Benign Download

cnc.pre-category

Assembly LOOP target mnemonicGo-compiled binary

SHA-256cd27705a523334b5d49e1cf01801e4e832702e07aa846645b2d475f48ad19e8e

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Am)O₃(CaDyEr)H₅(Cm₁₆Cr₉Db₄Os₄Po)Md₄(Bi₂HePt)

Evidence

Invokes x86-64 syscall by immediate number 0x81064–0x81294

⋯3 more rows
0x81094cccccccccccccccccccccccc8b7c2408.............|$.
0x810a4b8e70000000f05c3cccccccccccccccc................
0x810b4cccccccccccccccccccccccc488b4424............H.D$
0x810c408c70000000000bf00000000b83c0000.............<..
0x810d4000f05cd03ebfeccccccccccbf9cffff................
0x810e4ff488b7424088b542410448b542414b8.H.t$..T$.D.T$..
0x810f4010100000f05483d01f0ffff7605b8ff......H=....v...
0x81104ffffff89442418c3cccccccccccccccc....D$..........
0x81114cccccccccccccccccccccccc8b7c2408.............|$.
0x81124b8030000000f05483d01f0ffff7605b8.......H=....v..
0x81134ffffffff89442410c3cccccc488b7c24.....D$.....H.|$
0x8114408488b7424108b542418b8010000000f.H.t$..T$.......
0x811540589442420c3cccccccccccc8b7c2408..D$ ........|$.
0x81164488b7424108b542418b8000000000f05H.t$..T$........
0x8117489442420c3cccccccccccccc554889e5.D$ ........UH..
0x811844883ec10ba000000008b442420b94042H.........D$ .@B
0x811940f00f7f148890424b8e8030000f7e248....H..$.......H
0x811a4894424084889e7be00000000b8230000.D$.H........#..
0x811b4000f054883c4105dc3ccccccb8ba0000...H...]........
0x811c4000f0589442408c3cccccccccccccccc....D$..........
0x811d4ccccccccccccccccccccccccb8270000.............'..
0x811e4000f054189c4b8ba0000000f0589c644...A...........D
0x811f489e78b542408b8ea0000000f05c3cccc...T$...........
0x81204cccccccccccccccccccccccccccccccc................
0x81214ccccccccccccccccccccccccb8270000.............'..
0x81224000f0589c78b742408b83e0000000f05......t$..>.....
0x81234c3ccccccccccccccccccccccb8270000.............'..
⋯6 more rows

ChaCha quarter-round rotation schedule 0x1b868a–0x1b874a

⋯3 more rows
0x1b86ba899c2418010000418d9a6e64203331d3..$....A..nd 31.
0x1b86cac1c310418d141f895424744431d2c1c2...A....T$tD1...
0x1b86da0c458d3c12458dbf6e6420334431fbc1.E.<.E..nd 3D1..
⋯7 more rows

HTTP protocol version strings 0x26a07f–0x26a14f

⋯3 more rows
0x26a0af83ec2848894424384883fb08754448ba..(H.D$8H...uDH.
0x26a0bf485454502f312e30483910742248ba48HTTP/1.0H9.t"H.H
0x26a0cf5454502f312e314839107526b8010000TTP/1.1H9.u&....
0x26a0df004889c3b9010000004883c4285dc3b8.H.......H..(]..
⋯7 more rows

HTTP/2 protocol version string 0x293a8a–0x293b4a

⋯3 more rows
0x293aba2a752e48837820087527488b481848ba*u.H.x .u'H.H.H.
0x293aca485454502f322e30483911751448c740HTTP/2.0H9.u.H.@
0x293ada58ffffffff488b8424b8000000c64078X....H..$.....@x
⋯7 more rows

Large low-entropy read-only data section 0x351fc0–0x3520a0

⋯3 more rows
0x351ff000000000000000000000000000000000................
0x352000000000017300016d00015f0001760101....s..m.._..v..
0x3520104600016e000172000177000163000166F..n..r..w..c..f
0x35202001015201014e01014501014401015001..R..N..E..D..P.
0x35203001510101470001700101530001640101.Q..G..p..S..d..
⋯7 more rows