Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- * MalFamily: "Trojan-PSW"
- * MalScore: 10.0
- * File Name: "Exes_92eba943bfdf15732f4f8d47d596c38a.exe"
- * File Size: 427008
- * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
- * SHA256: "ec042ea8b6b6a94678df7612bffa69082e772b6c9d8a57b0bc89bc1258046b80"
- * MD5: "92eba943bfdf15732f4f8d47d596c38a"
- * SHA1: "26ce9046dbe35974610caddecee0aa64fb0af99c"
- * SHA512: "1671e609cca1eb6e0bbe5725ff21f23c6c3411474f50bf48a3fb1d845e040ae531614c453b67fe0fdc5e531553992c2e76680d2f8f6f401c7f6c2a66565cef49"
- * CRC32: "2C48BCB5"
- * SSDEEP: "12288:93BEfEVTgoUILnqXHwr0MNo4rodpWWRnVHe:9R7BvUMqXHDgtqWWJVH"
- * Process Execution:
- "Exes_92eba943bfdf15732f4f8d47d596c38a.exe",
- "services.exe",
- "lsass.exe",
- "sdclt.exe",
- "taskhost.exe",
- "sc.exe",
- "svchost.exe",
- "svchost.exe",
- "WerFault.exe",
- "wermgr.exe"
- * Executed Commands:
- "C:\\Windows\\system32\\lsass.exe",
- "C:\\Windows\\System32\\sdclt.exe /CONFIGNOTIFICATION",
- "taskhost.exe $(Arg0)",
- "C:\\Windows\\system32\\sc.exe start w32time task_started",
- "C:\\Windows\\system32\\svchost.exe -k LocalService",
- "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
- "C:\\Windows\\system32\\WerFault.exe -u -p 1452 -s 288",
- "\"C:\\Windows\\system32\\wermgr.exe\" \"-queuereporting_svc\" \"C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_30ff788d55c8dd8e13e51cbc4a41a06fb37b455_cab_06a3ea06\""
- * Signatures Detected:
- "Description": "At least one process apparently crashed during execution",
- "Details":
- "Description": "Creates RWX memory",
- "Details":
- "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
- "Details":
- "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 12081395 times"
- "Description": "Steals private information from local Internet browsers",
- "Details":
- "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History"
- "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data"
- "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies"
- "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
- "Description": "Collects information about installed applications",
- "Details":
- "Program": "Google Update Helper"
- "Program": "Microsoft Excel MUI 2013"
- "Program": "Microsoft Outlook MUI 2013"
- "Program": "Google Chrome"
- "Program": "Adobe Flash Player 29 NPAPI"
- "Program": "Adobe Flash Player 29 ActiveX"
- "Program": "Microsoft DCF MUI 2013"
- "Program": "Microsoft Access MUI 2013"
- "Program": "Microsoft Office Proofing Tools 2013 - English"
- "Program": "Adobe Acrobat Reader DC"
- "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xef\\xbf\\xb1ol"
- "Program": "Microsoft Publisher MUI 2013"
- "Program": "Outils de v\\xef\\xbf\\xa9rification linguistique 2013 de Microsoft Office\\xef\\xbe\\xa0- Fran\\xef\\xbf\\xa7ais"
- "Program": "Microsoft Office Shared MUI 2013"
- "Program": "Microsoft Office OSM MUI 2013"
- "Program": "Microsoft InfoPath MUI 2013"
- "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
- "Program": "Microsoft Word MUI 2013"
- "Program": "Microsoft Groove MUI 2013"
- "Program": "Microsoft Access Setup Metadata MUI 2013"
- "Program": "Microsoft Office OSM UX MUI 2013"
- "Program": "Java Auto Updater"
- "Program": "Microsoft PowerPoint MUI 2013"
- "Program": "Microsoft Office Professional Plus 2013"
- "Program": "Adobe Refresh Manager"
- "Program": "Microsoft Office Proofing 2013"
- "Program": "Microsoft Lync MUI 2013"
- "Program": "Microsoft OneNote MUI 2013"
- "Description": "File has been identified by 35 Antiviruses on VirusTotal as malicious",
- "Details":
- "MicroWorld-eScan": "Trojan.GenericKD.32258183"
- "Qihoo-360": "HEUR/QVM10.2.2D43.Malware.Gen"
- "McAfee": "RDN/Generic.tfr"
- "Cylance": "Unsafe"
- "K7AntiVirus": "Trojan ( 00555e8d1 )"
- "K7GW": "Trojan ( 00555e8d1 )"
- "Cybereason": "malicious.6dbe35"
- "Symantec": "Packed.Generic.525"
- "ESET-NOD32": "a variant of Win32/Kryptik.GVMV"
- "APEX": "Malicious"
- "Avast": "Win32:Malware-gen"
- "Kaspersky": "UDS:DangerousObject.Multi.Generic"
- "BitDefender": "Trojan.GenericKD.32258183"
- "Paloalto": "generic.ml"
- "AegisLab": "Trojan.Multi.Generic.4!c"
- "Endgame": "malicious (high confidence)"
- "Sophos": "Mal/GandCrab-H"
- "F-Secure": "Trojan.TR/AD.PredatorThief.nre"
- "Invincea": "heuristic"
- "McAfee-GW-Edition": "BehavesLike.Win32.Generic.gh"
- "Emsisoft": "Trojan.GenericKD.41571670 (B)"
- "SentinelOne": "DFI - Malicious PE"
- "Avira": "TR/AD.PredatorThief.nre"
- "Microsoft": "Trojan:Win32/Skeeyah.A!MTB"
- "ZoneAlarm": "Trojan-PSW.Win32.Predator.bju"
- "GData": "Win32.Trojan.Agent.K4NG9F"
- "AhnLab-V3": "Trojan/Win32.MalPe.R286466"
- "Acronis": "suspicious"
- "VBA32": "BScope.Trojan.Chapak"
- "Malwarebytes": "Trojan.MalPack.GS"
- "Rising": "Trojan.Generic@ML.100 (RDML:Zxt7ULAre+uOeGDIv+X6Fg)"
- "Fortinet": "W32/Kryptik.GVMV!tr"
- "Ad-Aware": "Trojan.GenericKD.32258183"
- "AVG": "Win32:Malware-gen"
- "CrowdStrike": "win/malicious_confidence_90% (W)"
- "Description": "Checks the system manufacturer, likely for anti-virtualization",
- "Details":
- "Description": "Attempts to access Bitcoin/ALTCoin wallets",
- "Details":
- "file": "C:\\Users\\user\\AppData\\Roaming\\Electrum\\wallets"
- "Description": "Harvests credentials from local FTP client softwares",
- "Details":
- "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\sitemanager.xml"
- "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\recentservers.xml"
- "Description": "Harvests information related to installed instant messenger clients",
- "Details":
- "file": "C:\\Users\\user\\AppData\\Roaming\\.purple\\accounts.xml"
- "Description": "Harvests information related to installed mail clients",
- "Details":
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Server"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Server"
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
- * Started Service:
- "VaultSvc",
- "WerSvc",
- "W32Time"
- * Mutexes:
- "s3v9x9w8v7v9x9w8v7",
- "Local\\WERReportingForProcess1452",
- "Global\\\\xe5\\x88\\x90\\xc2\\x8f",
- "Global\\\\xed\\x95\\xb0\\x1b",
- "WERUI_BEX64-30ff788d55c8dd8e13e51cbc4a41a06fb37b455"
- * Modified Files:
- "C:\\Windows\\sysnative\\LogFiles\\Scm\\2ce1541b-c7b1-4ba0-8974-722d18a3c54d",
- "C:\\Windows\\sysnative\\LogFiles\\Scm\\4963ad21-c4a5-42a5-b9bd-e441d57204fe",
- "C:\\Windows\\sysnative\\LogFiles\\Scm\\7bbc503c-5977-4798-a4ae-61483a7e030d",
- "C:\\Windows\\sysnative\\LogFiles\\Scm\\1b711859-b045-4c59-9c08-78ceb138fe31",
- "\\??\\PIPE\\lsarpc",
- "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB52E.tmp.appcompat.txt",
- "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB965.tmp.WERInternalMetadata.xml",
- "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB976.tmp.hdmp",
- "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERC2BE.tmp.mdmp",
- "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_30ff788d55c8dd8e13e51cbc4a41a06fb37b455_cab_06a3ea06\\WERB52E.tmp.appcompat.txt",
- "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_30ff788d55c8dd8e13e51cbc4a41a06fb37b455_cab_06a3ea06\\WERB965.tmp.WERInternalMetadata.xml",
- "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_30ff788d55c8dd8e13e51cbc4a41a06fb37b455_cab_06a3ea06\\WERB976.tmp.hdmp",
- "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_30ff788d55c8dd8e13e51cbc4a41a06fb37b455_cab_06a3ea06\\WERC2BE.tmp.mdmp",
- "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_30ff788d55c8dd8e13e51cbc4a41a06fb37b455_cab_06a3ea06\\Report.wer",
- "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_30ff788d55c8dd8e13e51cbc4a41a06fb37b455_cab_06a3ea06\\Report.wer.tmp"
- * Deleted Files:
- "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB52E.tmp",
- "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB52E.tmp.appcompat.txt",
- "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB965.tmp",
- "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB965.tmp.WERInternalMetadata.xml",
- "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB976.tmp",
- "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB976.tmp.hdmp",
- "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERC2BE.tmp",
- "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERC2BE.tmp.mdmp",
- "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_30ff788d55c8dd8e13e51cbc4a41a06fb37b455_cab_06a3ea06\\Report.wer.tmp"
- * Modified Registry Keys:
- "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\Type",
- "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WerSvc\\Type",
- "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\TimeProviders\\NtpClient\\SpecialPollTimeRemaining",
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent",
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent"
- * Deleted Registry Keys:
- * DNS Communications:
- "type": "A",
- "request": "statexadver3552.club",
- "answers":
- "data": "5.101.180.213",
- "type": "A"
- * Domains:
- "ip": "5.101.180.213",
- "domain": "statexadver3552.club"
- * Network Communication - ICMP:
- "src": "217.159.211.202",
- "dst": "169.254.255.254
- "type": 3,
- "data": ""
- "src": "217.159.211.202",
- "dst": "169.254.255.254
- "type": 3,
- "data": ""
- "src": "217.159.211.202",
- "dst": "169.254.255.254
- "type": 3,
- "data": ""
- "src": "217.159.211.202",
- "dst": "169.254.255.254
- "type": 3,
- "data": ""
- "src": "217.159.211.202",
- "dst": "169.254.255.254
- "type": 3,
- "data": ""
- "src": "217.159.211.202",
- "dst": "169.254.255.254
- "type": 3,
- "data": ""
- * Network Communication - HTTP:
- * Network Communication - SMTP:
- * Network Communication - Hosts:
- * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement