Suspicious ^80% Download

Backdoor.Win32.Rbot.ush

Named Rbot backdoor binary

Binary contains a UPX packing markerUPX decompression I/O error

SHA-256d0ac05588a434b9f74e33565e0a5fbb52da12df6bd3306f84dad951c5f16774c

Evidence

Compact high-entropy RWX UPX1 section 0xfc0–0x10a0

⋯3 more rows
0xff000000000000000000000000000000000................
0x10001a030002048bb3f46de4c725ff0e0cd1........m..%....
0x1010381c2a51ddd94a4887508c0dd83fb0008.*Q..JH.P...?..
0x1020554a802968d253b09f720920c4d23344UJ.)h.S..r. ..3D
0x1030a3943a63ae7062d889e3838faa51b8db..:c.pb......Q..
⋯7 more rows

IsDebuggerPresent API name in PE strings 0x70084–0x70154

⋯3 more rows
0x700b46f6465202564290025583a4441460000ode %d).%X:DAF..
0x700c44973446562756767657250726573656eIsDebuggerPresen
0x700d4740000004b65726e656c333200000000t...Kernel32....
0x700e4284c6f636174696f6e205845422c2065(Location XEB, e
⋯7 more rows

References the Windows debugger output API 0x7034c–0x7042c

⋯3 more rows
0x7037c6d000000777269746520746f00000000m...write to....
0x7038c4f75747075744465627567537472696eOutputDebugStrin
0x7039c675700004f7574707574446562756753gW..OutputDebugS
0x703ac7472696e674100005f52530025750000tringA.._RS.%u..
0x703bc53657450726f6365737353687574646fSetProcessShutdo
⋯7 more rows

References the IsDebuggerPresent API 0xaf090–0xaf2e0

⋯3 more rows
0xaf0c01cf8aff71dad371c7f602fc8070c7e6e......7..`/...~n
0xaf0d04d66c37be73f4cd87c2ef272abee5004Mf.{.?L.|..r..P.
0xaf0e0fdc4fc067a2d35f36843e1d10395c7b7....z-5.hC......
0xaf0f07d7aeb8166e867c3a16d9fdd7ae04cfc}z..f.g..m..z.L.
0xaf100debcfa9988e790ef40aa6f8337babcce[email protected]...
⋯12 more rows
0xaf1d0dd8afaf9aafae218ff2ee4c58db4ff14................
0xaf1e0fd568c301d7809f80cb8bd314628013c.V.0.x.....1F(.<
0xaf1f0c03ee05520655b8c301c380e9a8f5fde.>.U e[.0.8..._.
0xaf200a0bdd58699fd8a8a97fae296d6b4d0f6................
⋯14 more rows