Hostile ^92% datamaliciousorder Download

Trojan.Danger_Trojan.GenericKD.67166905_37.vir

Self-deleting, system-infecting trojan

Recursively infects PE files across drivesLaunches COMSPEC to delete own short path

SHA-256c1f31ab80ccf710aa9f203dfb9c550aba2181a889b22ba94de0de03b719f8555

MaleculeO₃(IErAs)H₃(F₄Os₂Po₄)Md₃(Bi₃Si)Th

Evidence

x86 indirect call through a global pointer 0x1071–0x11b1

⋯3 more rows
0x10a144010000682040400051ff1510304000D...h @@.Q...0@.
0x10b18b350c3040008d5424408d8424440100[email protected]$@..$D..
0x10c1005250ffd68d8c244401000068184040.RP....$D...h.@@
⋯4 more rows
0x111144242400000000c744240c40000000ffD$$.....D$.@....
0x1121151c31400085c0744a8b54243c8b3508[email protected]$<.5.
0x11313040006a4052ffd66800010000ff1504[email protected]@R..h.......
0x114130400050ffd66a0fff150030400050ff[email protected]@.P.
⋯7 more rows

Delete files (Windows API ANSI) 0x2f98–0x31e8

⋯6 more rows
0x2ff800000000000000005ffea4760c06a576........_..v...v
0x30084d25a47687d6a4767acca4766710a576M%.v...vz..vg..v
0x3018df96a6767410a5761f2aa576b68ba476...vt..v.*.v...v
0x3028e0e5a376f4c5a476a0efa4766220a076...v...v...vb .v
0x303866efa4765d9da476d728a576f01da076f..v]..v.(.v...v
0x30480774a47600000000e09f4e6d129f4e6d.t.v......Nm..Nm
0x3058419d4e6dc1a14e6d04a24e6d6ed44b6dA.Nm..Nm..Nmn.Km
0x30681f9c4e6d7b9f4e6d03c44b6d84c34b6d..Nm{.Nm..Km..Km
⋯6 more rows
0x30d8aa36787575dc7975c0b27d7553f57975.6xuu.yu..}uS.yu
0x30e870c0777550997875c3877e75ac767875p.wuP.xu..~u.vxu
0x30f85f557c75c4b2787506f67875c8f37875_U|u..xu..xu..xu
0x3108793d78755798787595347975c0837975y=xuW.xu.4yu..yu
0x3118000000000a9bbd756f649e7500000000.......uod.u....
0x3128d763747671ea79760000000000000000.ctvq.yv........
0x31381010400000000000ffffffff6e224000[email protected]"@.
⋯11 more rows

Links legacy MFC42 runtime 0x340c–0x358c

⋯7 more rows
0x347c00000000623700005437000000000000....b7..T7......
0x348c4d464334322e444c4c0049005f5f4378MFC42.DLL.I.__Cx
0x349c784672616d6548616e646c657200ba01xFrameHandler...
0x34ac5f73746174004c0266636c6f73650000_stat.L.fclose..
0x34bc5d026672656164006202667365656b00].fread.b.fseek.
0x34cc5702666f70656e00a90272656e616d65W.fopen...rename
0x34dc00006602667772697465000059026670..f.fwrite..Y.fp
⋯11 more rows

References GetLogicalDrives API name 0x360a–0x381a

⋯3 more rows
0x363a000002036c7374726370794100000901....lstrcpyA....
0x364a476574456e7669726f6e6d656e745661GetEnvironmentVa
0x365a726961626c6541004e0147657453686friableA.N.GetSho
0x366a7274506174684e616d65410024014765rtPathNameA.$.Ge
⋯8 more rows
0x36fa50726f636573734100009602536c6565ProcessA....Slee
0x370a700020014765744c6f676963616c4472p. .GetLogicalDr
0x371a69766573000026014765744d6f64756cives..&.GetModul
0x372a6548616e646c65410000500147657453eHandleA..P.GetS
⋯4 more rows
0x377a3b0053484368616e67654e6f74696679;.SHChangeNotify
0x378a000074005368656c6c45786563757465..t.ShellExecute
0x379a457841005348454c4c33322e646c6c00ExA.SHELL32.dll.
0x37aa00000000000000000000000000000000................
⋯7 more rows

References a Windows .exe filename or extension 0x3fc0–0x41b0

⋯5 more rows
0x40104f70656e00000000203e206e756c0000Open.... > nul..
0x40202f632064656c2000434f4d5350454300/c del .COMSPEC.
0x4030726200005f2e6578650000002e657865rb.._.exe....exe
0x404000000000776200002e746d7000000000....wb...tmp....
0x40505f0000005c5a6f6d6269652e65786500_...\Zombie.exe.
0x40605fcfebd5d2bbd8cec4bcfe2d5f2d0000_..........-_-..
⋯7 more rows
0x40e0d0d0c1cbb3ccd0f23f20202020200a00........?     ..
0x40f02e42414b000000002e62616b00000000.BAK.....bak....
0x41002e47484f0000000067686f002e455845.GHO....gho..EXE
0x41100000000057494e4e5400000057494e44....WINNT...WIND
0x41204f5753002a2e2a005c0000003a000000OWS.*.*.\...:...
⋯9 more rows