Hostile 92% Download

Trojan.Win32.Dialer.czb

Known Trojan, RAT indicators

Detects Gh0st RAT mentioned in Cylance' Ghost Dragon ReportPercent-encoded content decoded
SHA-256b7522ebc69412d278ba335d68747bd27e2b61792b9ab7f859f42447818e32766
MaleculeMdTh

Evidence

Query/set system parameters (symbol) 0xf288–0xf3e8
⋯10 more rows
0xf32806000000080000000c00000010000000................
0xf33818000000200000003000000040000000.... ...0...@...
0xf3486000000080000000c000000000010000`...............
⋯10 more rows
Query/set system parameters (string) 0x1077e–0x1081e
0x1077e6f700000480147657450726f63657373op..H.GetProcess
0x1078e57696e646f7753746174696f6e003b02WindowStation.;.
0x1079e53656e644d6573736167654100009902SendMessageA....
0x107ae53797374656d506172616d6574657273SystemParameters
0x107be496e666f4100d6026b657962645f6576InfoA...keybd_ev
0x107ce656e7400d3014d61705669727475616cent...MapVirtual
⋯5 more rows
Percent-encoded content decoded 0x115f8–0x116c8
⋯3 more rows
0x116286e74726f6c5365745c53657276696365ntrolSet\Service
0x11638735c2573000000000d0a5b253032642fs\%s......[%02d/
0x11648253032642f256420253032643a253032%02d/%d %02d:%02
0x11658643a253032645d20282573290d0a0000d:%02d] (%s)....
⋯7 more rows
Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report 0x1172c–0x118ec
⋯7 more rows
0x1179c53746172740000005479706500000000Start...Type....
0x117ac52656753657456616c75654578287374RegSetValueEx(st
0x117bc61727429000000004572726f72436f6eart)....ErrorCon
0x117cc74726f6c000000004f626a6563744e61trol....ObjectNa
⋯18 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.