Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_3_1.vir
Trojan downloader with C2 and evasion
WinInet ZIP downloader stages and executes temp payloadMultiple sandbox execution paths embedded as padding
SHA-25694403c189473eaba726227602111e64022259639c22090516dde90ac6583ff9d
Evidence
⋯12 more rows
0xa905c002500730000006b0069006c006600\.%.s...k.i.l.f.
0xaa031002e0065007800650000006170706c1...e.x.e...appl
0xab069636174696f6e2f2a00000074657874ication/*...text
0xac02f2a0000550070006400610074006500/*..U.p.d.a.t.e.
0xad07300200064006f0077006e006c006f00s. .d.o.w.n.l.o.
0xae061006400650072000000000052746c44a.d.e.r.....RtlD
0xaf065636f6d707265737342756666657200ecompressBuffer.
0xb006e00740064006c006c002e0064006c00n.t.d.l.l...d.l.
⋯15 more rows
⋯3 more rows
0xc36726e65745265616446696c6500005a00rnetReadFile..Z.
0xc46487474705175657279496e666f570000HttpQueryInfoW..
0xc565e004874747053656e64526571756573^.HttpSendReques
0xc6674570000af00496e7465726e65745365tW....InternetSe
0xc76744f7074696f6e5700009e00496e7465tOptionW....Inte
0xc86726e657451756572794f7074696f6e57rnetQueryOptionW
0xc9600005700487474704f70656e52657175..W.HttpOpenRequ
0xca66573744100007100496e7465726e6574estA..q.Internet
0xcb6436f6e6e6563744100009a00496e7465ConnectA....Inte
0xcc6726e65744f70656e570057494e494e45rnetOpenW.WININE
0xcd6542e646c6c00ce024865617044657374T.dll...HeapDest
0xce6726f7900bf0147657443757272656e74roy...GetCurrent
⋯10 more rows
0xd967446696c6553697a65008f0043726561tFileSize...Crea
0xda6746546696c655700850247657454656dteFileW...GetTem
0xdb6705061746857000014024765744d6f64pPathW....GetMod
0xdc6756c6546696c654e616d65570000cb02uleFileNameW....
⋯5 more rows
0xe26746657005553455233322e646c6c0000tfW.USER32.dll..
0xe3622015368656c6c457865637574655700".ShellExecuteW.
0xe465348454c4c33322e646c6c0000000000SHELL32.dll.....
⋯7 more rows
0x276464006300630065003600330065003800d.c.c.e.6.3.e.8.
0x277465006300650063006200390066006600e.c.e.c.b.9.f.f.
0x278462003700610038003900630035006500b.7.a.8.9.c.5.e.
0x279461003800660038003800640000000000a.8.f.8.8.d.....
0x27a443003a005c004a005300380035004a00C.:.\.J.S.8.5.J.
0x27b44e00470042002e006500780065000000N.G.B...e.x.e...
0x27c4000043003a005c005500730065007200..C.:.\.U.s.e.r.
0x27d473005c00560069007200740075006100s.\.V.i.r.t.u.a.
0x27e46c005c00410070007000440061007400l.\.A.p.p.D.a.t.
0x27f461005c004c006f00630061006c005c00a.\.L.o.c.a.l.\.
0x2804540065006d0070005c00630032003600T.e.m.p.\.c.2.6.
0x2814360065003600300061006500360030006.e.6.0.a.e.6.0.
0x2824380061003600620032003300620036008.a.6.b.2.3.b.6.
0x283464003300380062006600350033006200d.3.8.b.f.5.3.b.
0x2844370034003300390066006500340062007.4.3.9.f.e.4.b.
0x285465006100370064006600660066006500e.a.7.d.f.f.f.e.
0x2864320034006400330033006400330033002.4.d.3.3.d.3.3.
0x287461003700370061003400640033006300a.7.7.a.4.d.3.c.
0x2884340035006500610032002e00650078004.5.e.a.2...e.x.
0x289465000000000043003a005c0035003400e.....C.:.\.5.4.
0x28a4310034003700320035006600300066001.4.7.2.5.f.0.f.
0x28b462003100330033006500360037003000b.1.3.3.e.6.7.0.
0x28c465003000640035006400320037003500e.0.d.5.d.2.7.5.
0x28d4360036006300660039006600620035006.6.c.f.9.f.b.5.
0x28e439003600340036003600 9.6.4.6.6.
0x2a6265006600390039003000390030006600e.f.9.9.0.9.0.f.
0x2a72390032003100370034003200300032009.2.1.7.4.2.0.2.
0x2a82370035006200610063006600610064007.5.b.a.c.f.a.d.
0x2a92320038003900340033006400300062002.8.9.4.3.d.0.b.
0x2aa2370031003200620036003300300038007.1.2.b.6.3.0.8.
0x2ab266006400300062006100620000000000f.d.0.b.a.b.....
0x2ac263003a005c0061006e0061006c007900c.:.\.a.n.a.l.y.
0x2ad2730065005c0031003500370033003900s.e.\.1.5.7.3.9.
0x2ae2380038003900390032002e00330037008.8.9.9.2...3.7.
0x2af2300036003200340035005f00320030000.6.2.4.5._.2.0.
0x2b023500350033003700340062002d0064005.5.3.7.4.b.-.d.
0x2b123100320031002d0034006100320036001.2.1.-.4.a.2.6.
0x2b222d0061006300620064002d0061006600-.a.c.b.d.-.a.f.
0x2b32330062003200360039003500320031003.b.2.6.9.5.2.1.
0x2b42360032000000000043003a005c0036006.2.....C.:.\.6.
0x2b5262003500630036003400660037003500b.5.c.6.4.f.7.5.
0x2b62390065003700370035003200310062009.e.7.7.5.2.1.b.
0x2b72390063003200360061003300610036009.c.2.6.a.3.a.6.
0x2b8265006400340066003200610035003800e.d.4.f.2.a.5.8.
0x2b9264003500310039003900340036006200d.5.1.9.9.4.6.b.
0x2ba2340039003600300035003400650035004.9.6.0.5.4.e.5.
0x2bb2390065003300370061003300360032009.e.3.7.a.3.6.2.
0x2bc26300 c.
0x2fb4740061005c004c006f00630061006c00t.a.\.L.o.c.a.l.
0x2fc45c00540065006d0070005c0062007500\.T.e.m.p.\.b.u.
0x2fd46400680061002e007000650033003200d.h.a...p.e.3.2.
0x2fe40000000043003a005c00550073006500....C.:.\.U.s.e.
0x2ff4720073005c0050006500740072006100r.s.\.P.e.t.r.a.
0x30045c004100700070004400610074006100\.A.p.p.D.a.t.a.
0x30145c004c006f00630061006c005c005400\.L.o.c.a.l.\.T.
0x302465006d0070005c006500370062003800e.m.p.\.e.7.b.8.
0x303464006600310030003200300065006200d.f.1.0.2.0.e.b.
0x304431003400650034002d006200750064001.4.e.4.-.b.u.d.
0x30542e007000650033003200000000004300..p.e.3.2.....C.
0x30643a005c00550073006500720073005c00:.\.U.s.e.r.s.\.
0x3074610064006d0069006e005c0044006f00a.d.m.i.n.\.D.o.
0x308477006e006c006f006100640073005c00w.n.l.o.a.d.s.\.
0x309463003600320030003300320038003300c.6.2.0.3.2.8.3.
0x30a462006500610032006600650036003800b.e.a.2.f.e.6.8.
0x30b45f00620075006400680061002e006500_.b.u.d.h.a...e.
0x30c4780065000000000043003a005c003400x.e.....C.:.\.4.
0x30d4340035003900660062003600660032004.5.9.f.b.6.f.2.
0x30e465003000310036003400370030006200e.0.1.6.4.7.0.b.
0x30f464003000360066003200660063003300d.0.6.f.2.f.c.3.
0x310462003300370066003300310065003700b.3.7.f.3.1.e.7.
0x3114320066003900620030003100660035002.f.9.b.0.1.f.5.
0x3124310061006200350066006200350066001.a.b.5.f.b.5.f.
0x313462006400610031006300340062006300b.d.a.1.c.4.b.c.
0x3144350038006100310036006400620000005.8.a.1.6.d.b...
0x3154000043003a005c005500730065007200..C.:.\.U.s.e.r.
0x316473005c004c006900730061005c004400s.\.L.i.s.a.\.D.
0x3174650073006b0074006f0070005c005900e.s.k.t.o.p.\.Y.
0x3184640077004e0063005a00710066002e00d.w.N.c.Z.q.f...
0x31946500780065000000000043003a005c00e.x.e.....C.:.\.
0x31a4380038003500610037006100610063008.8.5.a.7.a.a.c.
0x31b465003500610066003700630062003100e.5.a.f.7.c.b.1.
0x31c461003900390064003500650034003700a.9.9.d.5.e.4.7.
0x31d4330030003200650038003600650066003.0.2.e.8.6.e.f.
0x31e465003500340065003900310062003900e.5.4.e.9.1.b.9.
0x31f430006400 0.d.