Hostile 92% Download

Backdoor.Win32.IRCBot.vu

Named IRC bot backdoor

Detects Base64 encoded Executable in ExecutableEncoded content decoded: base64
SHA-256b85e39689cc8ccc52565dc668812685811eafb7452311f6d041c3d6a5689bfbe
MaleculeMdTh

Evidence

Query/set system parameters (string) 0x6c80–0x6d20
0x6c8000000400587c42000000000000000000....X|B.........
0x6c90a1607c42000bc07402ffe068786c4000.`|B...t...hxl@.
0x6ca0b860114000ffd0ffe000000016000000.`.@............
0x6cb053797374656d506172616d6574657273SystemParameters
0x6cc0496e666f4100000014684000b06c4000[email protected]@.
0x6cd000000400647c42000000000000000000....d|B.........
⋯5 more rows
Encoded content decoded: base64 0xc7a4–0xc894
⋯3 more rows
0xc7d42a002e006f00630078000000a8000000*...o.c.x.......
0xc7e453004500740046005700560039004d00S.E.t.F.W.V.9.M.
0xc7f4540030004e0042005400460039004e00T.0.N.B.T.F.9.N.
0xc804510055004e0049005300550035004600Q.U.N.I.S.U.5.F.
0xc814580046004e00500052006c0052005800X.F.N.P.R.l.R.X.
0xc824510056004a0046005800450031004a00Q.V.J.F.X.E.1.J.
⋯7 more rows
Detects Base64 encoded Executable in Executable 0x2b3f7–0x2b577
⋯7 more rows
0x2b4679868040070006c006700310040340200.h..p.l.g.1.@4..
0x2b4775400560071005100410041004d004100T.V.q.Q.A.A.M.A.
0x2b48741004100410045004100410041004100A.A.A.E.A.A.A.A.
⋯15 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.