rat_d77c741a702de185b397e9926e4b3ce2_exe_2019-08-03_20_30.txt

* MalFamily: "Bladabindi"

* MalScore: 10.0

* File Name: "rat_d77c741a702de185b397e9926e4b3ce2.exe"
* File Size: 24064
* File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
* SHA256: "e1578f5994f345bf51849dea792b89d4dd6436bcd88f149d50698d0f7c5ddb5d"
* MD5: "d77c741a702de185b397e9926e4b3ce2"
* SHA1: "cc6903862f990cfa4f0a1655bc571f7b8d5e732f"
* SHA512: "93c2715b7d809139d574e66d55b464cbb0a4125603a0597d81b96db09c9666bbfd4b89d1f088b95f58a1ee24031ddee5203c4a032884480ff67c3c803203b905"
* CRC32: "031F11CF"
* SSDEEP: "384:aI2SUCoQ3XgUzwsGCw5zSEZJgA6hgHpFChrV1mRvR6JZlbw8hqIusZzZEef:dNnzdwk8Rpcnui"

* Process Execution:
    "rat_d77c741a702de185b397e9926e4b3ce2.exe",
    "zles.exe",
    "netsh.exe",
    "svchost.exe",
    "WmiPrvSE.exe"


* Executed Commands:
    "C:\\Users\\user\\AppData\\Local\\Temp\\zles.exe ",
    "netsh firewall add allowedprogram \"C:\\Users\\user\\AppData\\Local\\Temp\\zles.exe\" \"zles.exe\" ENABLE",
    "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"


* Signatures Detected:

        "Description": "Creates RWX memory",
        "Details":


        "Description": "Reads data out of its own binary image",
        "Details":

                "self_read": "process: rat_d77c741a702de185b397e9926e4b3ce2.exe, pid: 1088, offset: 0x00000000, length: 0x00005e00"




        "Description": "Drops a binary and executes it",
        "Details":

                "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\zles.exe"




        "Description": "Anomalous .NET characteristics",
        "Details":

                "anomalous_version": "Assembly version is set to 0"




        "Description": "Sniffs keystrokes",
        "Details":

                "GetAsyncKeyState": "Process: zles.exe(3040)"




        "Description": "A process was set to shut the system down when terminated",
        "Details":

                "process": "zles.exe:3040"




        "Description": "Installs itself for autorun at Windows startup",
        "Details":

                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\27f0bc6dd472c236af90385c7a5579b1"


                "data": "\"C:\\Users\\user\\AppData\\Local\\Temp\\zles.exe\" .."


                "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\27f0bc6dd472c236af90385c7a5579b1"


                "data": "\"C:\\Users\\user\\AppData\\Local\\Temp\\zles.exe\" .."


                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\27f0bc6dd472c236af90385c7a5579b1.exe"


                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\27f0bc6dd472c236af90385c7a5579b1.exe"




        "Description": "Retrieves Windows ProductID, probably to fingerprint the sandbox",
        "Details":


        "Description": "File has been identified by 62 Antiviruses on VirusTotal as malicious",
        "Details":

                "MicroWorld-eScan": "Generic.MSIL.Bladabindi.3A5CD7D8"


                "FireEye": "Generic.mg.d77c741a702de185"


                "CAT-QuickHeal": "Backdoor.Bladabindi.AL3"


                "McAfee": "Trojan-FIGN"


                "Cylance": "Unsafe"


                "VIPRE": "Backdoor.MSIL.Bladabindi.a (v)"


                "SUPERAntiSpyware": "Trojan.Agent/Gen-Bladabindi"


                "Alibaba": "Backdoor:MSIL/Bladabindi.a71ce2e8"


                "K7GW": "Trojan ( 700000121 )"


                "K7AntiVirus": "Trojan ( 700000121 )"


                "Arcabit": "Generic.MSIL.Bladabindi.3A5CD7D8"


                "Invincea": "heuristic"


                "Baidu": "MSIL.Backdoor.Bladabindi.a"


                "F-Prot": "W32/MSIL_Bladabindi.AU.gen!Eldorado"


                "Symantec": "Backdoor.Ratenjay"


                "TotalDefense": "Win32/DotNetDl.A!generic"


                "APEX": "Malicious"


                "Paloalto": "generic.ml"


                "ClamAV": "Win.Trojan.B-468"


                "Kaspersky": "HEUR:Trojan.Win32.Generic"


                "BitDefender": "Generic.MSIL.Bladabindi.3A5CD7D8"


                "NANO-Antivirus": "Trojan.Win32.Disfa.dtznyx"


                "AegisLab": "Trojan.Win32.Generic.m0yY"


                "Avast": "MSIL:Agent-DRD Trj"


                "Tencent": "Win32.Trojan.Generic.Wrqi"


                "Ad-Aware": "Generic.MSIL.Bladabindi.3A5CD7D8"


                "Emsisoft": "Generic.MSIL.Bladabindi.3A5CD7D8 (B)"


                "Comodo": "Backdoor.MSIL.Bladabindi.A@566ygc"


                "F-Secure": "Trojan.TR/Dropper.Gen7"


                "DrWeb": "BackDoor.Bladabindi.13678"


                "Zillya": "Trojan.Disfa.Win32.11021"


                "TrendMicro": "BKDR_BLADABI.SMC"


                "McAfee-GW-Edition": "BehavesLike.Win32.Trojan.mm"


                "Sophos": "Troj/DotNet-P"


                "Ikarus": "Trojan.MSIL.Bladabindi"


                "Cyren": "W32/MSIL_Bladabindi.AU.gen!Eldorado"


                "Jiangmin": "TrojanDropper.Autoit.dce"


                "Avira": "TR/Dropper.Gen7"


                "MAX": "malware (ai score=83)"


                "Antiy-AVL": "TrojanBackdoor/MSIL.Bladabindi.as"


                "Microsoft": "Backdoor:MSIL/Bladabindi.B"


                "Endgame": "malicious (high confidence)"


                "ViRobot": "Backdoor.Win32.Bladabindi.Gen.A"


                "ZoneAlarm": "HEUR:Trojan.Win32.Generic"


                "GData": "MSIL.Backdoor.Bladabindi.AV"


                "AhnLab-V3": "Backdoor/Win32.Bladabindi.R91438"


                "Acronis": "suspicious"


                "VBA32": "Trojan.MSIL.Disfa"


                "ALYac": "Generic.MSIL.Bladabindi.3A5CD7D8"


                "Malwarebytes": "Backdoor.NJRat.Generic"


                "ESET-NOD32": "a variant of MSIL/Bladabindi.AS"


                "TrendMicro-HouseCall": "BKDR_BLADABI.SMC"


                "Rising": "Backdoor.MSIL.Bladabindi!1.9E49 (CLASSIC)"


                "Yandex": "Trojan.Agent!5bb0v0CCAo0"


                "SentinelOne": "DFI - Malicious PE"


                "eGambit": "Unsafe.AI_Score_98%"


                "Fortinet": "MSIL/Agent.LI!tr"


                "AVG": "MSIL:Agent-DRD Trj"


                "Cybereason": "malicious.a702de"


                "Panda": "Trj/GdSda.A"


                "CrowdStrike": "win/malicious_confidence_100% (W)"


                "Qihoo-360": "HEUR/QVM03.0.BC17.Malware.Gen"




        "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
        "Details":

                "target": "clamav:Win.Trojan.B-468, sha256:e1578f5994f345bf51849dea792b89d4dd6436bcd88f149d50698d0f7c5ddb5d, type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"


                "dropped": "clamav:Win.Trojan.B-468, sha256:e1578f5994f345bf51849dea792b89d4dd6436bcd88f149d50698d0f7c5ddb5d , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\zles.exe*C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\27f0bc6dd472c236af90385c7a5579b1.exe, type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"




        "Description": "Creates a copy of itself",
        "Details":

                "copy": "C:\\Users\\user\\AppData\\Local\\Temp\\zles.exe"


                "copy": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\27f0bc6dd472c236af90385c7a5579b1.exe"




        "Description": "Collects information to fingerprint the system",
        "Details":


        "Description": "Created network traffic indicative of malicious activity",
        "Details":

                "signature": "ET TROJAN Bladabindi/njRAT CnC Command (ll)"





* Started Service:

* Mutexes:
    "Global\\CLR_CASOFF_MUTEX",
    "27f0bc6dd472c236af90385c7a5579b1",
    "Global\\.net clr networking"


* Modified Files:
    "C:\\Users\\user\\AppData\\Local\\Temp\\zles.exe",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\27f0bc6dd472c236af90385c7a5579b1.exe",
    "\\Device\\Http\\Communication",
    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
    "\\??\\PIPE\\wkssvc",
    "\\??\\PIPE\\srvsvc"


* Deleted Files:
    "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1088.36222640",
    "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1088.36222640",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1088.36222656"


* Modified Registry Keys:
    "HKEY_CURRENT_USER\\di",
    "HKEY_CURRENT_USER\\Environment\\SEE_MASK_NOZONECHECKS",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\27f0bc6dd472c236af90385c7a5579b1",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\27f0bc6dd472c236af90385c7a5579b1",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\dhcpqec.dll,-100",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\dhcpqec.dll,-101",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\dhcpqec.dll,-103",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\dhcpqec.dll,-102",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\napipsec.dll,-1",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\napipsec.dll,-2",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\napipsec.dll,-4",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\napipsec.dll,-3",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\tsgqec.dll,-100",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\tsgqec.dll,-101",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\tsgqec.dll,-102",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\tsgqec.dll,-103",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\eapqec.dll,-100",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\eapqec.dll,-101",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\eapqec.dll,-102",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\eapqec.dll,-103"


* Deleted Registry Keys:

* DNS Communications:

* Domains:

* Network Communication - ICMP:

* Network Communication - HTTP:

* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: