Suspicious 80% Download

Trojan-Spy.Win32.Agent.j

Trojan spyware with hooks

Embedded PE binary at file offset 0x5aa60 (~45744 bytes)References the Windows debugger output API
SHA-256fb51662a234735724e8fb4bc8c979dcd2daf222a15648db88d74cfe235de9646
MaleculeO(Er)H(Po₂)

Evidence

Execute shell command (ShellExecuteA) 0x4e180–0x4e2f0
⋯6 more rows
0x4e1e0c00000000000004668466f726567726f.......FhForegro
0x4e1f0756e64576e64203d2025583b20684163undWnd = %X; hAc
0x4e20074697665576e64203d2025583b206846tiveWnd = %X; hF
0x4e2106f6375736564576e64203d2025580a00ocusedWnd = %X..
⋯14 more rows
Detour-style InstallHook helper name 0x4e3dc–0x4e49c
⋯3 more rows
0x4e40c5f7570646174652e646174003a000000_update.dat.:...
0x4e41c496e7374616c6c486f6f6b007259a09bInstallHook.rY..
0x4e42ca8f6cf11a44200a0c90a8f3952656769.....B.....9Regi
⋯7 more rows
References the Windows debugger output API 0x58c1c–0x58cec
⋯3 more rows
0x58c4c72656e7450726f636573734964000000rentProcessId...
0x58c5c4f75747075744465627567537472696eOutputDebugStrin
0x58c6c674100005465726d696e61746550726fgA..TerminatePro
0x58c7c6365737300004f70656e50726f636573cess..OpenProces
⋯7 more rows
Embedded PE binary at file offset 0x5aa60 (~45744 bytes) 0x5aa20–0x5aaf0
⋯3 more rows
0x5aa500000000000000000030044004c004c00..........D.L.L.
0x5aa604d5a90000300000004000000ffff0000MZ..............
0x5aa70b8000000000000004000000000000000........@.......
0x5aa8000000000000000000000000000000000................
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.