Benign Download

btmtk.ko.zst

C2 infrastructure using multiple communication methodsRepeated NOP-run pattern in executable section
SHA-256fd95545d0c0a0dd96514e74faa678fa68f4728c393aec56e9d4c011968c8882d
MaleculeO₂(AsC)

Evidence

Repeated NOP-run pattern in executable section 0x230–0x280
0x23000000000000000000000000000000000................
0x24090909090909090909090909090909090................
0x250e800000000550fb6c9448d49014889e5.....U...D.I.H..
0x26081fa25790000745f81fa61790000752f..%y..t_..ay..u/
0x2704585c0742a4589c8b96179000048c7c2E..t*E...ay..H..
0x28000000000e8000000005d31c031d231 .........]1.1.1
C2 infrastructure using multiple communication methods 0x3006–0x3036
0x30068b45d865482b0500000000751b4883c4.E.eH+.....u.H..
0x3016585b415c415d415e5d31c031d231c931X[A\A]A^]1.1.1.1
0x3026f631ffe900000000e800000000e80000.1..............
0x30360000e9000000004c89 .......L.
GPL license reference 0x3bbd–0x3bed
0x3bbd7232682e62696e006c6963656e73653dr2h.bin.license=
0x3bcd47504c0076657273696f6e3d302e3100GPL.version=0.1.
0x3bdd6465736372697074696f6e3d426c7565description=Blue
0x3bed746f6f too

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.