API tools faq
paste
paladin316

Exes_7338b5bfedca98ec4fc567bf10726d0f_exe_2019-07-29_21_30.txt

paladin316
Jul 29th, 2019
2,106
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 31.29 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_7338b5bfedca98ec4fc567bf10726d0f.exe"
  7. * File Size: 1275185
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "e67fdccb5410647c06ae3f33ae976285b51e119ec904cae768ed6392f5a5fbd6"
  10. * MD5: "7338b5bfedca98ec4fc567bf10726d0f"
  11. * SHA1: "d9fa5309de66b6c6a9ed340080ccfbaa357a95e0"
  12. * SHA512: "530e42f0d5d358f5b5b2e1d3f1dfe61dd37574d75998665bd146ff9124e1d4ae81a4e69d5abeb914af201c9edcacbf0bfca3d229314f0d255ff38d108c5522cd"
  13. * CRC32: "AB147327"
  14. * SSDEEP: "24576:bNA3R5drXTLPdKVjGe6PaxaQ1lrcltwA/tw+ww8FHDbeisNIfTKPWBcH:G5PlewPa3itwsn8x6IOPWBy"
  15.  
  16. * Process Execution:
  17. "Exes_7338b5bfedca98ec4fc567bf10726d0f.exe",
  18. "wscript.exe",
  19. "frq.exe",
  20. "frq.exe",
  21. "RegSvcs.exe",
  22. "powershell.exe"
  23.  
  24.  
  25. * Executed Commands:
  26. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\wdg.vbs\"",
  27. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\wdg.vbs ",
  28. "\"C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\frq.exe\" mca=vqw",
  29. "frq.exe mca=vqw",
  30. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\frq.exe C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\QJJLA",
  31. "powershell Add-MpPreference -ExclusionPath C:\\"
  32.  
  33.  
  34. * Signatures Detected:
  35.  
  36. "Description": "Possible date expiration check, exits too soon after checking local time",
  37. "Details":
  38.  
  39. "process": "frq.exe, PID 1252"
  40.  
  41.  
  42.  
  43.  
  44. "Description": "Creates RWX memory",
  45. "Details":
  46.  
  47.  
  48. "Description": "Detected script timer window indicative of sleep style evasion",
  49. "Details":
  50.  
  51. "Window": "WSH-Timer"
  52.  
  53.  
  54.  
  55.  
  56. "Description": "Reads data out of its own binary image",
  57. "Details":
  58.  
  59. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00000000, length: 0x00000007"
  60.  
  61.  
  62. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00000000, length: 0x00002000"
  63.  
  64.  
  65. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00000007, length: 0x0013752a"
  66.  
  67.  
  68. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00001ff0, length: 0x00002000"
  69.  
  70.  
  71. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00003fe0, length: 0x00002000"
  72.  
  73.  
  74. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00005fd0, length: 0x00002000"
  75.  
  76.  
  77. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00007fc0, length: 0x00002000"
  78.  
  79.  
  80. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00009fb0, length: 0x00002000"
  81.  
  82.  
  83. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x0000bfa0, length: 0x00002000"
  84.  
  85.  
  86. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x0000df90, length: 0x00002000"
  87.  
  88.  
  89. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x0000ff80, length: 0x00002000"
  90.  
  91.  
  92. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00011f70, length: 0x00002000"
  93.  
  94.  
  95. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00013f60, length: 0x00002000"
  96.  
  97.  
  98. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00015f50, length: 0x00002000"
  99.  
  100.  
  101. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00017f40, length: 0x00002000"
  102.  
  103.  
  104. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00019f30, length: 0x00002000"
  105.  
  106.  
  107. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x0001bf20, length: 0x00002000"
  108.  
  109.  
  110. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x0001df10, length: 0x00002000"
  111.  
  112.  
  113. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x0001ff00, length: 0x00002000"
  114.  
  115.  
  116. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00021ef0, length: 0x00002000"
  117.  
  118.  
  119. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00023ee0, length: 0x00002000"
  120.  
  121.  
  122. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00025ed0, length: 0x00002000"
  123.  
  124.  
  125. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00027ec0, length: 0x00002000"
  126.  
  127.  
  128. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00029eb0, length: 0x00002000"
  129.  
  130.  
  131. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x0002bea0, length: 0x00002000"
  132.  
  133.  
  134. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x0002de90, length: 0x00002000"
  135.  
  136.  
  137. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x0002fe80, length: 0x00002000"
  138.  
  139.  
  140. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00031e70, length: 0x00002000"
  141.  
  142.  
  143. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00033e60, length: 0x00002000"
  144.  
  145.  
  146. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00035e50, length: 0x00002000"
  147.  
  148.  
  149. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00037e40, length: 0x00002000"
  150.  
  151.  
  152. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00039e30, length: 0x00002000"
  153.  
  154.  
  155. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x0003be20, length: 0x00002000"
  156.  
  157.  
  158. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x0003de10, length: 0x00002000"
  159.  
  160.  
  161. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x0003fe00, length: 0x00002000"
  162.  
  163.  
  164. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00041df0, length: 0x00002000"
  165.  
  166.  
  167. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00043de0, length: 0x00002000"
  168.  
  169.  
  170. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00045dd0, length: 0x00002000"
  171.  
  172.  
  173. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00047dc0, length: 0x00002000"
  174.  
  175.  
  176. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00049db0, length: 0x00002000"
  177.  
  178.  
  179. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x0004bda0, length: 0x00002000"
  180.  
  181.  
  182. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x0004dd90, length: 0x00002000"
  183.  
  184.  
  185. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x0004fd80, length: 0x00002000"
  186.  
  187.  
  188. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00050a00, length: 0x00000031"
  189.  
  190.  
  191. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00050a19, length: 0x000e3126"
  192.  
  193.  
  194. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00133d18, length: 0x00000028"
  195.  
  196.  
  197. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00133f0d, length: 0x00000028"
  198.  
  199.  
  200. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x001340f8, length: 0x00000028"
  201.  
  202.  
  203. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x001342c5, length: 0x00000028"
  204.  
  205.  
  206. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x001344d7, length: 0x00000028"
  207.  
  208.  
  209. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x001346ae, length: 0x00000028"
  210.  
  211.  
  212. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x0013487a, length: 0x00000028"
  213.  
  214.  
  215. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00134a48, length: 0x00000028"
  216.  
  217.  
  218. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00134c21, length: 0x00000028"
  219.  
  220.  
  221. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00134ded, length: 0x00000028"
  222.  
  223.  
  224. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00135006, length: 0x00000028"
  225.  
  226.  
  227. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x001351f0, length: 0x00000028"
  228.  
  229.  
  230. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00135400, length: 0x00000028"
  231.  
  232.  
  233. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00135616, length: 0x00000028"
  234.  
  235.  
  236. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x0013580a, length: 0x00000028"
  237.  
  238.  
  239. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x001359d4, length: 0x00000027"
  240.  
  241.  
  242. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00135bc4, length: 0x00000028"
  243.  
  244.  
  245. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00135d9d, length: 0x00000028"
  246.  
  247.  
  248. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00135f68, length: 0x00000028"
  249.  
  250.  
  251. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x0013612e, length: 0x00000028"
  252.  
  253.  
  254. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x001362f4, length: 0x00000028"
  255.  
  256.  
  257. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x001364cb, length: 0x00000028"
  258.  
  259.  
  260. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x001366b9, length: 0x00000028"
  261.  
  262.  
  263. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x0013688a, length: 0x00000028"
  264.  
  265.  
  266. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00136a68, length: 0x00000028"
  267.  
  268.  
  269. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00136c57, length: 0x00000028"
  270.  
  271.  
  272. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00136e52, length: 0x00000028"
  273.  
  274.  
  275. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00137089, length: 0x00000028"
  276.  
  277.  
  278. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x0013726d, length: 0x00000028"
  279.  
  280.  
  281. "self_read": "process: Exes_7338b5bfedca98ec4fc567bf10726d0f.exe, pid: 2916, offset: 0x00137476, length: 0x0000001b"
  282.  
  283.  
  284. "self_read": "process: wscript.exe, pid: 2384, offset: 0x00000000, length: 0x00000040"
  285.  
  286.  
  287. "self_read": "process: wscript.exe, pid: 2384, offset: 0x000000f0, length: 0x00000018"
  288.  
  289.  
  290. "self_read": "process: wscript.exe, pid: 2384, offset: 0x000001e8, length: 0x00000078"
  291.  
  292.  
  293. "self_read": "process: wscript.exe, pid: 2384, offset: 0x00018000, length: 0x00000020"
  294.  
  295.  
  296. "self_read": "process: wscript.exe, pid: 2384, offset: 0x00018058, length: 0x00000018"
  297.  
  298.  
  299. "self_read": "process: wscript.exe, pid: 2384, offset: 0x000181a8, length: 0x00000018"
  300.  
  301.  
  302. "self_read": "process: wscript.exe, pid: 2384, offset: 0x00018470, length: 0x00000010"
  303.  
  304.  
  305. "self_read": "process: wscript.exe, pid: 2384, offset: 0x00018640, length: 0x00000012"
  306.  
  307.  
  308.  
  309.  
  310. "Description": "Drops a binary and executes it",
  311. "Details":
  312.  
  313. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\frq.exe"
  314.  
  315.  
  316.  
  317.  
  318. "Description": "Executed a process and injected code into it, probably while unpacking",
  319. "Details":
  320.  
  321. "Injection": "frq.exe(2804) -> RegSvcs.exe(1764)"
  322.  
  323.  
  324.  
  325.  
  326. "Description": "Attempts to remove evidence of file being downloaded from the Internet",
  327. "Details":
  328.  
  329. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\:Zone.Identifier"
  330.  
  331.  
  332.  
  333.  
  334. "Description": "Installs itself for autorun at Windows startup",
  335. "Details":
  336.  
  337. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\qwertyujhgfdf.exe"
  338.  
  339.  
  340. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\frq.exe C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\MCA_VQ~1"
  341.  
  342.  
  343.  
  344.  
  345. "Description": "Creates a hidden or system file",
  346. "Details":
  347.  
  348. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\frq.exe"
  349.  
  350.  
  351. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\bur.jpg"
  352.  
  353.  
  354. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\cdt.jpg"
  355.  
  356.  
  357. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\cee.jpg"
  358.  
  359.  
  360. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\cla.pdf"
  361.  
  362.  
  363. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\cov.bmp"
  364.  
  365.  
  366. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\csp.dat"
  367.  
  368.  
  369. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\dcu.icm"
  370.  
  371.  
  372. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\dts.txt"
  373.  
  374.  
  375. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\dub.dat"
  376.  
  377.  
  378. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\esp.bmp"
  379.  
  380.  
  381. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\fbv.icm"
  382.  
  383.  
  384. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\fia.ppt"
  385.  
  386.  
  387. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\fpb.bmp"
  388.  
  389.  
  390. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\gfr.mp3"
  391.  
  392.  
  393. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\gjg.mp4"
  394.  
  395.  
  396. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\hjq.mp3"
  397.  
  398.  
  399. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\hkc.bmp"
  400.  
  401.  
  402. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\hld.jpg"
  403.  
  404.  
  405. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\ibh.ppt"
  406.  
  407.  
  408. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\jet.xl"
  409.  
  410.  
  411. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\jsa.xl"
  412.  
  413.  
  414. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\jsf.ppt"
  415.  
  416.  
  417. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\ken.jpg"
  418.  
  419.  
  420. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\kiv.xl"
  421.  
  422.  
  423. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\lgw.pdf"
  424.  
  425.  
  426. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\lhq.icm"
  427.  
  428.  
  429. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\ljq.bmp"
  430.  
  431.  
  432. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\lsf.ico"
  433.  
  434.  
  435. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\lwr.mp4"
  436.  
  437.  
  438. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\lxr.docx"
  439.  
  440.  
  441. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\mca=vqw"
  442.  
  443.  
  444. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\moi.mp4"
  445.  
  446.  
  447. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\nqt.xl"
  448.  
  449.  
  450. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\pdg.icm"
  451.  
  452.  
  453. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\pkn.ico"
  454.  
  455.  
  456. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\qfd.pdf"
  457.  
  458.  
  459. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\rbu.dat"
  460.  
  461.  
  462. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\rfe.icm"
  463.  
  464.  
  465. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\rjf.dat"
  466.  
  467.  
  468. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\rne.pdf"
  469.  
  470.  
  471. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\scg.bmp"
  472.  
  473.  
  474. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\sou.icm"
  475.  
  476.  
  477. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\ubl.pdf"
  478.  
  479.  
  480. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\uhe.ico"
  481.  
  482.  
  483. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\vib.txt"
  484.  
  485.  
  486. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\vvh.ico"
  487.  
  488.  
  489. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\wdg.vbs"
  490.  
  491.  
  492. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\xmk.mp3"
  493.  
  494.  
  495. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\xqq.pdf"
  496.  
  497.  
  498. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\xvc.bmp"
  499.  
  500.  
  501. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\43555320"
  502.  
  503.  
  504.  
  505.  
  506. "Description": "File has been identified by 40 Antiviruses on VirusTotal as malicious",
  507. "Details":
  508.  
  509. "MicroWorld-eScan": "Trojan.GenericKD.32159404"
  510.  
  511.  
  512. "McAfee": "Artemis!7338B5BFEDCA"
  513.  
  514.  
  515. "Cylance": "Unsafe"
  516.  
  517.  
  518. "Alibaba": "Trojan:Win32/Starter.ali2000005"
  519.  
  520.  
  521. "K7GW": "Riskware ( 0040eff71 )"
  522.  
  523.  
  524. "K7AntiVirus": "Riskware ( 0040eff71 )"
  525.  
  526.  
  527. "TrendMicro": "TROJ_GEN.R05FC0WGI19"
  528.  
  529.  
  530. "Symantec": "Trojan.Gen.MBT"
  531.  
  532.  
  533. "APEX": "Malicious"
  534.  
  535.  
  536. "Avast": "Win32:Malware-gen"
  537.  
  538.  
  539. "ClamAV": "Win.Malware.0040eff-7058212-0"
  540.  
  541.  
  542. "Kaspersky": "Trojan-Spy.Win32.AveMaria.blh"
  543.  
  544.  
  545. "BitDefender": "Trojan.GenericKD.32159404"
  546.  
  547.  
  548. "AegisLab": "Trojan.Win32.AveMaria.l!c"
  549.  
  550.  
  551. "Tencent": "Win32.Trojan-spy.Avemaria.Aexs"
  552.  
  553.  
  554. "Ad-Aware": "Trojan.GenericKD.32159404"
  555.  
  556.  
  557. "Emsisoft": "Trojan.GenericKD.32159404 (B)"
  558.  
  559.  
  560. "Comodo": "Malware@#1yolasd1rbk6"
  561.  
  562.  
  563. "Invincea": "heuristic"
  564.  
  565.  
  566. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  567.  
  568.  
  569. "FireEye": "Generic.mg.7338b5bfedca98ec"
  570.  
  571.  
  572. "Sophos": "Mal/Generic-S"
  573.  
  574.  
  575. "Paloalto": "generic.ml"
  576.  
  577.  
  578. "Cyren": "W32/Trojan.UYGV-3716"
  579.  
  580.  
  581. "Microsoft": "Trojan:Win32/Occamy.C"
  582.  
  583.  
  584. "Endgame": "malicious (high confidence)"
  585.  
  586.  
  587. "ViRobot": "Trojan.Win32.Z.Inject.1275185"
  588.  
  589.  
  590. "ZoneAlarm": "Trojan-Spy.Win32.AveMaria.blh"
  591.  
  592.  
  593. "GData": "Win32.Trojan.Agent.FUFX8Z"
  594.  
  595.  
  596. "AhnLab-V3": "Trojan/Win32.RL_Agent.R273974"
  597.  
  598.  
  599. "ALYac": "Trojan.GenericKD.32159404"
  600.  
  601.  
  602. "Zoner": "Probably RARAutorun"
  603.  
  604.  
  605. "ESET-NOD32": "Win32/Injector.Autoit.EDE"
  606.  
  607.  
  608. "TrendMicro-HouseCall": "TROJ_GEN.R05FC0WGI19"
  609.  
  610.  
  611. "Ikarus": "Trojan.Inject"
  612.  
  613.  
  614. "Fortinet": "AutoIt/Injector.EDE!tr"
  615.  
  616.  
  617. "AVG": "Win32:Malware-gen"
  618.  
  619.  
  620. "Cybereason": "malicious.9de66b"
  621.  
  622.  
  623. "CrowdStrike": "win/malicious_confidence_80% (W)"
  624.  
  625.  
  626. "Qihoo-360": "Win32/Trojan.Spy.3ac"
  627.  
  628.  
  629.  
  630.  
  631. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  632. "Details":
  633.  
  634. "target": "clamav:Win.Malware.0040eff-7058212-0, sha256:e67fdccb5410647c06ae3f33ae976285b51e119ec904cae768ed6392f5a5fbd6, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  635.  
  636.  
  637.  
  638.  
  639.  
  640. * Started Service:
  641.  
  642. * Mutexes:
  643. "DefaultTabtip-MainUI",
  644. "CicLoadWinStaWinSta0",
  645. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  646. "Local\\ZoneAttributeCacheCounterMutex",
  647. "Local\\ZonesCacheCounterMutex",
  648. "Local\\ZonesLockedCacheCounterMutex",
  649. "Global\\CLR_CASOFF_MUTEX"
  650.  
  651.  
  652. * Modified Files:
  653. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\__tmp_rar_sfx_access_check_27828453",
  654. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\cee.jpg",
  655. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\mca=vqw",
  656. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\wdg.vbs",
  657. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\frq.exe",
  658. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\qfd.pdf",
  659. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\gjg.mp4",
  660. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\fpb.bmp",
  661. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\kiv.xl",
  662. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\xmk.mp3",
  663. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\nqt.xl",
  664. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\rjf.dat",
  665. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\bur.jpg",
  666. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\hkc.bmp",
  667. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\ubl.pdf",
  668. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\scg.bmp",
  669. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\lxr.docx",
  670. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\rbu.dat",
  671. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\rne.pdf",
  672. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\hjq.mp3",
  673. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\lgw.pdf",
  674. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\jet.xl",
  675. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\dub.dat",
  676. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\rfe.icm",
  677. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\lsf.ico",
  678. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\dts.txt",
  679. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\lwr.mp4",
  680. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\fia.ppt",
  681. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\esp.bmp",
  682. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\vvh.ico",
  683. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\pkn.ico",
  684. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\cdt.jpg",
  685. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\hld.jpg",
  686. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\pdg.icm",
  687. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\jsf.ppt",
  688. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\csp.dat",
  689. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\fbv.icm",
  690. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\ljq.bmp",
  691. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\jsa.xl",
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\xvc.bmp",
  693. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\dcu.icm",
  694. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\uhe.ico",
  695. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\cov.bmp",
  696. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\sou.icm",
  697. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\moi.mp4",
  698. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\ken.jpg",
  699. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\lhq.icm",
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\cla.pdf",
  701. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\xqq.pdf",
  702. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\gfr.mp3",
  703. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\ibh.ppt",
  704. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\vib.txt",
  705. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\QJJLA",
  706. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  707. "\\??\\PIPE\\srvsvc",
  708. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\UCN7MGGMYV0PMZF3L6OK.temp",
  709. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms"
  710.  
  711.  
  712. * Deleted Files:
  713. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\__tmp_rar_sfx_access_check_27828453",
  714. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\QJJLA",
  715. "C:\\Users\\user\\AppData\\Local\\Temp\\43555320\\:Zone.Identifier",
  716. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\UCN7MGGMYV0PMZF3L6OK.temp",
  717. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1992.27928921",
  718. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1992.27928921",
  719. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1992.27928921"
  720.  
  721.  
  722. * Modified Registry Keys:
  723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  725. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  726. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\qwertyujhgfdf.exe",
  727. "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MediaResources\\msvideo",
  728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPer1_0Server",
  729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerServer",
  730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\IEEZTNQ9AF"
  731.  
  732.  
  733. * Deleted Registry Keys:
  734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  735. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  737. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  738.  
  739.  
  740. * DNS Communications:
  741.  
  742. "type": "A",
  743. "request": "benzkartel.duckdns.org",
  744. "answers":
  745.  
  746. "data": "192.169.69.25",
  747. "type": "A"
  748.  
  749.  
  750.  
  751.  
  752.  
  753. * Domains:
  754.  
  755. "ip": "192.169.69.25",
  756. "domain": "benzkartel.duckdns.org"
  757.  
  758.  
  759.  
  760. * Network Communication - ICMP:
  761.  
  762. * Network Communication - HTTP:
  763.  
  764. * Network Communication - SMTP:
  765.  
  766. * Network Communication - Hosts:
  767.  
  768. * Network Communication - IRC:
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!