Benign Download

Backdoor.Win32.Hupigon.bxli

Detects an XORed URL in an executableEncoded content decoded: xor
SHA-256a13e09790fc8489c3522253e96a04a339e05810eeb4e6c9b6c8fb4b19855d433
MaleculeMdTh

Evidence

Encoded content decoded: xor 0x7ff4–0x80d4
⋯3 more rows
0x802428bfc0806ce5c0808cbdc080f866c080(...l........f..
0x8034a4d4cdf5ecf4e9d2e5e1e4c5f8e3ecf5................
0x8044f3e9f6e5d7f2e9f4e5d3f9eee3e8f2ef................
0x8054eee9fae5f20dc080d50b6cd309530942..........l..S.B
0x8064416a90e677730bdd88e60981e60993dbAj..ws..........
⋯7 more rows
Encoded content decoded: xor → base64 0xee61–0xef31
⋯3 more rows
0xee91bfc08070bcc0808cbdc080c8bdc08098...p............
0xeea1c5d6e1f2e9e1eef4c1f2f2e1f9ccefe3................
0xeeb1ebe5e4c5f2f2eff20dc080887bc08080............{...
0xeec180808080808080808080808080808080................
⋯7 more rows
Detects an XORed URL in an executable 0x9008c–0x9014c
⋯3 more rows
0x900bc83808080e5e4e4807f7f7f7f8c808080................
0x900cce8f4f4f0baafafb9b8e5f8e580808080................
0x900dc7f7f7f7f81808080ba8080807f7f7f7f................
⋯7 more rows
Query/set system parameters (string) 0xa27de–0xa287e
0xa27dee7e580808080d4f2e1eef3ece1f4e5cd................
0xa27eec4c9d3f9f3c1e3e3e5ec80808080d4f2................
0xa27fee1e3ebd0eff0f5f0cde5eef580808080................
0xa280ed3f9f3f4e5edd0e1f2e1ede5f4e5f2f3................
0xa281ec9eee6efc1808080d3e8eff7d7e9eee4................
0xa282eeff780808080d3e8eff7d3e3f2efecec................
⋯5 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.