Hostile ^92% Download

Trojan.Win32.Dialer.bau

Trojan with embedded payload

Detects Gh0st RAT mentioned in Cylance' Ghost Dragon ReportEmbedded PE binary at file offset 0x14460 (~3072 bytes)

SHA-256bc0b60c3a77066b65cd94aab9728471f23516361e7af2bfbeff9223ffd4d4c0d

MaleculeMdTh

Evidence

Query/set system parameters (symbol) 0x102c4–0x10404

⋯8 more rows
0x10344e91c00b02005931901000000681301b0.... .......h...
0x1035400000000000000000000000000000000................
0x1036400000000fffffffff0f700b020059319............ ...
⋯10 more rows

Query/set system parameters (string) 0x113f4–0x11494

0x113f4457800008a0253657457696e646f7773Ex....SetWindows
0x11404486f6f6b45784100ae02556e686f6f6bHookExA...Unhook
0x1141457696e646f7773486f6f6b4578009902WindowsHookEx...
0x1142453797374656d506172616d6574657273SystemParameters
0x11434496e666f41003b0253656e644d657373InfoA.;.SendMess
0x11444616765410000d5026b657962645f6576ageA....keybd_ev
⋯5 more rows

Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report 0x1238c–0x1254c

⋯7 more rows
0x123fc53746172740000005479706500000000Start...Type....
0x1240c52656753657456616c75654578287374RegSetValueEx(st
0x1241c61727429000000004572726f72436f6eart)....ErrorCon
0x1242c74726f6c000000004f626a6563744e61trol....ObjectNa
⋯18 more rows

Percent-encoded content decoded 0x12574–0x12644

⋯3 more rows
0x125a4700000005c757365722e646174000000p...\user.dat...
0x125b40d0a5b253032642f253032642f256420..[%02d/%02d/%d 
0x125c4253032643a253032643a253032645d20%02d:%02d:%02d] 
0x125d4282573290d0a00005d0000000d0a0000(%s)....].......
⋯7 more rows

Embedded PE binary at file offset 0x14460 (~3072 bytes) 0x14420–0x144f0

⋯3 more rows
0x1445000000000000000000300420049004e00..........B.I.N.
0x144604d5a90000300000004000000ffff0000MZ..............
0x14470b8000000000000004000000000000000........@.......
0x1448000000000000000000000000000000000................
⋯7 more rows