Hostile ^100% Download

uux

Persistence, C2, and evasion indicators

Detects malware from disclosed CN malware setHeartbeat thread procedure

SHA-256dee20b174e5f6d11ae4ac78fc7b5939e114464879edbc45a3ae962dc4b72832e

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₅(CIAsDyP₂)H₆(Cm₂DbDsF₁₀Os₂Po₂)Md₃(Bi₂Bk)Th

Evidence

Native stack immediate byte-string fragment 0x805–0x8e5

⋯3 more rows
0x83584c075d88b450cc9c35589e55383ec20..u..E...U..S.. 
0x845c645e101c645e202c645e304c645e408.E...E...E...E..
0x855c645e510c645e620c645e740c645e880.E...E. [email protected]..
0x865c645e91bc645ea36c745f000000000eb.E...E.6.E......
0x8754bc745ec00000000eb338b45ec8d1485K.E......3.E....
⋯7 more rows

LCG PRNG multiplier 0x41C64E6D in code 0x2a460–0x2a520

⋯3 more rows
0x2a490c30f1f800000000083c70489f3ebde90................
0x2a4a069066d4ec641053930000025ffffff7fi.mN.A.90..%....
0x2a4b08906890231c08b5df48b75f88b7dfc89....1..]..u..}..
⋯7 more rows

References JFIF or the JPEG media type 0xa5304–0xa5554

⋯3 more rows
0xa53346d6167652f782d786269746d61702c20mage/x-xbitmap, 
0xa5344696d6167652f6a7065672c20696d6167image/jpeg, imag
0xa5354652f706a7065672c206170706c696361e/pjpeg, applica
⋯9 more rows
0xa53f4696e673a20677a69702c206465666c61ing: gzip, defla
0xa5404746500000d0a557365722d4167656e74te....User-Agent
0xa54143a204d6f7a696c6c612f352e30202863: Mozilla/5.0 (c
0xa54246f6d70617469626c653b204d53494520ompatible; MSIE 
0xa543431302e303b2057696e646f7773204e5410.0; Windows NT
0xa544420362e313b20574f5736343b20547269 6.1; WOW64; Tri
0xa545464656e742f362e3029000d0a486f7374dent/6.0)...Host
0xa54643a000d0a436f6e6e656374696f6e3a20:...Connection: 
⋯15 more rows

UDP flood terminology 0x1b860d–0x1b872d

⋯5 more rows
0x1b865d6f6f645076453473796e62005f5a5a39oodPvE4synb._ZZ9
0x1b866d5544505f466c6f6f645076453473796eUDP_FloodPvE4syn
0x1b867d62005f5a5a31316d795f6970636f6e66b._ZZ11my_ipconf
⋯11 more rows

Heartbeat thread procedure 0x1c2c9f–0x1c2dbf

⋯5 more rows
0x1c2cef61636b73697a650073656e646d736700acksize.sendmsg.
0x1c2cff48656172744265617454687265616400HeartBeatThread.
0x1c2d0f5f5f6d706e5f657874726163745f646f__mpn_extract_do
⋯11 more rows