Hostile 92% windows Download

file

Go loader with obfuscation and direct syscalls

Go PE with opaque identity and raw API dispatchGo PE signed by abused TLS server certificate
SHA-256fa77709baf5d398b0477271d75bf1f3b43e74f025a33f99e5fce4efc3bdd2dc5
URLhttps://mb-api.abuse.ch/api/v1/
MaleculeO₂(As₂C)H(Os)Md₂(PtSi₃)

Evidence

Go types with concatenated-word obfuscation 0x122f79–0x1230a9
⋯5 more rows
0x122fc96365656465644572726f72001c2a5b5dceededError..*[]
0x122fd96d61696e2e4b7a67756b706466786278main.Kzgukpdfxbx
0x122fe97373796e736463657a001c2a6d61702essynsdcez..*map.
0x122ff967726f75705b7265666c6563742e5479group[reflect.Ty
⋯11 more rows
Go PE with opaque build identity and dynamic API dispatch 0x1c9f0b–0x1ca0cb
⋯7 more rows
0x1c9f7b616473797374656d6c69627261727900adsystemlibrary.
0x1c9f8b73797363616c6c2e53797363616c6c4esyscall.SyscallN
0x1c9f9b0073797363616c6c2e6c6f61646c6962.syscall.loadlib
0x1c9fab726172790073797363616c6c2e676574rary.syscall.get
0x1c9fbb70726f63616464726573730073797363procaddress.sysc
0x1c9fcb616c6c2e53797363616c6c0073797363all.Syscall.sysc
0x1c9fdb616c6c2e53797363616c6c3600737973all.Syscall6.sys
⋯15 more rows
Go PE with opaque identity and raw API dispatch 0x1ccdd9–0x1ccee9
⋯3 more rows
0x1cce094c6f61642e6465666572777261703100Load.deferwrap1.
0x1cce1973797363616c6c2e282a4c617a795072syscall.(*LazyPr
0x1cce296f63292e46696e640073797363616c6coc).Find.syscall
0x1cce392e282a4c617a7950726f63292e46696e.(*LazyProc).Fin
0x1cce49642e6465666572777261703100737973d.deferwrap1.sys
0x1cce5963616c6c2e282a4c617a7950726f6329call.(*LazyProc)
0x1cce692e43616c6c0073797363616c6c2e282a.Call.syscall.(*
0x1cce794c617a7950726f63292e6d7573744669LazyProc).mustFi
⋯7 more rows
Go PE with retained symbol metadata 0x278dc0–0x278e80
⋯3 more rows
0x278df000000000000000000000000000000000................
0x278e0000000000040000000000000001002000.............. .
0x278e1003000000000011000000d0c011000100................
⋯7 more rows
Go PE signed by abused TLS server certificate 0x29a01e–0x29a19e
⋯7 more rows
0x29a08e756e74696d652e697461626c696e6b00untime.itablink.
0x29a09e676f3a6275696c64696e666f00676f3ago:buildinfo.go:
0x29a0ae6275696c64696e666f2e726566007275buildinfo.ref.ru
⋯15 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.