Hostile 92% windows Download

file

obfuscated Go malware with C2

Go PE hides path and resolves Win32 via SyscallNGo PE signed by abused TLS server certificate
SHA-256af3ef660ee97d62ccc7d0685b66be395ae0304a2daad6796b04520fa018233ec
URLhttps://mb-api.abuse.ch/api/v1/
MaleculeO₂(As₂C)H(Os)Md₂(PtSi₃)

Evidence

Go types with concatenated-word obfuscation 0x156dc2–0x156ef2
⋯5 more rows
0x156e1263746c6974652e5479706500192a5b5dctlite.Type..*[]
0x156e226d61696e2e4a6e6d6b667478736a796bmain.Jnmkftxsjyk
0x156e326f627569757200192a6d61702e67726fobuiur..*map.gro
0x156e4275705b737472696e675d666c6f617436up[string]float6
⋯11 more rows
Go PE hides build path with SyscallN dispatch 0x23a5dc–0x23a79c
⋯7 more rows
0x23a64c616473797374656d6c69627261727900adsystemlibrary.
0x23a65c73797363616c6c2e53797363616c6c4esyscall.SyscallN
0x23a66c0073797363616c6c2e6c6f61646c6962.syscall.loadlib
0x23a67c726172790073797363616c6c2e676574rary.syscall.get
0x23a68c70726f63616464726573730073797363procaddress.sysc
0x23a69c616c6c2e53797363616c6c0073797363all.Syscall.sysc
0x23a6ac616c6c2e53797363616c6c3600737973all.Syscall6.sys
⋯15 more rows
Go PE hides path and resolves Win32 via SyscallN 0x23d3c6–0x23d4d6
⋯3 more rows
0x23d3f64c6f61642e6465666572777261703100Load.deferwrap1.
0x23d40673797363616c6c2e282a4c617a795072syscall.(*LazyPr
0x23d4166f63292e46696e640073797363616c6coc).Find.syscall
0x23d4262e282a4c617a7950726f63292e46696e.(*LazyProc).Fin
0x23d436642e6465666572777261703100737973d.deferwrap1.sys
0x23d44663616c6c2e282a4c617a7950726f6329call.(*LazyProc)
0x23d4562e43616c6c0073797363616c6c2e282a.Call.syscall.(*
0x23d4664c617a7950726f63292e6d7573744669LazyProc).mustFi
⋯7 more rows
Go PE with retained symbol metadata 0x2dc7c0–0x2dc880
⋯3 more rows
0x2dc7f000000000000000000000000000000000................
0x2dc80000000000040000000000000001002000.............. .
0x2dc81003000000000011000000300715000100..........0.....
⋯7 more rows
Go PE signed by abused TLS server certificate 0x2f905e–0x2f91de
⋯7 more rows
0x2f90ce756e74696d652e697461626c696e6b00untime.itablink.
0x2f90de676f3a6275696c64696e666f00676f3ago:buildinfo.go:
0x2f90ee6275696c64696e666f2e726566007275buildinfo.ref.ru
⋯15 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.