Hostile ^92% Download

file

Shadow HVNC loader detected

Detects Shadow HVNC LoaderToolhelp process termination API cluster

SHA-2567c4888d19819857873d74da379275518d0cc6f1bdcfd91761622976fbf3abd34

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₃(CoDyEr)H₁₀(Po₁₃Cm₇CrDb₃F₈Hf₄MgOs₉Ti₂U)Md₂(Bi₂Si)Th₂

Evidence

Dense x64 TLS-array pointer access 0x6ae0–0x6ba0

⋯3 more rows
0x6b100000000048894d0874758b0548566100....H.M.tu..HVa.
0x6b2065488b0c2558000000488b0cc1488d81eH..%X...H...H..
0x6b300800000080b910000000010f85ea0600................
⋯7 more rows

References Windows cmd.exe interpreter 0xc4019–0xc40d9

⋯3 more rows
0xc40490f84144700004889c6c740032e657865[email protected]
0xc4059c700636d642eba6000000031c9e8c52e..cmd..`...1....
0xc406925004885c04989f40f84b93e00004989%.H..I.....>..I.
⋯7 more rows

PowerShell.exe interpreter reference 0xc52ed–0xc53ad

⋯3 more rows
0xc531d78654889470648b8706f776572736865xeH.G.H.powershe
0xc532d488907488b831001000041c645420141H..H......A.EB.A
0xc533dc6454101488983400400004c89b34804[email protected].
⋯7 more rows

Open process handle 0x4e1fc8–0x4e22b8

⋯3 more rows
0x4e1ff8fdadfffffdadffff3bc1ffff3bc1ffff........;...;...
0x4e20083bc1ffff3bc1ffff84f3ffff84f3ffff;...;...........
0x4e201884f3ffff84f3ffff8e0900008e090000................
0x4e20288e0900008e090000b3410000b3410000.........A...A..
0x4e2038b3410000b34100000100000000000000.A...A..........
0x4e204800000000000000000001010201020203................
0x4e205801020203020303045555555555555555........UUUUUUUU
0x4e206855555555555555553333333333333333UUUUUUUU33333333
0x4e20783333333333333333020000000000000033333333........
0x4e208800000000000000000300000000000000................
0x4e20980000000000000000657870616e642033........expand 3
0x4e20a8322d62797465206b04000000000000002-byte k........
0x4e20b800000000000000000100000002000000................
0x4e20c803000000000000000000000000000000................
0x4e20d800000000000000000200000000000000................
0x4e20e800000000000000000300000000000000................
0x4e20f80000000000000000657870616e642033........expand 3
0x4e2108322d62797465206b657870616e6420332-byte kexpand 3
0x4e2118322d62797465206b03000102070405062-byte k........
0x4e21280b08090a0f0c0d0e0300010207040506................
0x4e21380b08090a0f0c0d0e0e0f0c0d02030001................
0x4e2148060704050a0b08091e1f1c1d12131011................
0x4e2158161714151a1b18190300010207040506................
0x4e21680b08090a0f0c0d0e0e0f0c0d02030001................
0x4e2178060704050a0b080900007a440000803f..........zD...?
0x4e2188ffffff5e00000000ea55ed06d6203d53...^.....U... =S
0x4e21984863a72fc8aee0e60900000000000000Hc./............
0x4e21a800000000000000001f0000001e000000................
0x4e21b81c000000000000009b8e367eb8c234fe..........6~..4.
0x4e21c8df95033d132420166e6e6e6e6e6e6e6e...=.$ .nnnnnnnn
0x4e21d86e6e6e6e6e6e6e6ef77304a3c608817fnnnnnnnn.s......
0x4e21e8eec80eec9f7525dc0000000000000000.....u%.........
0x4e21f801000000000000000d0a534d0d0a0d0a..........SM....
0x4e22080000000000000000505249202a204854........PRI * HT
⋯3 more rows
0x4e224853535353535353535166446992be63c7SSSSSSSSQfDi..c.
0x4e2258c277cc65233493a63b26dcc85f9e5dd3.w.e#4..;&.._.].
0x4e22683ecf196439cb8ca7cd38cc8f551f0b2c>..d9....8..U..,
0x4e227819626e8a09954e10ffffffffffffff7f.bn...N.........
0x4e2288ffffffffffffff7f2d431cebe2361a3f........-C...6.?
0x4e22980080e03779c34143ff3f3f3f00000000...7y.AC.???....
0x4e22a80000000000000000f080808000000000................
0x4e22b800000000000000000f0e0d0c0b0a0908................

Detects Shadow HVNC Loader 0x4e85d0–0x4e8760

⋯7 more rows
0x4e86400b00000000000000a01c00000c000000................
0x4e86502f6170692f6167656e742f636f6e6e65/api/agent/conne
0x4e86606374067773733a2f2fc0c00023636f6ect.wss://...#con
0x4e86706e656374696f6e2e776562736f636b65nection.websocke
⋯15 more rows