Suspicious 80% malware-souk Download

6d4cb4dcae0ad95c2112b2b2c110e296475daf2f64cf64720caec172555ba6f5.zip

Encrypted archive, hash-named, complex binary

Imports the Unix syscall wrapper APIChaCha20/Salsa20 cipher constant
SHA-2569d3e86e876dfcf28b549b23f3d0223e287e2b2f00c672087a7450ab53bc7ddb4

Evidence

_Unwind_Resume exception-unwinding symbol 0x9b0–0xca0
⋯7 more rows
0xa206966696300707468726561645f736574ific.pthread_set
0xa307370656369666963005f556e77696e64specific._Unwind
0xa405f526573756d65005f556e77696e645f_Resume._Unwind_
0xa504261636b7472616365005f556e77696eBacktrace._Unwin
⋯19 more rows
0xb905f617474725f67657467756172647369_attr_getguardsi
0xba07a65006c6962646c2e736f2e3200646cze.libdl.so.2.dl
0xbb073796d006c6962632e736f2e3600706fsym.libc.so.6.po
0xbc07369785f6d656d616c69676e00646c5fsix_memalign.dl_
⋯4 more rows
0xc10656c640063616c6c6f63007374726c65eld.calloc.strle
0xc206e00707263746c006d656d7365740077n.prctl.memset.w
0xc30726974657600706f6c6c00736967616critev.poll.sigal
0xc4074737461636b006d656d637079006d70tstack.memcpy.mp
0xc50726f74656374006d616c6c6f63007265rotect.malloc.re
0xc60616c70617468006f70656e6469720067alpath.opendir.g
0xc706574656e76006d756e6d617000726561etenv.munmap.rea
0xc80646c696e6b00736574726c696d697400dlink.setrlimit.
0xc906765746377640072656e616d65007265getcwd.rename.re
0xca061646469723634005f5f6378615f6669addir64.__cxa_fi
_main program entry symbol 0x13ca0–0x13d60
⋯3 more rows
0x13cd0e8db11ffff0f0b660f1f840000000000.......f........
0x13ce041574156534881ec3001000048c78424AWAVSH..0...H..$
0x13cf080000000000000000f280571bd03000f.........(.q....
⋯7 more rows
ChaCha quarter-round rotation schedule 0x1b5ac–0x1b78c
⋯3 more rows
0x1b5dc48895424708b44241c4401f84131c641H.T$p.D$.D..A1.A
0x1b5ecc1c6104401f54131ef41c1c70c4401f8...D..A1.A...D..
0x1b5fc4131c641c1c6084401f5896c24644131A1.A...D...l$dA1
0x1b60cef41c1c7078b6c241801fd31eec1c610.A....l$...1....
0x1b61c01f131cfc1c70c01fd31eec1c60801f1..1......1......
0x1b62c31cfc1c707448b5424144501c24431d31....D.T$.E..D1.
0x1b63cc1c310448b64240c4101dc4531e041c1...D.d$.A..E1.A.
0x1b64cc00c4501c24431d3c1c3084101dc4531..E..D1....A..E1
0x1b65ce041c1c0078b5424084401ca4131d341.A....T$.D..A1.A
0x1b66cc1c310448b6c24104501dd4531e941c1...D.l$.E..E1.A.
0x1b67cc10c4401ca895424084131d341c1c308..D...T$.A1.A...
0x1b68c4501dd4531e941c1c10701f84131c341E..E1.A.....A1.A
0x1b69cc1c3104501dc4431e7c1c70c01f88944...E..D1.......D
0x1b6ac241c4131c341c1c3084501dc44896424$.A1.A...E..D.d$
0x1b6bc0c4431e7c1c7074401c54131ee41c1c6.D1....D..A1.A..
0x1b6cc104501f54531e841c1c00c4401c5896c.E..E1.A...D...l
0x1b6dc24184131ee488b5424708b6c246441c1$.A1.H.T$p.l$dA.
0x1b6ecc6084501f544896c24104531e841c1c0..E..D.l$.E1.A..
0x1b6fc074501ca4431d6c1c61001f54131e941.E..D1......A1.A
0x1b70cc1c10c4501ca44895424144431d6c1c6...E..D.T$.D1...
0x1b71c0801f54131e941c1c1078b4424084401...A1.A....D$.D.
⋯7 more rows
ChaCha20/Salsa20 cipher constant 0x4fc10–0x4fd40
⋯3 more rows
0x4fc4092096b4cfeb872864819cffcdbc124e3..kL..r.H.....$.
0x4fc5072616e676520656e6420696e64657820range end index
0x4fc6029207768656e20736c6963696e672060) when slicing `
0x4fc70657870616e642033322d62797465206bexpand 32-byte k
0x4fc807b696e76616c69642073796e7461787d{invalid syntax}
0x4fc90616c726561647920626f72726f776564already borrowed
0x4fca0696e76616c69642066696c656e616d65invalid filename
0x4fcb06e6f2073746f72616765207370616365no storage space
0x4fcc0686f737420756e726561636861626c65host unreachable
0x4fcd0636f6e6e656374696f6e207265736574connection reset
⋯7 more rows
Stream cipher error type 0x52daa–0x52fda
⋯3 more rows
0x52dda40d9f183ded9da0c7181c28faab972dd@.......q.....r.
0x52dea2122232425262728292a2b2c2d303132!"#$%&'()*+,-012
0x52dfa333435363738394041424344454647483456789@ABCDEFGH
0x52e0a494a4b4c4d4e5051525354555658595aIJKLMNPQRSTUVXYZ
0x52e1a5b60616263646568696a6b6c6d707172[`abcdehijklmpqr
0x52e2a4142434445464748494a4b4c4d4e4f50ABCDEFGHIJKLMNOP
0x52e3a5152535455565758595a616263646566QRSTUVWXYZabcdef
0x52e4a6768696a6b6c6d6e6f70717273747576ghijklmnopqrstuv
0x52e5a7778797a303132333435363738392b2cwxyz0123456789+,
0x52e6a2e2f4142434445464748494a4b4c4d4e./ABCDEFGHIJKLMN
⋯23 more rows

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.