API tools faq
paste
paladin316

rat_bdefc97be5a050d8af0b5becb3673827_exe_2019-08-06_08_30.txt

paladin316
Aug 6th, 2019
2,181
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 28.58 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "rat_bdefc97be5a050d8af0b5becb3673827.exe"
  7. * File Size: 1425244
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "fb151d49e80bd4cfafb78794b5330674da1c0d0a21016746ae448da319b17720"
  10. * MD5: "bdefc97be5a050d8af0b5becb3673827"
  11. * SHA1: "7176124fca2d519ad60cd779ac0d010ad9b82d14"
  12. * SHA512: "2325f89071f204ecf7c2fac6a388fd0f8a70811b7951cf0e57561910dc99254d372d240ab7211c6377efcc96cf0f08561cec4b8073ef3b07ed05e89078ac63dc"
  13. * CRC32: "45B4BA21"
  14. * SSDEEP: "24576:SNA3R5drXPWNg0HNa/3GVXliEY17ZfiyHa4F9l9eDbeibsRfGZojnTIa3M:r5mgcliEYjbF/9UbsR0a3M"
  15.  
  16. * Process Execution:
  17. "rat_bdefc97be5a050d8af0b5becb3673827.exe",
  18. "wscript.exe",
  19. "njq.exe",
  20. "njq.exe",
  21. "RegSvcs.exe"
  22.  
  23.  
  24. * Executed Commands:
  25. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\jtw.vbs\"",
  26. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\jtw.vbs ",
  27. "\"C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\njq.exe\" hiu=mdr",
  28. "njq.exe hiu=mdr",
  29. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\njq.exe C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\DSOQG"
  30.  
  31.  
  32. * Signatures Detected:
  33.  
  34. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  35. "Details":
  36.  
  37. "IP": "103.125.217.169:24007"
  38.  
  39.  
  40.  
  41.  
  42. "Description": "Possible date expiration check, exits too soon after checking local time",
  43. "Details":
  44.  
  45. "process": "njq.exe, PID 424"
  46.  
  47.  
  48.  
  49.  
  50. "Description": "Creates RWX memory",
  51. "Details":
  52.  
  53.  
  54. "Description": "Detected script timer window indicative of sleep style evasion",
  55. "Details":
  56.  
  57. "Window": "WSH-Timer"
  58.  
  59.  
  60.  
  61.  
  62. "Description": "A process attempted to delay the analysis task.",
  63. "Details":
  64.  
  65. "Process": "RegSvcs.exe tried to sleep 905 seconds, actually delayed analysis time by 0 seconds"
  66.  
  67.  
  68.  
  69.  
  70. "Description": "Expresses interest in specific running processes",
  71. "Details":
  72.  
  73. "process": "RegSvcs.exe"
  74.  
  75.  
  76.  
  77.  
  78. "Description": "Reads data out of its own binary image",
  79. "Details":
  80.  
  81. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00000000, length: 0x00000007"
  82.  
  83.  
  84. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00000000, length: 0x00002000"
  85.  
  86.  
  87. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00000007, length: 0x0015bf55"
  88.  
  89.  
  90. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00001ff0, length: 0x00002000"
  91.  
  92.  
  93. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00003fe0, length: 0x00002000"
  94.  
  95.  
  96. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00005fd0, length: 0x00002000"
  97.  
  98.  
  99. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00007fc0, length: 0x00002000"
  100.  
  101.  
  102. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00009fb0, length: 0x00002000"
  103.  
  104.  
  105. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0000bfa0, length: 0x00002000"
  106.  
  107.  
  108. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0000df90, length: 0x00002000"
  109.  
  110.  
  111. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0000ff80, length: 0x00002000"
  112.  
  113.  
  114. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00011f70, length: 0x00002000"
  115.  
  116.  
  117. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00013f60, length: 0x00002000"
  118.  
  119.  
  120. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00015f50, length: 0x00002000"
  121.  
  122.  
  123. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00017f40, length: 0x00002000"
  124.  
  125.  
  126. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00019f30, length: 0x00002000"
  127.  
  128.  
  129. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0001bf20, length: 0x00002000"
  130.  
  131.  
  132. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0001df10, length: 0x00002000"
  133.  
  134.  
  135. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0001ff00, length: 0x00002000"
  136.  
  137.  
  138. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00021ef0, length: 0x00002000"
  139.  
  140.  
  141. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00023ee0, length: 0x00002000"
  142.  
  143.  
  144. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00025ed0, length: 0x00002000"
  145.  
  146.  
  147. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00027ec0, length: 0x00002000"
  148.  
  149.  
  150. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00029eb0, length: 0x00002000"
  151.  
  152.  
  153. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0002bea0, length: 0x00002000"
  154.  
  155.  
  156. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0002de90, length: 0x00002000"
  157.  
  158.  
  159. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0002fe80, length: 0x00002000"
  160.  
  161.  
  162. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00031e70, length: 0x00002000"
  163.  
  164.  
  165. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00033e60, length: 0x00002000"
  166.  
  167.  
  168. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00035e50, length: 0x00002000"
  169.  
  170.  
  171. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00037e40, length: 0x00002000"
  172.  
  173.  
  174. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00039e30, length: 0x00002000"
  175.  
  176.  
  177. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0003be20, length: 0x00002000"
  178.  
  179.  
  180. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0003de10, length: 0x00002000"
  181.  
  182.  
  183. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0003fe00, length: 0x00002000"
  184.  
  185.  
  186. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00041df0, length: 0x00002000"
  187.  
  188.  
  189. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00043de0, length: 0x00002000"
  190.  
  191.  
  192. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00045dd0, length: 0x00002000"
  193.  
  194.  
  195. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00047dc0, length: 0x00002000"
  196.  
  197.  
  198. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00049db0, length: 0x00002000"
  199.  
  200.  
  201. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0004bda0, length: 0x00002000"
  202.  
  203.  
  204. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0004dd90, length: 0x00002000"
  205.  
  206.  
  207. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0004fd80, length: 0x00002000"
  208.  
  209.  
  210. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00051d70, length: 0x00002000"
  211.  
  212.  
  213. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00053d60, length: 0x00002000"
  214.  
  215.  
  216. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00055d50, length: 0x00002000"
  217.  
  218.  
  219. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00057d40, length: 0x00002000"
  220.  
  221.  
  222. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00059200, length: 0x00000032"
  223.  
  224.  
  225. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0005921a, length: 0x000ff8bf"
  226.  
  227.  
  228. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00158cb5, length: 0x00000028"
  229.  
  230.  
  231. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00158ef3, length: 0x00000028"
  232.  
  233.  
  234. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x001590d1, length: 0x00000028"
  235.  
  236.  
  237. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x001592ae, length: 0x00000027"
  238.  
  239.  
  240. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x001594a0, length: 0x00000028"
  241.  
  242.  
  243. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x001596bc, length: 0x00000028"
  244.  
  245.  
  246. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00159889, length: 0x00000028"
  247.  
  248.  
  249. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00159a71, length: 0x00000029"
  250.  
  251.  
  252. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00159c56, length: 0x00000028"
  253.  
  254.  
  255. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x00159e38, length: 0x00000028"
  256.  
  257.  
  258. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0015a00f, length: 0x00000027"
  259.  
  260.  
  261. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0015a21d, length: 0x00000028"
  262.  
  263.  
  264. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0015a40e, length: 0x00000028"
  265.  
  266.  
  267. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0015a617, length: 0x00000028"
  268.  
  269.  
  270. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0015a7e3, length: 0x00000028"
  271.  
  272.  
  273. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0015a9b7, length: 0x00000028"
  274.  
  275.  
  276. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0015ab83, length: 0x00000028"
  277.  
  278.  
  279. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0015ad66, length: 0x00000028"
  280.  
  281.  
  282. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0015af42, length: 0x00000028"
  283.  
  284.  
  285. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0015b11d, length: 0x00000028"
  286.  
  287.  
  288. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0015b2f5, length: 0x00000028"
  289.  
  290.  
  291. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0015b4c0, length: 0x00000028"
  292.  
  293.  
  294. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0015b6b7, length: 0x00000028"
  295.  
  296.  
  297. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0015b8b1, length: 0x00000028"
  298.  
  299.  
  300. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0015ba9d, length: 0x00000028"
  301.  
  302.  
  303. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0015bc7b, length: 0x00000028"
  304.  
  305.  
  306. "self_read": "process: rat_bdefc97be5a050d8af0b5becb3673827.exe, pid: 1212, offset: 0x0015be9f, length: 0x0000001b"
  307.  
  308.  
  309. "self_read": "process: wscript.exe, pid: 2420, offset: 0x00000000, length: 0x00000040"
  310.  
  311.  
  312. "self_read": "process: wscript.exe, pid: 2420, offset: 0x000000f0, length: 0x00000018"
  313.  
  314.  
  315. "self_read": "process: wscript.exe, pid: 2420, offset: 0x000001e8, length: 0x00000078"
  316.  
  317.  
  318. "self_read": "process: wscript.exe, pid: 2420, offset: 0x00018000, length: 0x00000020"
  319.  
  320.  
  321. "self_read": "process: wscript.exe, pid: 2420, offset: 0x00018058, length: 0x00000018"
  322.  
  323.  
  324. "self_read": "process: wscript.exe, pid: 2420, offset: 0x000181a8, length: 0x00000018"
  325.  
  326.  
  327. "self_read": "process: wscript.exe, pid: 2420, offset: 0x00018470, length: 0x00000010"
  328.  
  329.  
  330. "self_read": "process: wscript.exe, pid: 2420, offset: 0x00018640, length: 0x00000012"
  331.  
  332.  
  333.  
  334.  
  335. "Description": "Drops a binary and executes it",
  336. "Details":
  337.  
  338. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\njq.exe"
  339.  
  340.  
  341.  
  342.  
  343. "Description": "Executed a process and injected code into it, probably while unpacking",
  344. "Details":
  345.  
  346. "Injection": "njq.exe(2480) -> RegSvcs.exe(2280)"
  347.  
  348.  
  349.  
  350.  
  351. "Description": "Sniffs keystrokes",
  352. "Details":
  353.  
  354. "SetWindowsHookExA": "Process: RegSvcs.exe(2280)"
  355.  
  356.  
  357.  
  358.  
  359. "Description": "Installs itself for autorun at Windows startup",
  360. "Details":
  361.  
  362. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate"
  363.  
  364.  
  365. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\njq.exe C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\HIU_MD~1"
  366.  
  367.  
  368.  
  369.  
  370. "Description": "Creates a hidden or system file",
  371. "Details":
  372.  
  373. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\njq.exe"
  374.  
  375.  
  376. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\aej.icm"
  377.  
  378.  
  379. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\akw.bmp"
  380.  
  381.  
  382. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\boe.ico"
  383.  
  384.  
  385. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\bqw.xl"
  386.  
  387.  
  388. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\bwe.ico"
  389.  
  390.  
  391. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\cfp.jpg"
  392.  
  393.  
  394. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\cgw.mp4"
  395.  
  396.  
  397. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\cjv.jpg"
  398.  
  399.  
  400. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\cvh.dat"
  401.  
  402.  
  403. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\emc.mp3"
  404.  
  405.  
  406. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\euh.dat"
  407.  
  408.  
  409. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\gdp.dat"
  410.  
  411.  
  412. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\gmm.bmp"
  413.  
  414.  
  415. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\hiu=mdr"
  416.  
  417.  
  418. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\ino.ico"
  419.  
  420.  
  421. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\jho.mp4"
  422.  
  423.  
  424. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\jjr.mp3"
  425.  
  426.  
  427. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\jtq.txt"
  428.  
  429.  
  430. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\jtw.vbs"
  431.  
  432.  
  433. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\knj.jpg"
  434.  
  435.  
  436. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\krt.ico"
  437.  
  438.  
  439. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\ksl.ppt"
  440.  
  441.  
  442. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\lba.ppt"
  443.  
  444.  
  445. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\ldv.txt"
  446.  
  447.  
  448. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\lhu.icm"
  449.  
  450.  
  451. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\lkj.ico"
  452.  
  453.  
  454. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\mts.ico"
  455.  
  456.  
  457. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\mvd.pdf"
  458.  
  459.  
  460. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\nic.txt"
  461.  
  462.  
  463. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\noi.mp4"
  464.  
  465.  
  466. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\oas.bmp"
  467.  
  468.  
  469. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\oca.dat"
  470.  
  471.  
  472. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\oib.jpg"
  473.  
  474.  
  475. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\pds.xl"
  476.  
  477.  
  478. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\qrw.bmp"
  479.  
  480.  
  481. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\qvj.mp3"
  482.  
  483.  
  484. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\qwq.pdf"
  485.  
  486.  
  487. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\req.txt"
  488.  
  489.  
  490. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\rir.icm"
  491.  
  492.  
  493. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\sjl.dat"
  494.  
  495.  
  496. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\ujx.bmp"
  497.  
  498.  
  499. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\vvv.bmp"
  500.  
  501.  
  502. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\waf.icm"
  503.  
  504.  
  505. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\wcs.docx"
  506.  
  507.  
  508. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\wjf.xl"
  509.  
  510.  
  511. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\wmq.xl"
  512.  
  513.  
  514. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\xih.xl"
  515.  
  516.  
  517. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\51552840"
  518.  
  519.  
  520.  
  521.  
  522. "Description": "File has been identified by 19 Antiviruses on VirusTotal as malicious",
  523. "Details":
  524.  
  525. "FireEye": "Generic.mg.bdefc97be5a050d8"
  526.  
  527.  
  528. "K7GW": "Trojan ( 0055314e1 )"
  529.  
  530.  
  531. "K7AntiVirus": "Trojan ( 0055314e1 )"
  532.  
  533.  
  534. "APEX": "Malicious"
  535.  
  536.  
  537. "ClamAV": "Win.Malware.Autoit-7082918-0"
  538.  
  539.  
  540. "Kaspersky": "Trojan.Win32.Autoit.fnv"
  541.  
  542.  
  543. "AegisLab": "Trojan.BAT.Crypter.tqa8"
  544.  
  545.  
  546. "Invincea": "heuristic"
  547.  
  548.  
  549. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  550.  
  551.  
  552. "Ikarus": "Trojan.Inject"
  553.  
  554.  
  555. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  556.  
  557.  
  558. "ZoneAlarm": "Trojan.Win32.Autoit.fnv"
  559.  
  560.  
  561. "Zoner": "Probably RARAutorun"
  562.  
  563.  
  564. "ESET-NOD32": "Win32/Injector.Autoit.EDS"
  565.  
  566.  
  567. "Yandex": "Trojan.Agent!nS7qVYN4VgU"
  568.  
  569.  
  570. "Fortinet": "AutoIt/Injector.EDS!tr"
  571.  
  572.  
  573. "Cybereason": "malicious.fca2d5"
  574.  
  575.  
  576. "CrowdStrike": "win/malicious_confidence_80% (D)"
  577.  
  578.  
  579. "Qihoo-360": "HEUR/QVM10.1.0319.Malware.Gen"
  580.  
  581.  
  582.  
  583.  
  584. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  585. "Details":
  586.  
  587. "target": "clamav:Win.Malware.Autoit-7082918-0, sha256:fb151d49e80bd4cfafb78794b5330674da1c0d0a21016746ae448da319b17720, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  588.  
  589.  
  590.  
  591.  
  592.  
  593. * Started Service:
  594.  
  595. * Mutexes:
  596. "DefaultTabtip-MainUI",
  597. "CicLoadWinStaWinSta0",
  598. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  599. "Local\\ZoneAttributeCacheCounterMutex",
  600. "Local\\ZonesCacheCounterMutex",
  601. "Local\\ZonesLockedCacheCounterMutex",
  602. "Remcos_Mutex_Inj",
  603. "Remcos-LO81AZ"
  604.  
  605.  
  606. * Modified Files:
  607. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\__tmp_rar_sfx_access_check_11611250",
  608. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\qwq.pdf",
  609. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\hiu=mdr",
  610. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\jtw.vbs",
  611. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\njq.exe",
  612. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\req.txt",
  613. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\gdp.dat",
  614. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\vvv.bmp",
  615. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\boe.ico",
  616. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\bqw.xl",
  617. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\oas.bmp",
  618. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\ino.ico",
  619. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\noi.mp4",
  620. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\krt.ico",
  621. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\mts.ico",
  622. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\cfp.jpg",
  623. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\xih.xl",
  624. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\wmq.xl",
  625. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\emc.mp3",
  626. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\ujx.bmp",
  627. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\lkj.ico",
  628. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\oib.jpg",
  629. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\knj.jpg",
  630. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\cjv.jpg",
  631. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\oca.dat",
  632. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\sjl.dat",
  633. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\wjf.xl",
  634. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\bwe.ico",
  635. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\jtq.txt",
  636. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\akw.bmp",
  637. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\wcs.docx",
  638. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\mvd.pdf",
  639. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\qvj.mp3",
  640. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\pds.xl",
  641. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\cvh.dat",
  642. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\ksl.ppt",
  643. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\jho.mp4",
  644. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\lhu.icm",
  645. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\ldv.txt",
  646. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\jjr.mp3",
  647. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\gmm.bmp",
  648. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\aej.icm",
  649. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\waf.icm",
  650. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\cgw.mp4",
  651. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\rir.icm",
  652. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\qrw.bmp",
  653. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\euh.dat",
  654. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\nic.txt",
  655. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\lba.ppt",
  656. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\DSOQG",
  657. "C:\\Users\\user\\AppData\\Roaming\\remcos\\logs.dat"
  658.  
  659.  
  660. * Deleted Files:
  661. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\__tmp_rar_sfx_access_check_11611250",
  662. "C:\\Users\\user\\AppData\\Local\\Temp\\51552840\\DSOQG"
  663.  
  664.  
  665. * Modified Registry Keys:
  666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  668. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  669. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate",
  670. "HKEY_CURRENT_USER\\Software\\Remcos-LO81AZ\\",
  671. "HKEY_CURRENT_USER\\Software\\Remcos-LO81AZ\\exepath",
  672. "HKEY_CURRENT_USER\\Software\\Remcos-LO81AZ\\licence"
  673.  
  674.  
  675. * Deleted Registry Keys:
  676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  677. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  679. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  680.  
  681.  
  682. * DNS Communications:
  683.  
  684. "type": "A",
  685. "request": "jw94893.dynu.net",
  686. "answers":
  687.  
  688. "data": "103.125.217.169",
  689. "type": "A"
  690.  
  691.  
  692.  
  693.  
  694.  
  695. * Domains:
  696.  
  697. "ip": "103.125.217.169",
  698. "domain": "jw94893.dynu.net"
  699.  
  700.  
  701.  
  702. * Network Communication - ICMP:
  703.  
  704. * Network Communication - HTTP:
  705.  
  706. * Network Communication - SMTP:
  707.  
  708. * Network Communication - Hosts:
  709.  
  710. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!