Virus.Hijack_Dropped.Backdoor.Padodor.BJ_736_1.vir
Backdoor with taunts and persistence
Virus.Hijack Agent DCBC lockerSelf-copy into Windows system directory with Run key
SHA-256f6503fc3b329655e3b7ebc35b2115a12a30af68485899a256bc789306f587f4c
Evidence
⋯5 more rows
0xff000000000000000000000000000000000................
0x10006f99f8639b6708996708fc3314141499o..c.g..g..3....
0x10105f1c91f413801b99670863fc64141414_.......g.c.d...
0x1020995f0899ff77d21014d8d8d8d8d8d8d8._...w..........
0x10306f99f8639b6708996708fc8a1d141499o..c.g..g.......
0x1040ff77d1d8d8d8d8d8d8d8d8d8d8d8d8d8.w..............
0x10506f99f8639b6708996708fc5c2c141499o..c.g..g..\,...
0x1060ff77d1d8d8d8d8d8d8d8d8d8d8d8d8d8.w..............
0x10706f99f8995f1c64fc9210141491d01077o..._.d........w
0x1080d21014d8d8d8d8d8d8d8d8d8d8d8d8d8................
0x10906f99f8639b6708996708fcc315151599o..c.g..g.......
0x10a05f1c91f413801b99670863fcd4151515_.......g.c.....
0x10b0995f0899ff77d21014d8d8d8d8d8d8d8._...w..........
0x10c06f99f8639b6708995f186425cd671c63o..c.g.._.d%.g.c
0x10d0996708fc4633141499ff77d21c14d8d8.g..F3....w.....
0x10e06f99f8639b67087a13995f08995c3463o..c.g.z.._..\4c
0x10f0152fec61521499ff77d1d8d8d8d8d8d8./.aR...w.......
0x11006f99f8639b67087a14995f08995c3463o..c.g.z.._..\4c
0x1110152fec61521499ff77d1d8d8d8d8d8d8./.aR...w.......
0x11206f99f8639b6708996708fc9470141499o..c.g..g...p...
0x1130ff77d21014d8d8d8d8d8d8d8d8d8d8d8.w..............
0x11406f99f8639b6708995f1c649967089963o..c.g.._.d.g..c
0x11503462152fe061521499ff77d21014d8d84b./.aR...w.....
0x11606f99f8639b6708995f24649967186399o..c.g.._$d.g.c.
0x11706f1c62995f08995c1063152fd8615214o.b._..\.c./.aR.
0x118099ff77d21814d8d8d8d8d8d8d8d8d8d8..w.............
0x11906f99f891f81c9b6708919708148f1bddo......g........
0x11a05f0c14141414f91b995f08995c109b67_........_..\..g
0x11b00c995f0c99ff77d1d8d8d8d8d8d8d8d8.._...w.........
0x11c06f99f8639b6708995f24649967186399o..c.g.._$d.g.c.
0x11d06f1c62995f08995c3463152fd0615214o.b._..\4c./.aR.
0x11e099ff77d21814d8d8d8d8d8d8d8d8d8d8..w.............
0x11f06f99f8639b6708995f08995c3463152fo..c.g.._..\4c./
0x1200d461521499ff77d1d8d8d8d8d8d8d8d8.aR...w.........
0x12106f99f8639b6708995f24649967186399o..c.g.._$d.g.c.
0x12206f1c62995f08995c3463152f8c615214o.b._..\4c./.aR.
0x123099ff77d21814d8d8d8d8d8d8d8d8d8d8..w.............
0x12406f99f8639b6708995f1c64996718637co..c.g.._.d.g.c|
0x125094141414996f0899523464152fd06152.....o..R4d./.aR
0x12601499ff77d21c14d8d8d8d8d8d8d8d8d8...w............
0x12706f99f8639b6708995f20649967246399o..c.g.._ d.g$c.
0x24f9000000000000000000000000000000000................
0x24fa000000000000000000000000000000000................
0x24fb000000000000000000000000000000000................
0x24fc000000000000000000000000000000000................
0x24fd000000000000000000000000000000000................
0x24fe000000000000000000000000000000000................
0x24ff000000000000000000000000000000000................
0x2500030ca020022ca020012ca020000ca02000..."...........
0x25010f0c90200dcc90200cec90200bcc90200................
0x25020aec90200000000000cc902001ec90200................
0x2503032c902003ec9020050c9020090c802002...>...P.......
0x25040f6c80200e2c80200ccc80200b8c80200................
0x25050a8c80200fcc70200ecc7020084c80200................
0x2506076c802006ac802005ac802004cc80200v...j...Z...L...
0x2507040c8020036c8020028c802001ac80200@...6...(.......
0x250800ac802009ec80200000000005cbe0200............\...
0x2509068be020078be020092be02009ebe0200h...x...........
0x250a0aabe0200babe0200c8be0200dabe0200................
0x250b0ecbe0200febe02000abf020018bf0200................
0x250c02abf020036bf02004abf020050be0200*...6...J...P...
0x250d084bf020098bf0200aabf0200babf0200................
0x250e0c8bf0200d6bf0200e4bf0200f2bf0200................
0x250f00cc0020024c002003ec0020058c00200....$...>...X...
0x2510072c002007cc002008cc002009ec00200r...|...........
0x25110aec00200bec00200cec00200e0c00200................
0x25120f2c0020002c1020018c102003ebe0200............>...
0x251302ebe02001abe020008be0200f0bd0200................
0x25140e6bd0200cebd0200bebd0200b0bd0200................
0x25150a4bd020088bd020078bd020068bd0200........x...h...
0x2516050bd020042bd02002abd02001cbd0200P...B...*.......
0x251700ebd0200fcbc0200f0bc0200e6bc0200................
0x25180d0bc0200bebc0200b2bc0200a2bc0200................
0x251908abc020074bc020064bc020052bc0200....t...d...R...
0x251a042bc020034bc020024bc020006bc0200B...4...$.......
0x251b0f2bb0200dcbb0200c4bb0200aabb0200................
0x251c098bb020088bb020078bb020068bb0200........x...h...
0x251d058bb020046bb020038bb02002cbb0200X...F...8...,...
0x251e01ebb020010bb0200fcba0200eeba0200................
0x251f0dcba0200ccba0200b6ba0200a0ba0200................
0x252008aba02007eba020076ba020062ba0200....~...v...b...
0x2521050ba020044ba020036ba020020ba0200P...D...6... ...
0x252200cba020004ba0200eeb90200e0b90200................
0x25230d4b90200c6b90200bab90200acb90200................
0x25240a0b902008eb902007eb9020066bf0200........~...f...
0x2525000000000090000800c00008008000080................
0x25260000000005eb9020046b9020030b90200....^...F...0...
0x2527020b902000000000060ca020050ca0200 .......`...P...
0x252800000000096ca020080ca020000000000................
⋯7 more rows
0x287004461746554696d655370616e00000000DateTimeSpan....
0x28710433a5c77696e646f77735c2573000000C:\windows\%s...
0x28720433a5c77696e646f77735c7379737465C:\windows\syste
0x287306d33325c25730000433a5c77696e646fm32\%s..C:\windo
0x2874077735c73797374656d5c257300000000ws\system\%s....
0x287507762000073746172742025730a000000wb..start %s....
⋯6 more rows
0x287c065786e67626f6c676567786c686f2021exngbolgegxlho !
0x287d0000000005c2573005c2573004e745265....\%s.\%s.NtRe
0x287e073756d6550726f63657373006e74646csumeProcess.ntdl
0x287f06c2e646c6c000000633a5c73746f702dl.dll...c:\stop-
0x288006164772e7478740025780000534f4654adw.txt.%x..SOFT
0x28810574152455c4d6963726f736f66745c57WARE\Microsoft\W
0x28820696e646f77735c43757272656e745665indows\CurrentVe
0x288307273696f6e5c52756e5c0000534f4654rsion\Run\..SOFT
0x28840574152455c4d6963726f736f66745c57WARE\Microsoft\W
0x28850696e646f77735c43757272656e745665indows\CurrentVe
0x288607273696f6e5c52756e5c000063616c63rsion\Run\..calc
0x288702e657865000000006f70656e00000000.exe....open....
0x288806e6f74657061642e657865006f70656enotepad.exe.open
0x28890000000006d737061696e742e65786500....mspaint.exe.
0x288a06f70656e0000000077726974652e6578open....write.ex
0x288b0650000006f70656e00000000596f7520e...open....You
0x288c07375636b00000000596f75207265616csuck....You real
0x288d079207468696e6b20796f752063616e20y think you can
0x288e0657363617065206d650000004d657373escape me...Mess
0x288f02077697468207468652062657374202c with the best ,
0x2890020646965206c696b6520746865207265 die like the re
0x28910737400004920616d20746865206f6e65st..I am the one
0x2892020616e64206f6e6c7900000048412048 and only...HA H
0x289304120484100000000436f6d606f6e202cA HA....Com`on ,
0x2894020746861746073207468652062657374 that`s the best
0x2895020796f752063616e20646f0049606d20 you can do.I`m
0x2896076657279206469737361706f696e7465very dissapointe
0x2897064207769746820796f75722070657266d with your perf
0x289806f726d61636500004e6f626164792063ormace..Nobady c
⋯7 more rows
0x2c9a057494e53504f4f4c2e4452560000eb01WINSPOOL.DRV....
0x2c9b05265674f70656e4b6579410004025265RegOpenKeyA...Re
0x2c9c06753657456616c75654578410000cb01gSetValueExA....
0x2c9d0526567436c6f73654b657900f7015265RegCloseKey...Re
0x2c9e067517565727956616c75654578410000gQueryValueExA..
0x2c9f0ec015265674f70656e4b657945784100..RegOpenKeyExA.
0x2ca00d1015265674372656174654b65794578..RegCreateKeyEx
0x2ca104100d40152656744656c6574654b6579A...RegDeleteKey
0x2ca204100dd01526567456e756d4b65794100A...RegEnumKeyA.
0x2ca30f601526567517565727956616c756541..RegQueryValueA
0x2ca40000041445641504933322e646c6c0000..ADVAPI32.dll..
0x2ca5007015368656c6c457865637574654100..ShellExecuteA.
0x2ca60af005348476574466f6c646572506174..SHGetFolderPat
⋯3 more rows
0x2caa046696c654e616d65410053484c574150FileNameA.SHLWAP
0x2cab0492e646c6c004f4c4541555433322e64I.dll.OLEAUT32.d
0x2cac06c6c0000000000000000000000000000ll..............
0x2cad000000000000000000000000000000000................
⋯7 more rows
⋯5 more rows
0x335ae01001800a80c00000100300334000000..........0.4...
0x335be560053005f0056004500520053004900V.S._.V.E.R.S.I.
0x335ce4f004e005f0049004e0046004f000000O.N._.I.N.F.O...
⋯6 more rows
0x3363e300034003000390030003400650034000.4.0.9.0.4.e.4.
0x3364e00004a001500010043006f006d007000..J.....C.o.m.p.
0x3365e61006e0079004e0061006d0065000000a.n.y.N.a.m.e...
0x3366e000054004f0044004f003a0020003c00..T.O.D.O.:. .<.
0x3367e43006f006d00700061006e0079002000C.o.m.p.a.n.y. .
0x3368e6e0061006d0065003e00000000005a00n.a.m.e.>.....Z.
0x3369e19000100460069006c00650044006500....F.i.l.e.D.e.
0x336ae73006300720069007000740069006f00s.c.r.i.p.t.i.o.
0x336be6e000000000054004f0044004f003a00n.....T.O.D.O.:.
0x336ce20003c00460069006c00650020006400 .<.F.i.l.e. .d.
0x336de65007300630072006900700074006900e.s.c.r.i.p.t.i.
0x336ee6f006e003e0000000000300008000100o.n.>.....0.....
0x336fe460069006c0065005600650072007300F.i.l.e.V.e.r.s.
0x3370e69006f006e000000000031002e003000i.o.n.....1...0.
0x3371e2e0030002e003100000038000c000100..0...1...8.....
0x3372e49006e007400650072006e0061006c00I.n.t.e.r.n.a.l.
0x3373e4e0061006d0065000000410064007700N.a.m.e...A.d.w.
0x3374e54006500730074002e00650078006500T.e.s.t...e.x.e.
0x3375e00008400300001004c00650067006100....0...L.e.g.a.
0x3376e6c0043006f0070007900720069006700l.C.o.p.y.r.i.g.
0x3377e68007400000054004f0044004f003a00h.t...T.O.D.O.:.
0x3378e200028006300290020003c0043006f00 .(.c.). .<.C.o.
⋯7 more rows
0x3380e6400770054006500730074002e006500d.w.T.e.s.t...e.
0x3381e7800650000004a001500010050007200x.e...J.....P.r.
0x3382e6f0064007500630074004e0061006d00o.d.u.c.t.N.a.m.
0x3383e65000000000054004f0044004f003a00e.....T.O.D.O.:.
0x3384e20003c00500072006f00640075006300 .<.P.r.o.d.u.c.