Benign Download

Backdoor.Win32.Cakl.ahr

CreateRemoteThread API stringEncoded content decoded: xor

SHA-256d27fdcbfe60e50175f9281086ecfd1c3f435b2d22602ab6a1b14fccc73d82fea

Evidence

Encoded content decoded: xor 0x9ea6–0x9f86

⋯3 more rows
0x9ed64c97ffffcccccccccccc8d4d04e9b87bL..........M...{
0x9ee6ffff8d8d94efffffe9ad81ffff8d8d98................
0x9ef6efffffe9a281ffff8d8da0efffffe997................
0x9f067bffff8d8da8efffffe98c7bffff8d8d{..........{....
0x9f16a4efffffe9817bffff8d8d9cefffffe9......{.........
⋯7 more rows

Encoded content decoded: xor → base64 0x165e4–0x166b4

⋯3 more rows
0x16614000000000000000000000000887d7dca.............}}.
0x16624bea1a1febfb2b2ffbcadadffbbababff................
0x16634baa9a9ffbba9a9ffbca4a4ff563f3fff............V??.
0x16644694848ffb7a4a4ffae9292ffab8d8dffiHH.............
⋯7 more rows

CreateRemoteThread API string 0x2265c–0x2272c

⋯3 more rows
0x2268cb8bebfaba69ab8a5beafa9becaca8cca................
0x2269c89b8afabbeaf98afa7a5beaf9ea2b8af................
0x226acabaecaca76c89ca3b8bebfaba68ba6a6....v...........
0x226bca5a98fb2cacaf4cb8dafbe9ab8a5a98b................
⋯7 more rows