Hostile ^92% Download

28e0c4d5bc6675537ba47c6529877a3194a29585fb86477f66bf13c79252d2f0

Obfuscated ransomware with embedded payload

Garbled Go C2 implant (HTTP/2, TLS, crypto)Garble randomized packages (digit variant)

SHA-256f33f709c1db1b252dbcae322b2340af81cfa72f9c62e60c37c57ef4f0d8151d0

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₂(As₂I)H₅(CmCrDb₂F₂Os₂)Md₂(Bi₅Pt)

Evidence

ChaCha quarter-round rotation schedule 0x319837–0x3198f7

⋯3 more rows
0x319867899c2418010000418d9a6e64203331d3..$....A..nd 31.
0x319877c1c310418d141f895424604431d2c1c2...A....T$`D1...
0x3198870c458d3c12458dbf6e6420334431fbc1.E.<.E..nd 3D1..
⋯7 more rows

Large low-entropy read-only data section 0x555fc0–0x5560a0

⋯3 more rows
0x555ff000000000000000000000000000000000................
0x556000000001014600015f0001720001770001....F.._..r..w..
0x5560107300016600016e000170000163000162s..f..n..p..c..b
0x55602000017400016d01015200017500016100..t..m..R..u..a.
0x55603001780001790001670101420001690102.x..y..g..B..i..
⋯7 more rows

Go-compiled binary 0x6aab60–0x6aace0

⋯7 more rows
0x6aabd000000000000000000000000000000000................
0x6aabe06210bc1c000001086521000000000000b.......e!......
0x6aabf0aa000000000000000010400000000000..........@.....
⋯15 more rows

Garble randomized packages (digit variant) 0x6acf4e–0x6ad21e

⋯5 more rows
0x6acf9e2a54797065292e506f696e7465727300*Type).Pointers.
0x6acfae7762384e6c4844392e282a455f317a5fwb8NlHD9.(*E_1z_
0x6acfbe6647524c514d7a292e4572726f720077fGRLQMz).Error.w
0x6acfce62384e6c4844392e46724546374c3248b8NlHD9.FrEF7L2H
⋯6 more rows
0x6ad03e724546374c32484e744f2e5479706500rEF7L2HNtO.Type.
0x6ad04e7762384e6c4844392e282a664a735047wb8NlHD9.(*fJsPG
0x6ad05e684c34745a6271292e41737369676e61hL4tZbq).Assigna
0x6ad06e626c65546f007762384e6c4844392e28bleTo.wb8NlHD9.(
0x6ad07e2a664a735047684c34745a6271292e43*fJsPGhL4tZbq).C
0x6ad08e6f6d70617261626c65007762384e6c48omparable.wb8NlH
0x6ad09e44392e282a664a735047684c34745a62D9.(*fJsPGhL4tZb
0x6ad0ae71292e456c656d007762384e6c484439q).Elem.wb8NlHD9
0x6ad0be2e282a664a735047684c34745a627129.(*fJsPGhL4tZbq)
0x6ad0ce2e496d706c656d656e7473007762384e.Implements.wb8N
0x6ad0de6c4844392e664a735047684c34745a62lHD9.fJsPGhL4tZb
0x6ad0ee712e4b696e64007762384e6c4844392eq.Kind.wb8NlHD9.
0x6ad0fe282a664a735047684c34745a6271292e(*fJsPGhL4tZbq).
0x6ad10e4b696e64007762384e6c4844392e282aKind.wb8NlHD9.(*
0x6ad11e664a735047684c34745a6271292e4c65fJsPGhL4tZbq).Le
0x6ad12e6e007762384e6c4844392e282a664a73n.wb8NlHD9.(*fJs
0x6ad13e5047684c34745a6271292e4e616d6500PGhL4tZbq).Name.
0x6ad14e7762384e6c4844392e282a664a735047wb8NlHD9.(*fJsPG
0x6ad15e684c34745a6271292e4e756d4669656chL4tZbq).NumFiel
0x6ad16e64007762384e6c4844392e282a664a73d.wb8NlHD9.(*fJs
⋯11 more rows

Go garbled package type pointer 0x6b0faf–0x6b10df

⋯5 more rows
0x6b0fff5031496a5a2e636f6e59425761654a20P1IjZ.conYBWaeJ 
0x6b100f2a43596b706c6d423950595a572e474c*CYkplmB9PYZW.GL
0x6b101f69496859565a38207d5d292e53746f72iIhYVZ8 }]).Stor
0x6b102f6500696b74555031496a5a2e584e3164e.iktUP1IjZ.XN1d
⋯11 more rows