Benign datamaliciousorder Download

Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_102_1.vir

Berbew/Karton card-phishing backdoor identityCard-verification phishing prompt set

SHA-256957e2044fb347089970b49faf25b7382796145d8c9ee499732f535fe96444312

MaleculeMdTh

Evidence

Encoded content decoded: xor 0xaa29–0xab09

⋯3 more rows
0xaa5930e24dca00e24dca70e24de630e24dd60.M...M.p.M.0.M.
0xaa6902c27fee02ca7fe602d27ffe02a67f82................
0xaa7902ae7f9a02b67f9202be7faa02867fa2................
0xaa8902e24dca30e24dca30e24dca30e24dca..M.0.M.0.M.0.M.
0xaa9930e24dca30e24dca30e24dca30e24dca0.M.0.M.0.M.0.M.
⋯7 more rows

Embedded PE binary at file offset 0xe000 (~212992 bytes) 0xdfc0–0xe090

⋯3 more rows
0xdff000000000000000000000000000000000................
0xe0004d5a90000300000004000000ffff0000MZ..............
0xe010b8000000000000004000000000000000........@.......
0xe02000000000000000000000000000000000................
⋯7 more rows

Visa or MasterCard phishing choice 0xad88–0xb078

⋯7 more rows
0xadf8c64f713bc64f713bc64f713bc64f713b.Oq;.Oq;.Oq;.Oq;
0xae0892271848e604346c8a6f226f9309371b.'.H..4l.o"o..7.
0xae18b12e021ba520155ea26f1342e6195f1b..... .^.o.B.._.
0xae289061516b931f3a7288635156a92b1449.aQk..:r.cQV.+.I
0xae38a73b1e49e620171ba53d044fa93f5f55.;.I. ...=.O.?_U
0xae48b34f265eaa2c1e56a36f0554e6200449.O&^.,.V.o.T. .I
0xae58e6291e49b3225d1b872b0457b26f265e.).I."]..+.W.o&^
0xae68a46f3c5ab53b1449b56e5153b23b0101.o<Z.;.I.nQS.;..
0xae78e9601249b33b1e4be821043b87183c17.`.I.;.K.!.;..<.
0xae88e6381457a5201c5ee63b1e1b851d246f.8.W. .^.;....$o
⋯6 more rows
0xaef8a32c051b871b3c1b96063f17e63f1d5e.,....<...?..?.^
0xaf08a73c1417e62c1e49b42a124fc61f1d5e.<...,.I.*.O...^
0xaf18a73c1417e62a1f4fa33d5142a93a031b.<...*.O.=QB.:..
0xaf28871b3c1b96063f3b8f211254b43d1458..<...?;.!.T.=.X
0xaf38b26f326d907d5113f5621552a126051b.o2m.}Q..b.R.&..
0xaf48a520155ee6201f1ba42e1250e620171b. .^. .....P. ..
0xaf58a52e035fef63514baa2a1048a3635158..._.cQK.*.H.cQX
0xaf68a93d035ea53b716baa2a1048a363515e.=.^.;qk.*.H.cQ^
0xaf78a83b1449e6361e4eb46f326d907d5113.;.I.6.N.o2m.}Q.
0xaf88f5621552a126051ba520155ee6201f1b.b.R.&... .^. ..
0xaf98a42e1250e620171ba52e035fef4f5448...P. ....._.OTH
0xafa8eb6a023b9623145ab52a5d1bb52a1d5e.j.;.#.Z.*]..*.^
⋯4 more rows
0xaff8a26f3f4eab2d1449ea6f0157a32e025e.o?N.-.I.o.W...^
0xb008ea6f1254b43d1458b24f2157a32e025e.o.T.=.X.O!W...^
0xb018ea6f1455b22a031bbf200449e60c1049.o.U.*... .I...I
0xb028a26f3f4eab2d1449c66a021be33c716b.o?N.-.I.j...<qk
0xb038aa2a1048a363515ea83b1449e62c1e49.*.H.cQ^.;.I.,.I
0xb048b42a124fe6090457aa6f3f5aab2a716b.*.O...W.o?Z.*qk
0xb058aa2a1048a3635148a3231458b26f325a.*.H.cQH.#.X.o2Z
0xb068b42b51139026025ae9021048b22a0378.+Q..&.Z...H.*.x
0xb078a73d1512c6290356f44f235ea126024f.=...).V.O#^.&.O

Browser app iexplore 0xb3ea–0xb67a

⋯7 more rows
0xb45a4d1aeb62511eb36f5c16f84f5b15ec4fM..bQ..o\..O[..O
0xb46a2916a924235ea539400ac606347db42e)..$#^[email protected]}..
0xb47a1c5ec66a021eb36f5c1b8b261249a93c.^.j...o\..&.I.<
0xb48a1e5db26f3855b22a0355a33b517ebe3f.].o8U.*.U.;Q~.?
0xb49a1d54b42a033b9a061443b6231e49a361.T.*.;...C.#.I.a
0xb4aa1443a36f716ba73b193b9520174fb12e.C.oqk.;.;. .O..
0xb4ba035e9a021858b4200254a03b2d72836f.^...X. .T.;-r.o
⋯7 more rows
0xb53a1e59a7232448a33d3e5da0231855a34f.Y.#$H.=>].#.U.O
0xb54a2254a03b065ab42a2d76af2c0354b520"T.;.Z.*-v.,.T. 
0xb55a174f9a181855a22006489a0c0449b42a.O...U. .H...I.*
0xb56a1f4f902a0348af201f678f21055eb421.O.*.H. .g.!.^.!
0xb57a144fe61c144fb2261f5cb54f400df67e.O...O.&.\.O@..~
0xb58a71688909256c871d34678b261249a93cqh..%l..4g.&.I.<
⋯15 more rows

References the COM ThreadingModel registry value 0xb6ec–0xb91c

⋯7 more rows
0xb75ce32c5458c62d1d52a82b2e4eb52a033b.,TX.-.R.+.N.*.;
0xb76c912a131b83391455b26f3d54a1281449.*...9.U.o=T.(.I
0xb77cc61c1e5db2381049a3133c52a53d1e48...].8.I..<R.=.H
0xb78ca929056791261f5fa9380267853a0349.).g.&._.8.g.:.I
0xb79ca321056da33d0252a9212d68ae2a1d57.!.m.=.R.!-h.*.W
0xb7ac952a034daf2c1474a4251458b20b1457.*.M.,.t.%.X...W
0xb7bca7363d54a72b717ab62e034fab2a1f4f.6=T.+qz...O.*.O
0xb7ccc61b1949a32e1552a8283c54a22a1d3b...I...R.(<T.*.;
0xb7dcc60c3d688f0b2d1eb5133855963d1e58..=h..-...8U.=.X
0xb7ec952a034da33d4209c66a0267e33c5f5f.*.M.=B..j.g.<__
0xb7fcaa237140f176377e870c377deb093778.#[email protected]~..7}..7x
0xb80c8362490af30a5c7aff7f4116f57e4709.bI...\z..A..~G.
0xb81cff7f330e84784203bb4f7b3bcc1b296f..3..xB..O{;..)o
0xb82cfc6f561eb5687b31c66a41099e6f7173.oV..h{1.jA..oqs
⋯15 more rows

TerminateProcess API name in binary strings 0xc186–0xc316

⋯7 more rows
0xc1f674654d757465784100006402536c6565teMutexA..d.Slee
0xc20670006c025465726d696e61746550726fp.l.TerminatePro
0xc2166365737300008c025669727475616c51cess....VirtualQ
0xc22675657279000041004372656174655072uery..A.CreatePr
⋯15 more rows

Create registry key ANSI 0xc46a–0xc62a

⋯10 more rows
0xc50a476574557365724e616d654100007101GetUserNameA..q.
0xc51a5265674372656174654b657945784100RegCreateKeyExA.
0xc52a00007401526567436c6f73654b657900..t.RegCloseKey.
0xc53a000079015265674f70656e4b65794578..y.RegOpenKeyEx
0xc54a41008401526567517565727956616c75A...RegQueryValu
0xc55a65457841000090015265675365745661eExA....RegSetVa
0xc56a6c756545784100000000ca0147657453lueExA......GetS
0xc57a65637572697479496e666f000000cd01ecurityInfo.....
⋯11 more rows

Showing the top 5 files — 1 more file (26 regions) not shown.