420000B6.OLB.VB....B..
0x2992d0000000600000009000000e898420024.............B.$
⋯6 more rows
0x2999d3100000700000075736572333200001b1......user32...
0x299ad0000005365744c61796572656457696e...SetLayeredWin
0x299bd646f77417474726962757465730000a4dowAttributes...
0x299cd994200b099420000000400d4c2420000.B...B.......B..
0x299dd00000000000000a1dcc242000bc07402..........B...t.
0x299edffe068cc994200b8c0124000ffd0ffe0..h..B....@.....
0x299fd0000000f00000047657457696e646f77.......GetWindow
0x29a0d4c6f6e67410000a4994200049a420000LongA....B...B..
0x29a1d000400e0c242000000000000000000a1.....B..........
0x29a2de8c242000bc07402ffe068149a4200b8..B...t...h..B..
0x29a3dc0124000ffd0ffe00000000f00000053[email protected]
0x29a4d657457696e646f774c6f6e67410000a4etWindowLongA...
0x29a5d9942004c9a420000000400ecc2420000.B.L.B.......B..
⋯10 more rows
0x29b0d000000d94ead339966cf11b70c00aa00....N.3.f.......
0x29b1d60d393120000005c0055006e00690063`......\.U.n.i.c
0x29b2d006f0072006e002d000000e14ead3399.o.r.n.-....N.3.
0x29b3d66cf11b70c00e00060d3931e00000063f.......`......c
0x29b4d006d00640020002f0063002000720065.m.d. ./.c. .r.e
0x29b5d006e0061006d0065002000220000000c.n.a.m.e. ."....
0x29b6d0000002e006500780065002200200000.....e.x.e.". ..
0x29b7d000000080000002e0064006900650000.........d.i.e..
0x29b8d000000564241362e444c4c000000005f...VBA6.DLL...._
0x29b9d5f766261456e64000000005f5f766261_vbaEnd....__vba

PE version metadata includes CompanyName 0x2d1f2–0x2d472

⋯3 more rows
0x2d222300034004200300000002c000a0001000.4.B.0...,.....
0x2d23243006f006d00700061006e0079004e00C.o.m.p.a.n.y.N.
0x2d24261006d00650000000000610061006100a.m.e.....a.a.a.
⋯3 more rows
0x2d28269002d0055006e00690063006f007200i.-.U.n.i.c.o.r.
0x2d2926e00000000002c000a00010046006900n.....,.....F.i.
0x2d2a26c006500560065007200730069006f00l.e.V.e.r.s.i.o.
0x2d2b26e000000000031002e00300030000000n.....1...0.0...
0x2d2c2009830000a000100500072006f006400..0.....P.r.o.d.
0x2d2d275006300740056006500720073006900u.c.t.V.e.r.s.i.
0x2d2e26f006e00000031002e00300030000000o.n...1...0.0...
0x2d2f2000040001e00010049006e0074006500[email protected].
0x2d30272006e0061006c004e0061006d006500r.n.a.l.N.a.m.e.
0x2d31200004b00610077006100690069002d00..K.a.w.a.i.i.-.
0x2d32255006e00690063006f0072006e000000U.n.i.c.o.r.n...
0x2d33200005000260001004f00720069006700..P.&...O.r.i.g.
0x2d34269006e0061006c00460069006c006500i.n.a.l.F.i.l.e.
0x2d3526e0061006d00650000004b0061007700n.a.m.e...K.a.w.
0x2d3626100690069002d0055006e0069006300a.i.i.-.U.n.i.c.
0x2d3726f0072006e002e006500780065000000o.r.n...e.x.e...
0x2d38200000000010003002020020001000100........  ......
⋯15 more rows