Trojan.Injector_Backdoor.Hupigon.AAAH_18_2.vir
Overlay temp payload dropperHardcoded ping-pong echo token
SHA-256f2f99aba4d21a00ac413c3ee6b70bef0fe8bd9b7e86ef7e0be1cca572c42cfdb
MaleculeK(Mc)O(C)H₃(Cm₃F₃Po₉)Md₂(Bi₂Si)
Evidence
0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x30000000000000000000000000f0000000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯12 more rows
⋯3 more rows
0x77fe0feffff528d8598feffff506a006a00....R......Pj.j.
0x78f68000000086a006a006a008d8df0feffh....j.j.j......
0x79fff516a00ff15042040008b4dfc33cde8.Qj.... @..M.3..
⋯7 more rows
⋯5 more rows
0x15646765745f706f72745f66726f6d5f636fget_port_from_co
0x15746e74726f6c6c65723a20736f636b6574ntroller: socket
0x15842829202d204572726f7220617420736f() - Error at so
0x1594636b657428293a20256c640a00000000cket(): %ld.....
0x15a46765745f706f72745f66726f6d5f636fget_port_from_co
0x15b46e74726f6c6c65723a20736f636b6574ntroller: socket
0x15c42829206973204f4b2e0a00006765745f() is OK....get_
0x15d4706f72745f66726f6d5f636f6e74726fport_from_contro
0x15e46c6c65723a20636f6e6e656374282920ller: connect()
0x15f42d204661696c656420746f20636f6e6e- Failed to conn
0x160465637420616e642067657420706f7274ect and get port
0x16142e0a00006765745f706f72745f66726f....get_port_fro
0x16246d5f636f6e74726f6c6c65723a20636fm_controller: co
0x16346e6e6563742829206973204f4b2e0a00nnect() is OK...
0x16446765745f706f72745f66726f6d5f636fget_port_from_co
0x16546e74726f6c6c65723a2047657474696entroller: Gettin
0x166467206563686f20706f72742e2e2e0a00g echo port.....
0x16746765745f706f72745f66726f6d5f636fget_port_from_co
0x16846e74726f6c6c65723a20436f6e6e6563ntroller: Connec
0x169474696f6e20436c6f7365642e0a000000tion Closed.....
0x16a46765745f706f72745f66726f6d5f636fget_port_from_co
0x16b46e74726f6c6c65723a3a207265637628ntroller:: recv(
0x16c429206973204f4b2e0a0000006765745f) is OK.....get_
0x16d4706f72745f66726f6d5f636f6e74726fport_from_contro
0x16e46c6c65723a3a20526563656976656420ller:: Received
0x16f4646174612069733a20222564220a0000data is: "%d"...
0x17046765745f706f72745f66726f6d5f636fget_port_from_co
0x17146e74726f6c6c65723a3a204279746573ntroller:: Bytes
0x17242072656365697665642069733a20256c received is: %l
0x1734642e0a006563686f5f616e645f726574d...echo_and_ret
0x174475726e3a20736f636b65742829202d20urn: socket() -
0x17544572726f7220617420736f636b657428Error at socket(
0x1764293a20256c640a006563686f5f616e64): %ld..echo_and
0x17745f72657475726e3a20736f636b657428_return: socket(
0x178429206973204f4b2e0a0000006563686f) is OK.....echo
0x17945f616e645f72657475726e3a20636f6e_and_return: con
0x17a46e6563742829202d204661696c656420nect() - Failed
0x17b4746f20636f6e6e65637420746f207365to connect to se
0x17c4727665722825732920706f72743a2564rver(%s) port:%d
0x17d40a0000006563686f5f616e645f726574....echo_and_ret
0x17e475726e3a20636f6e6e65637428292069urn: connect() i
0x17f473204f4b2e0a00006563686f5f616e64s OK....echo_and
⋯7 more rows
0x1db46561746550726f636573734100008202eateProcessA....
0x1dc447657454656d7046696c654e616d6541GetTempFileNameA
0x1dd4000013024765744d6f64756c6546696c....GetModuleFil
0x1de4654e616d654100005200436c6f736548eNameA..R.CloseH
0x1df4616e646c6500840247657454656d7050andle...GetTempP
0x1e046174684100004b45524e454c33322e64athA..KERNEL32.d
0x1e146c6c00001e015368656c6c4578656375ll....ShellExecu
0x1e24746541005348454c4c33322e646c6c00teA.SHELL32.dll.
0x1e345753325f33322e646c6c0000c4056d61WS2_32.dll....ma
0x1e446c6c6f630000660561746f6900001004lloc..f.atoi....
⋯3 more rows
0x1e84616e6400960566777269746500009305and...fwrite....
0x1e946674656c6c009105667365656b007605ftell...fseek.v.
0x1ea466636c6f7365000071045f74696d6536fclose..q._time6
⋯7 more rows
⋯3 more rows
0x1ff46e766f6b655f776174736f6e0000ef01nvoke_watson....
0x20045f636f6e74726f6c66705f730000ec02_controlfp_s....
0x2014496e7465726c6f636b65644578636861InterlockedExcha
0x20246e676500e902496e7465726c6f636b65nge...Interlocke
0x203464436f6d7061726545786368616e6765dCompareExchange
0x20440000d30248656170536574496e666f72....HeapSetInfor
0x20546d6174696f6e0000ea00456e636f6465mation....Encode
0x2064506f696e74657200c0045465726d696ePointer...Termin
0x207461746550726f636573730000c0014765ateProcess....Ge
0x20847443757272656e7450726f6365737300tCurrentProcess.
0x2094d304556e68616e646c65644578636570..UnhandledExcep
0x20a474696f6e46696c7465720000a5045365tionFilter....Se
0x20b474556e68616e646c6564457863657074tUnhandledExcept
0x20c4696f6e46696c74657200000349734465ionFilter...IsDe
0x20d462756767657250726573656e7400ca00buggerPresent...
0x20e44465636f6465506f696e74657200a703DecodePointer...
0x20f45175657279506572666f726d616e6365QueryPerformance
0x2104436f756e746572009302476574546963Counter...GetTic
0x21146b436f756e740000c501476574437572kCount....GetCur
0x212472656e7454687265616449640000c101rentThreadId....
⋯18 more rows