Hostile ^93% windows Download

LocationNotificationWindows.exe

MasonRAT malware with C2 and persistence

Detecs .NET Binary that lists installed AVsDetects unknown malware sample with pastebin RAW URL

SHA-256bedf7004c639d4c848bbdc4a12b7c04fc90bdde9eb55ae1155cdfe42b88e27b2

URLhttps://tria.ge/api/v0/samples/260824-t4v9dswydy/sample

MaleculeO₂(CP)H₇(Cm₅Cr₃DbF₅Hf₃Os₅Po₅)Md₃(Bi₃BkPa)Th₃

Evidence

.NET AES/Rijndael crypto evidence 0x5a84–0x5b44

⋯3 more rows
0x5ab417d613041104110531da140b2b00072a........1...+..*
0x5ac442534a4201000100000000000c000000BSJB............
0x5ad476342e302e3330333139000000000500v4.0.30319......
⋯7 more rows

Embedded HTTP or WebSocket URL 0x9e94–0xa0b4

⋯7 more rows
0x9f04630074007500720069006e0067000043c.t.u.r.i.n.g..C
0x9f14680074007400700073003a002f002f00h.t.t.p.s.:././.
0x9f2470006100730074006500620069006e00p.a.s.t.e.b.i.n.
0x9f342e0063006f006d002f00720061007700..c.o.m./.r.a.w.
⋯11 more rows
0x9ff46c00690074007900000f610070007000l.i.t.y...a.p.p.
0xa004640061007400610000035c0000197300d.a.t.a...\...s.
0xa014630068007400610073006b0073002e00c.h.t.a.s.k.s...
0xa02465007800650000432f00630072006500e.x.e..C/.c.r.e.
0xa03461007400650020002f00660020002f00a.t.e. ./.f. ./.
0xa0447300630020006d0069006e0075007400s.c. .m.i.n.u.t.
⋯7 more rows

.NET drive enumeration via DriveInfo API 0xa3e0–0xa6d0

⋯3 more rows
0xa410000d720065006700660075006300001b..r.e.g.f.u.c...
0xa42057005300630072006900700074002e00W.S.c.r.i.p.t...
0xa4305300680065006c006c00001152006500S.h.e.l.l...R.e.
0xa44067005700720069007400650000135200g.W.r.i.t.e...R.
0xa450450047005f00440057004f0052004400E.G._.D.W.O.R.D.
0xa460000762006f0074000019520075006e00..b.o.t...R.u.n.
0xa47042006f0074004b0069006c006c006500B.o.t.K.i.l.l.e.
⋯16 more rows
0xa580690064002000000720002f006600000fi.d. ... ./.f...
0xa59043004d0044002e004500580045000029C.M.D...E.X.E..)
0xa5a0500072006f0063006500730073002000P.r.o.c.e.s.s. .
0xa5b053007400610072007400650064002000S.t.a.r.t.e.d. .
0xa5c0610074003a0020000011720075006e00a.t.:. ...r.u.n.
0xa5d06e006e006e006e006e00001563006c00n.n.n.n.n...c.l.
⋯13 more rows
0xa6b073005700000949004e00530053000007s.W...I.N.S.S...
0xa6c07c007c007c0000134700650074004400|.|.|...G.e.t.D.
0xa6d072006900760065007300001746006900r.i.v.e.s...F.i.

HTTP header field delimiter 0xb163–0xb353

⋯7 more rows
0xb1d3680069006e00670000055c005c00002bh.i.n.g...\.\..+
0xb1e35c0072006f006f0074005c0053006500\.r.o.o.t.\.S.e.
0xb1f363007500720069007400790043006500c.u.r.i.t.y.C.e.
0xb2036e007400650072003200003d53006500n.t.e.r.2..=S.e.
0xb2136c0065006300740020002a0020006600l.e.c.t. .*. .f.
0xb22372006f006d00200041006e0074006900r.o.m. .A.n.t.i.
⋯3 more rows
0xb26300032c0000094e006f006e006500002f..,...N.o.n.e../
0xb27350004f005300540020002f0020004800P.O.S.T. ./. .H.
0xb2835400540050002f0031002e0031000d00T.T.P./.1...1...
0xb2930a0048006f00730074003a0020000080..H.o.s.t.:. ...
⋯12 more rows

.NET HTTP client with AES/Rijndael 0xb888–0xba98

⋯7 more rows
0xb8f8010000000000052002010e0e1801000a....... ........
0xb9084d7954656d706c6174650831342e302eMyTemplate.14.0.
0xb918302e30000004010000001001000b4d790.0...........My
0xb9282e436f6d707574657200001301000e4d.Computer......M
0xb938792e4170706c69636174696f6e00000cy.Application...
0xb9480100074d792e5573657200001301000e...My.User......
0xb9584d792e57656253657276696365730000My.WebServices..
0xb968072004010e0e0e0e6101003453797374. ......a..4Syst
0xb978656d2e5765622e53657276696365732eem.Web.Services.
0xb98850726f746f636f6c732e536f61704874Protocols.SoapHt
0xb9987470436c69656e7450726f746f636f6ctpClientProtocol
0xb9a8124372656174655f5f496e7374616e63.Create__Instanc
⋯15 more rows