Virus.Danger_Gen.Trojan.ShellObject.yuZ@aiy413e_3.vir
Trojan with self-delete and beaconing
Hardcoded ping-pong echo tokenDelayed ping-and-del self-delete
SHA-256a0708bdcfa3739909c025b3ff0434be91f01d34e2e6f56ccbe907e5d968b85bf
Evidence
⋯11 more rows
0x4805e5b8b4dfc33cde8e30600008be55dc3^[.M.3........].
0x4908b355820400068a4214000ffd683c404.5X @.h.!@......
0x4a0b80200000068f4254000668945ccff15.....h.%@.f.E...
⋯7 more rows
⋯3 more rows
0x77fe0feffff528d8598feffff506a006a00....R......Pj.j.
0x78f68000000086a006a006a008d8df0feffh....j.j.j......
0x79fff516a00ff15042040008b4dfc33cde8.Qj.... @..M.3..
⋯7 more rows
⋯3 more rows
0xbdd750b53536a0153ff1550204000895dfcu.SSj.S..P @..].
0xbed64a1180000008b7004895de4bf803340d......p..]...3@
0xbfd00535657ff15482040003bc374193bc6.SVW..H @.;.t.;.
0xc0d750833f6468975e4eb1068e8030000ffu.3.F.u...h.....
⋯7 more rows
⋯5 more rows
0x15646765745f706f72745f66726f6d5f636fget_port_from_co
0x15746e74726f6c6c65723a20736f636b6574ntroller: socket
0x15842829202d204572726f7220617420736f() - Error at so
0x1594636b657428293a20256c640a00000000cket(): %ld.....
0x15a46765745f706f72745f66726f6d5f636fget_port_from_co
0x15b46e74726f6c6c65723a20736f636b6574ntroller: socket
0x15c42829206973204f4b2e0a00006765745f() is OK....get_
0x15d4706f72745f66726f6d5f636f6e74726fport_from_contro
0x15e46c6c65723a20636f6e6e656374282920ller: connect()
0x15f42d204661696c656420746f20636f6e6e- Failed to conn
0x160465637420616e642067657420706f7274ect and get port
0x16142e0a00006765745f706f72745f66726f....get_port_fro
0x16246d5f636f6e74726f6c6c65723a20636fm_controller: co
0x16346e6e6563742829206973204f4b2e0a00nnect() is OK...
0x16446765745f706f72745f66726f6d5f636fget_port_from_co
0x16546e74726f6c6c65723a2047657474696entroller: Gettin
0x166467206563686f20706f72742e2e2e0a00g echo port.....
0x16746765745f706f72745f66726f6d5f636fget_port_from_co
0x16846e74726f6c6c65723a20436f6e6e6563ntroller: Connec
0x169474696f6e20436c6f7365642e0a000000tion Closed.....
0x16a46765745f706f72745f66726f6d5f636fget_port_from_co
0x16b46e74726f6c6c65723a3a207265637628ntroller:: recv(
0x16c429206973204f4b2e0a0000006765745f) is OK.....get_
0x16d4706f72745f66726f6d5f636f6e74726fport_from_contro
0x16e46c6c65723a3a20526563656976656420ller:: Received
0x16f4646174612069733a20222564220a0000data is: "%d"...
0x17046765745f706f72745f66726f6d5f636fget_port_from_co
0x17146e74726f6c6c65723a3a204279746573ntroller:: Bytes
0x17242072656365697665642069733a20256c received is: %l
0x1734642e0a006563686f5f616e645f726574d...echo_and_ret
0x174475726e3a20736f636b65742829202d20urn: socket() -
0x17544572726f7220617420736f636b657428Error at socket(
0x1764293a20256c640a006563686f5f616e64): %ld..echo_and
0x17745f72657475726e3a20736f636b657428_return: socket(
0x178429206973204f4b2e0a0000006563686f) is OK.....echo
0x17945f616e645f72657475726e3a20636f6e_and_return: con
0x17a46e6563742829202d204661696c656420nect() - Failed
0x17b4746f20636f6e6e65637420746f207365to connect to se
0x17c4727665722825732920706f72743a2564rver(%s) port:%d
0x17d40a0000006563686f5f616e645f726574....echo_and_ret
0x17e475726e3a20636f6e6e65637428292069urn: connect() i
0x17f473204f4b2e0a00006563686f5f616e64s OK....echo_and
⋯5 more rows
0x1a3c657220706f72743a2025640a00000000er port: %d.....
0x1a4c4144414d414e445052415348414e5441ADAMANDPRASHANTA
0x1a5c5245415745534f4d450a000025733a25REAWESOME...%s:%
0x1a6c64204441544120434f52525550542e0ad DATA CORRUPT..
0x1a7c0000000025733a25642044415441204f....%s:%d DATA O
⋯13 more rows
0x1b5c01000000525344536062c1ccd6676948....RSDS`b...giH
0x1b6cb54755a58a83359410000000433a5c70.GU...5.....C:\p
0x1b7c696e675f706f6e675c77696e5f636c69ing_pong\win_cli
0x1b8c656e745c52656c656173655c77696e5fent\Release\win_
0x1b9c636c69656e742e706462000000000000client.pdb......
0x1bac00000000391e00000000000000000000....9...........
⋯11 more rows