socolivesa.io_new.exe
Keylogger, stealer, reverse shell, UAC bypass
fodhelper DelegateExecute hijackPE combines PowerShell and stdio
SHA-256d8af3c83bd5e5b801ef62344a85e1622d57e2f39569dfaca950a16bea07a91ab
Evidence
⋯12 more rows
0x32cf444f574e005f70726f63005f686f6f6bDOWN._proc._hook
0x32df49440053797374656d2e546578740053ID.System.Text.S
0x32ef7472696e674275696c646572005f6275tringBuilder._bu
0x32ff66666572005f61637469766557696e64ffer._activeWind
0x330f6f77005f6c6f636b0053657457696e64ow._lock.SetWind
0x331f6f7773486f6f6b457800556e686f6f6bowsHookEx.Unhook
0x332f57696e646f7773486f6f6b4578004361WindowsHookEx.Ca
0x333f6c6c4e657874486f6f6b457800476574llNextHookEx.Get
0x334f4d6f64756c6548616e646c6500476574ModuleHandle.Get
⋯9 more rows
0x33ef5645525f434f4e4e45435400574d5f43VER_CONNECT.WM_C
0x33ff41505f53415645444942006361704372AP_SAVEDIB.capCr
0x340f656174654361707475726557696e646feateCaptureWindo
0x341f77410053656e644d6573736167650044wA.SendMessage.D
0x342f657374726f7957696e646f7700776176estroyWindow.wav
⋯7 more rows
⋯5 more rows
0x34fa646f7700476574436f6e736f6c655769dow.GetConsoleWi
0x350a6e646f7700536c656570004e74536574ndow.Sleep.NtSet
0x351a496e666f726d6174696f6e50726f6365InformationProce
0x352a7373005669727475616c416c6c6f6345ss.VirtualAllocE
0x353a7800577269746550726f636573734d65x.WriteProcessMe
0x354a6d6f72790043726561746552656d6f74mory.CreateRemot
0x355a65546872656164004f70656e50726f63eThread.OpenProc
0x356a657373004f70656e436c6970626f6172ess.OpenClipboar
0x357a6400436c6f7365436c6970626f617264d.CloseClipboard
0x358a00476574436c6970626f617264446174.GetClipboardDat
0x359a6100476c6f62616c4c6f636b00476c6fa.GlobalLock.Glo
0x35aa62616c556e6c6f636b00497344656275balUnlock.IsDebu
0x35ba6767657250726573656e74004d61696eggerPresent.Main
0x35ca00436f6c6c65637453797374656d496e.CollectSystemIn
⋯7 more rows
⋯5 more rows
0x39d9746963730050726f6365737300476574tics.Process.Get
0x39e943757272656e7450726f636573730050CurrentProcess.P
0x39f9726f636573734d6f64756c6500676574rocessModule.get
0x3a095f4d61696e4d6f64756c65006765745f_MainModule.get_
⋯6 more rows
0x3a79705f457175616c697479004d61727368p_Equality.Marsh
0x3a89616c0052656164496e74333200537472al.ReadInt32.Str
0x3a99696e67004461746554696d6500676574ing.DateTime.get
0x3aa95f4e6f770053797374656d2e57696e64_Now.System.Wind
0x3ab96f77732e466f726d73004b6579730043ows.Forms.Keys.C
0x3ac96f6e636174004d6f6e69746f7200456eoncat.Monitor.En
0x3ad974657200417070656e64004578697400ter.Append.Exit.
0x3ae96765745f4c656e67746800436c656172get_Length.Clear
0x3af90053797374656d2e494f0046696c6500.System.IO.File.
0x3b09417070656e64416c6c5465787400456eAppendAllText.En
0x3b19636f64696e67006765745f5554463800coding.get_UTF8.
0x3b29476574427974657300436f6e76657274GetBytes.Convert
0x3b3900546f426173653634537472696e6700.ToBase64String.
0x3b4961766963617033322e646c6c003c5374avicap32.dll.<St
0x3b596172743e625f5f30004353243c3e395fart>b__0.CS$<>9_
⋯8 more rows
0x3be9476c6f62616c416e7369004672656548GlobalAnsi.FreeH
0x3bf9476c6f62616c00457869737473005265Global.Exists.Re
0x3c096164416c6c42797465730044656c6574adAllBytes.Delet
0x3c19650077696e6d6d2e646c6c0050726f63e.winmm.dll.Proc
0x3c296573735374617274496e666f00676574essStartInfo.get
0x3c395f5374617274496e666f007365745f46_StartInfo.set_F
0x3c49696c654e616d65007365745f41726775ileName.set_Argu
0x3c596d656e7473007365745f557365536865ments.set_UseShe
0x3c696c6c45786563757465007365745f4372llExecute.set_Cr
0x3c79656174654e6f57696e646f7700576169eateNoWindow.Wai
⋯3 more rows
0x487366007400000945006400670065000015f.t...E.d.g.e...
0x48834c006f00670069006e00200044006100L.o.g.i.n. .D.a.
0x48937400610000154c006f00670069006e00t.a...L.o.g.i.n.
⋯11 more rows
⋯3 more rows
0x4d7861006c006c0044006100740065000011a.l.l.D.a.t.e...
0x4d887300630068007400610073006b007300s.c.h.t.a.s.k.s.
0x4d9800552f00630072006500610074006500.U/.c.r.e.a.t.e.
⋯3 more rows
0x4dd86400610074006500220020002f007400d.a.t.e.". ./.t.
0x4de87200200022000021220020002f007300r. ."..!". ./.s.
0x4df8630020006f006e006c006f0067006f00c. .o.n.l.o.g.o.
0x4e086e0020002f0066000061530059005300n. ./.f..aS.Y.S.
⋯8 more rows
0x4e9870002e0065007800650000092f006100p...e.x.e.../.a.
0x4ea87500200000196500760065006e007400u. ...e.v.e.n.t.
0x4eb87600770072002e006500780065000080v.w.r...e.x.e...
0x4ec88348004b00450059005f004300550052.H.K.E.Y._.C.U.R
0x4ed800520045004e0054005f005500530045.R.E.N.T._.U.S.E
0x4ee80052005c0053006f0066007400770061.R.\.S.o.f.t.w.a
0x4ef800720065005c0043006c006100730073.r.e.\.C.l.a.s.s
0x4f0800650073005c006d0073002d00730065.e.s.\.m.s.-.s.e
0x4f18007400740069006e00670073005c0073.t.t.i.n.g.s.\.s
0x4f2800680065006c006c005c006f00700065.h.e.l.l.\.o.p.e
0x4f38006e005c0063006f006d006d0061006e.n.\.c.o.m.m.a.n
0x4f48006400011f440065006c006500670061.d...D.e.l.e.g.a
0x4f5800740065004500780065006300750074.t.e.E.x.e.c.u.t
0x4f68006500001b66006f006400680065006c.e...f.o.d.h.e.l
0x4f78007000650072002e0065007800650000.p.e.r...e.x.e..
0x4f88813d2d0043006f006d006d0061006e00.=-.C.o.m.m.a.n.
⋯11 more rows