Suspicious ^80% Download

Backdoor.Win32.Rbot.dx

Rbot backdoor with embedded PE

Embedded PE binary at file offset 0x3a2d4 (~393216 bytes)Encoded content decoded: base64

SHA-256c42bbfdbfb9cc53f62532b8edfc0d00524eb081d6245dcb54627a25e804dde9b

Evidence

Encoded content decoded: xor 0x1b05e–0x1b13e

⋯3 more rows
0x1b08e121212121212121212121212121258c3..............X.
0x1b09e12121212121212121212121212121212................
0x1b0ae12121212121212121212121212121212................
0x1b0be12121212121212121212121212121212................
0x1b0ce12121212121212121212121212121212................
⋯7 more rows

Embedded PE binary at file offset 0x3a2d4 (~393216 bytes) 0x3a294–0x3a364

⋯3 more rows
0x3a2c47ef9efef4515e8733b239a5b9fffd900~...E..s;#.[....
0x3a2d44d5a90000300000004000000ffff0000MZ..............
0x3a2e4b8000000000000004000000000000000........@.......
0x3a2f400000000000000000000000000000000................
⋯7 more rows

Execute shell command (ShellExecuteA) 0x63701–0x637c1

⋯3 more rows
0x637314424105b5e5fc3891783c7044974d0baD$.[^_......It..
0x63741fffefe7e8b0603d083f0ff33c28b1683...~.......3....
0x63751c604a90001018174de84d274d084f674.......t...t...t
⋯7 more rows

Encoded content decoded: base64 0x85304–0x85444

⋯3 more rows
0x85334696f6e00000000000000000000000000ion.............
0x8534450476879506b4e31636e4a6c626e5167PGhyPkN1cnJlbnQg
0x853545a573168615777676432467a49484e6cZW1haWwgd2FzIHNl
0x85364626e5167596e6b675957346752585a68bnQgYnkgYW4gRXZh
0x853746248566864476c766269424d61574e6cbHVhdGlvbiBMaWNl
0x85384626e4e6c4c6a7869636a343d00000000bnNlLjxicj4=....
0x8539400000000000000000000000044516f4e............DQoN
0x853a4436b4e31636e4a6c626e51675a573168CkN1cnJlbnQgZW1h
0x853b4615777676432467a49484e6c626e5167aWwgd2FzIHNlbnQg
0x853c4596e6b675957346752585a6862485668YnkgYW4gRXZhbHVh
0x853d464476c766269424d61574e6c626e4e6cdGlvbiBMaWNlbnNl
⋯7 more rows