Trojan-GameThief.Win32.OnLineGames.fym
Detects an XORed URL in an executableEncoded content decoded: xor
SHA-2568c4f16096b6fa6f57a6ccbd6e288ace176b593e2b2d6cc29c37678cf431f338a
MaleculeMdTh
Evidence
⋯3 more rows
0x5b58ffff01c645fc00005068010050048b15....E...Ph..P...
0x5b687c6060642e3b3b7e60253a677b617e7e|``d.;;~`%:g{a~~
0x5b787e7e3a777b793b77777c7c3b787d7a3a~~:w{y;ww||;x}z:
0x5b88756764006368646c6f67696e00000000ugd.chdlogin....
0x5b98000000007c6060642e3b3b7e60263a67....|``d.;;~`&:g
0x5ba87b617e7e7e7e3a777b793b7e7e7e603b{a~~~~:w{y;~~~`;
0x5bb8787d7a3a756764008bc88d71018a1141x}z:ugd....q...A
0x5bc83ad375f92bce5150b90000008d881c20:.u.+.QP.......
0x5bd8000089b083c010508d4dac0057ff750c.......P.M..W.u.
0x5be88bfeff75080000008bc88d79018d6424...u.......y..d$
0x5bf8000000008b406005b40600008d85d041.....@`........A
0x5c0800000000c680bc00000000007c606064............|``d
0x5c182e3b3b726d253a677b617e7e7e7e3a77.;;rm%:g{a~~~~:w
0x5c287b793b7e7e726d3b787d7a3a75676400{y;~~rm;x}z:ugd.
0x5c3831672b752931673267293167326129311g+u)1g2g)1g2a)1
0x5c4867326429316732676429316732662931g2d)1g2gd)1g2f)1
⋯7 more rows