API tools faq
paste
paladin316

NanoCore_a25c69f3b426b921b0311356d9490bbc_exe_2019-08-03_15_30.txt

paladin316
Aug 3rd, 2019
2,550
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 31.50 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Nanocore"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "NanoCore_a25c69f3b426b921b0311356d9490bbc.exe"
  7. * File Size: 1449866
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "188579c07ebd44804da187905a88c8589695effb5e66d569923b75e017922bf2"
  10. * MD5: "a25c69f3b426b921b0311356d9490bbc"
  11. * SHA1: "f7e9f03943280b93b46cb310b520f0e11152bf03"
  12. * SHA512: "cc8a2c3b3c47ebfc35e2a56a74c9882add952b90f7917bd1e8edf45cc995a0ad4164d0f49f6f015e0bc9996995a49c10bccc28c7f86b28900b0c54a0c8fc78ff"
  13. * CRC32: "F83A2C1F"
  14. * SSDEEP: "24576:bNA3R5drXTLPdHk33orDGI30lb2sxWyKJHWyc9raVMK+aOzqLpgetDznFsiprSTU:G5PlOYrSQ5sx8JHTc9rqHOzcgsfFrrIe"
  15.  
  16. * Process Execution:
  17. "NanoCore_a25c69f3b426b921b0311356d9490bbc.exe",
  18. "wscript.exe",
  19. "uqw.exe",
  20. "uqw.exe",
  21. "RegSvcs.exe",
  22. "schtasks.exe",
  23. "svchost.exe"
  24.  
  25.  
  26. * Executed Commands:
  27. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\ktp.vbs\"",
  28. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\ktp.vbs ",
  29. "\"C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\uqw.exe\" phx=hvp",
  30. "uqw.exe phx=hvp",
  31. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\uqw.exe C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\VTJKY",
  32. "\"schtasks.exe\" /create /f /tn \"DSL Subsystem\" /xml \"C:\\Users\\user\\AppData\\Local\\Temp\\tmp7B21.tmp\""
  33.  
  34.  
  35. * Signatures Detected:
  36.  
  37. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  38. "Details":
  39.  
  40. "IP": "170.130.31.104:24700"
  41.  
  42.  
  43.  
  44.  
  45. "Description": "Possible date expiration check, exits too soon after checking local time",
  46. "Details":
  47.  
  48. "process": "uqw.exe, PID 2776"
  49.  
  50.  
  51.  
  52.  
  53. "Description": "Creates RWX memory",
  54. "Details":
  55.  
  56.  
  57. "Description": "Detected script timer window indicative of sleep style evasion",
  58. "Details":
  59.  
  60. "Window": "WSH-Timer"
  61.  
  62.  
  63.  
  64.  
  65. "Description": "A process attempted to delay the analysis task.",
  66. "Details":
  67.  
  68. "Process": "RegSvcs.exe tried to sleep 1145 seconds, actually delayed analysis time by 0 seconds"
  69.  
  70.  
  71. "Process": "svchost.exe tried to sleep 300 seconds, actually delayed analysis time by 0 seconds"
  72.  
  73.  
  74.  
  75.  
  76. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  77. "Details":
  78.  
  79. "ioc": "v2.0.50727"
  80.  
  81.  
  82.  
  83.  
  84. "Description": "Reads data out of its own binary image",
  85. "Details":
  86.  
  87. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00000000, length: 0x00000007"
  88.  
  89.  
  90. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00000000, length: 0x00002000"
  91.  
  92.  
  93. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00000007, length: 0x00161f83"
  94.  
  95.  
  96. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00001ff0, length: 0x00002000"
  97.  
  98.  
  99. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00003fe0, length: 0x00002000"
  100.  
  101.  
  102. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00005fd0, length: 0x00002000"
  103.  
  104.  
  105. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00007fc0, length: 0x00002000"
  106.  
  107.  
  108. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00009fb0, length: 0x00002000"
  109.  
  110.  
  111. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0000bfa0, length: 0x00002000"
  112.  
  113.  
  114. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0000df90, length: 0x00002000"
  115.  
  116.  
  117. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0000ff80, length: 0x00002000"
  118.  
  119.  
  120. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00011f70, length: 0x00002000"
  121.  
  122.  
  123. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00013f60, length: 0x00002000"
  124.  
  125.  
  126. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00015f50, length: 0x00002000"
  127.  
  128.  
  129. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00017f40, length: 0x00002000"
  130.  
  131.  
  132. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00019f30, length: 0x00002000"
  133.  
  134.  
  135. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0001bf20, length: 0x00002000"
  136.  
  137.  
  138. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0001df10, length: 0x00002000"
  139.  
  140.  
  141. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0001ff00, length: 0x00002000"
  142.  
  143.  
  144. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00021ef0, length: 0x00002000"
  145.  
  146.  
  147. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00023ee0, length: 0x00002000"
  148.  
  149.  
  150. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00025ed0, length: 0x00002000"
  151.  
  152.  
  153. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00027ec0, length: 0x00002000"
  154.  
  155.  
  156. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00029eb0, length: 0x00002000"
  157.  
  158.  
  159. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0002bea0, length: 0x00002000"
  160.  
  161.  
  162. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0002de90, length: 0x00002000"
  163.  
  164.  
  165. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0002fe80, length: 0x00002000"
  166.  
  167.  
  168. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00031e70, length: 0x00002000"
  169.  
  170.  
  171. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00033e60, length: 0x00002000"
  172.  
  173.  
  174. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00035e50, length: 0x00002000"
  175.  
  176.  
  177. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00037e40, length: 0x00002000"
  178.  
  179.  
  180. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00039e30, length: 0x00002000"
  181.  
  182.  
  183. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0003be20, length: 0x00002000"
  184.  
  185.  
  186. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0003de10, length: 0x00002000"
  187.  
  188.  
  189. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0003fe00, length: 0x00002000"
  190.  
  191.  
  192. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00041df0, length: 0x00002000"
  193.  
  194.  
  195. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00043de0, length: 0x00002000"
  196.  
  197.  
  198. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00045dd0, length: 0x00002000"
  199.  
  200.  
  201. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00047dc0, length: 0x00002000"
  202.  
  203.  
  204. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00049db0, length: 0x00002000"
  205.  
  206.  
  207. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0004bda0, length: 0x00002000"
  208.  
  209.  
  210. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0004dd90, length: 0x00002000"
  211.  
  212.  
  213. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0004fd80, length: 0x00002000"
  214.  
  215.  
  216. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00050a00, length: 0x00000031"
  217.  
  218.  
  219. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00050a19, length: 0x0010e8ec"
  220.  
  221.  
  222. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0015f4b8, length: 0x00000028"
  223.  
  224.  
  225. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0015f689, length: 0x00000028"
  226.  
  227.  
  228. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0015f89a, length: 0x00000028"
  229.  
  230.  
  231. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0015fa70, length: 0x00000028"
  232.  
  233.  
  234. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0015fc86, length: 0x00000027"
  235.  
  236.  
  237. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0015fe64, length: 0x00000028"
  238.  
  239.  
  240. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00160061, length: 0x00000028"
  241.  
  242.  
  243. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00160237, length: 0x00000028"
  244.  
  245.  
  246. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00160437, length: 0x00000028"
  247.  
  248.  
  249. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00160605, length: 0x00000028"
  250.  
  251.  
  252. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x001607e8, length: 0x00000028"
  253.  
  254.  
  255. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x001609c5, length: 0x00000028"
  256.  
  257.  
  258. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00160bac, length: 0x00000028"
  259.  
  260.  
  261. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00160d86, length: 0x00000028"
  262.  
  263.  
  264. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00160f60, length: 0x00000029"
  265.  
  266.  
  267. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0016114c, length: 0x00000028"
  268.  
  269.  
  270. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x0016133c, length: 0x00000029"
  271.  
  272.  
  273. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00161529, length: 0x00000027"
  274.  
  275.  
  276. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00161700, length: 0x00000028"
  277.  
  278.  
  279. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x001618ed, length: 0x00000028"
  280.  
  281.  
  282. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00161b07, length: 0x00000028"
  283.  
  284.  
  285. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00161cdd, length: 0x00000028"
  286.  
  287.  
  288. "self_read": "process: NanoCore_a25c69f3b426b921b0311356d9490bbc.exe, pid: 580, offset: 0x00161ed1, length: 0x0000001b"
  289.  
  290.  
  291. "self_read": "process: wscript.exe, pid: 1480, offset: 0x00000000, length: 0x00000040"
  292.  
  293.  
  294. "self_read": "process: wscript.exe, pid: 1480, offset: 0x000000f0, length: 0x00000018"
  295.  
  296.  
  297. "self_read": "process: wscript.exe, pid: 1480, offset: 0x000001e8, length: 0x00000078"
  298.  
  299.  
  300. "self_read": "process: wscript.exe, pid: 1480, offset: 0x00018000, length: 0x00000020"
  301.  
  302.  
  303. "self_read": "process: wscript.exe, pid: 1480, offset: 0x00018058, length: 0x00000018"
  304.  
  305.  
  306. "self_read": "process: wscript.exe, pid: 1480, offset: 0x000181a8, length: 0x00000018"
  307.  
  308.  
  309. "self_read": "process: wscript.exe, pid: 1480, offset: 0x00018470, length: 0x00000010"
  310.  
  311.  
  312. "self_read": "process: wscript.exe, pid: 1480, offset: 0x00018640, length: 0x00000012"
  313.  
  314.  
  315. "self_read": "process: RegSvcs.exe, pid: 2348, offset: 0x00000000, length: 0x00001000"
  316.  
  317.  
  318. "self_read": "process: RegSvcs.exe, pid: 2348, offset: 0x00000080, length: 0x00000200"
  319.  
  320.  
  321. "self_read": "process: RegSvcs.exe, pid: 2348, offset: 0x00000178, length: 0x00000200"
  322.  
  323.  
  324. "self_read": "process: RegSvcs.exe, pid: 2348, offset: 0x00005b20, length: 0x00000200"
  325.  
  326.  
  327. "self_read": "process: RegSvcs.exe, pid: 2348, offset: 0x00005b3c, length: 0x00000200"
  328.  
  329.  
  330.  
  331.  
  332. "Description": "A process created a hidden window",
  333. "Details":
  334.  
  335. "Process": "RegSvcs.exe -> \"schtasks.exe\" /create /f /tn \"DSL Subsystem\" /xml \"C:\\Users\\user\\AppData\\Local\\Temp\\tmp7B21.tmp\""
  336.  
  337.  
  338.  
  339.  
  340. "Description": "Drops a binary and executes it",
  341. "Details":
  342.  
  343. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\uqw.exe"
  344.  
  345.  
  346.  
  347.  
  348. "Description": "Executed a process and injected code into it, probably while unpacking",
  349. "Details":
  350.  
  351. "Injection": "uqw.exe(2380) -> RegSvcs.exe(2348)"
  352.  
  353.  
  354.  
  355.  
  356. "Description": "Attempts to remove evidence of file being downloaded from the Internet",
  357. "Details":
  358.  
  359. "file": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe:Zone.Identifier"
  360.  
  361.  
  362.  
  363.  
  364. "Description": "Attempts to execute a Living Off The Land Binary command for post exeploitation",
  365. "Details":
  366.  
  367. "MITRE T1078 - schtask": "(Tactic: Execution, Persistence, Privilege Escalation)"
  368.  
  369.  
  370.  
  371.  
  372. "Description": "Installs itself for autorun at Windows startup",
  373. "Details":
  374.  
  375. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate"
  376.  
  377.  
  378. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\uqw.exe C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\PHX_HV~1"
  379.  
  380.  
  381.  
  382.  
  383. "Description": "Exhibits behavior characteristic of Nanocore RAT",
  384. "Details":
  385.  
  386.  
  387. "Description": "Creates a hidden or system file",
  388. "Details":
  389.  
  390. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\uqw.exe"
  391.  
  392.  
  393. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\aca.docx"
  394.  
  395.  
  396. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\ada.docx"
  397.  
  398.  
  399. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\bae.mp4"
  400.  
  401.  
  402. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\bmq.jpg"
  403.  
  404.  
  405. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\cbm.jpg"
  406.  
  407.  
  408. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\ccn.icm"
  409.  
  410.  
  411. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\ddn.ico"
  412.  
  413.  
  414. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\dtx.mp3"
  415.  
  416.  
  417. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\eqw.icm"
  418.  
  419.  
  420. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\erb.ppt"
  421.  
  422.  
  423. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\gsw.mp4"
  424.  
  425.  
  426. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\hiw.ppt"
  427.  
  428.  
  429. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\ixs.mp4"
  430.  
  431.  
  432. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\jbu.pdf"
  433.  
  434.  
  435. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\jdq.bmp"
  436.  
  437.  
  438. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\ktp.vbs"
  439.  
  440.  
  441. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\mbl.icm"
  442.  
  443.  
  444. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\mph.txt"
  445.  
  446.  
  447. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\mqg.ppt"
  448.  
  449.  
  450. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\nge.xl"
  451.  
  452.  
  453. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\nri.icm"
  454.  
  455.  
  456. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\onq.xl"
  457.  
  458.  
  459. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\phx=hvp"
  460.  
  461.  
  462. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\pis.mp4"
  463.  
  464.  
  465. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\pkb.txt"
  466.  
  467.  
  468. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\pvf.ico"
  469.  
  470.  
  471. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\qeu.jpg"
  472.  
  473.  
  474. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\qhf.ppt"
  475.  
  476.  
  477. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\qlm.jpg"
  478.  
  479.  
  480. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\qow.mp4"
  481.  
  482.  
  483. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\qum.bmp"
  484.  
  485.  
  486. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\rfj.xl"
  487.  
  488.  
  489. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\rol.icm"
  490.  
  491.  
  492. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\sid.mp3"
  493.  
  494.  
  495. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\swa.mp4"
  496.  
  497.  
  498. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\tst.ico"
  499.  
  500.  
  501. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\tuv.mp4"
  502.  
  503.  
  504. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\ugg.xl"
  505.  
  506.  
  507. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\vmf.docx"
  508.  
  509.  
  510. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\vms.jpg"
  511.  
  512.  
  513. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\wmh.pdf"
  514.  
  515.  
  516. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\xfd.ico"
  517.  
  518.  
  519. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\xss.icm"
  520.  
  521.  
  522. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\11185820"
  523.  
  524.  
  525.  
  526.  
  527. "Description": "File has been identified by 32 Antiviruses on VirusTotal as malicious",
  528. "Details":
  529.  
  530. "MicroWorld-eScan": "Trojan.GenericKD.32208194"
  531.  
  532.  
  533. "FireEye": "Generic.mg.a25c69f3b426b921"
  534.  
  535.  
  536. "McAfee": "Artemis!A25C69F3B426"
  537.  
  538.  
  539. "Alibaba": "Trojan:Win32/Starter.ali2000005"
  540.  
  541.  
  542. "K7GW": "Riskware ( 0040eff71 )"
  543.  
  544.  
  545. "K7AntiVirus": "Riskware ( 0040eff71 )"
  546.  
  547.  
  548. "F-Prot": "W32/Autoit.ADJ"
  549.  
  550.  
  551. "Symantec": "Trojan.Gen.2"
  552.  
  553.  
  554. "APEX": "Malicious"
  555.  
  556.  
  557. "Paloalto": "generic.ml"
  558.  
  559.  
  560. "ClamAV": "Win.Malware.Autoit-7088500-0"
  561.  
  562.  
  563. "Kaspersky": "Backdoor.MSIL.NanoBot.atnj"
  564.  
  565.  
  566. "BitDefender": "Trojan.GenericKD.32208194"
  567.  
  568.  
  569. "AegisLab": "Trojan.BAT.Crypter.tqa8"
  570.  
  571.  
  572. "Ad-Aware": "Trojan.GenericKD.32208194"
  573.  
  574.  
  575. "Emsisoft": "Trojan.GenericKD.32208194 (B)"
  576.  
  577.  
  578. "Invincea": "heuristic"
  579.  
  580.  
  581. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  582.  
  583.  
  584. "Sophos": "Mal/Generic-S"
  585.  
  586.  
  587. "Cyren": "W32/Autoit.QZWK-0973"
  588.  
  589.  
  590. "Microsoft": "Trojan:Win32/Tiggre!plock"
  591.  
  592.  
  593. "Endgame": "malicious (high confidence)"
  594.  
  595.  
  596. "ZoneAlarm": "Backdoor.MSIL.NanoBot.atnj"
  597.  
  598.  
  599. "GData": "MSIL.Backdoor.Nancat.4HWA37"
  600.  
  601.  
  602. "AhnLab-V3": "Trojan/Win32.RL_Agent.R273974"
  603.  
  604.  
  605. "Malwarebytes": "Trojan.MalPack.AISFX"
  606.  
  607.  
  608. "Zoner": "Probably RARAutorun"
  609.  
  610.  
  611. "Yandex": "Trojan.Agent!nS7qVYN4VgU"
  612.  
  613.  
  614. "AVG": "FileRepMalware"
  615.  
  616.  
  617. "Cybereason": "malicious.943280"
  618.  
  619.  
  620. "CrowdStrike": "win/malicious_confidence_80% (W)"
  621.  
  622.  
  623. "Qihoo-360": "HEUR/QVM06.3.EAEB.Malware.Gen"
  624.  
  625.  
  626.  
  627.  
  628. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  629. "Details":
  630.  
  631. "target": "clamav:Win.Malware.Autoit-7088500-0, sha256:188579c07ebd44804da187905a88c8589695effb5e66d569923b75e017922bf2, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  632.  
  633.  
  634.  
  635.  
  636. "Description": "Collects information to fingerprint the system",
  637. "Details":
  638.  
  639.  
  640. "Description": "Created network traffic indicative of malicious activity",
  641. "Details":
  642.  
  643. "signature": "ET TROJAN Possible NanoCore C2 60B"
  644.  
  645.  
  646.  
  647.  
  648.  
  649. * Started Service:
  650.  
  651. * Mutexes:
  652. "DefaultTabtip-MainUI",
  653. "CicLoadWinStaWinSta0",
  654. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  655. "Local\\ZoneAttributeCacheCounterMutex",
  656. "Local\\ZonesCacheCounterMutex",
  657. "Local\\ZonesLockedCacheCounterMutex",
  658. "Global\\CLR_CASOFF_MUTEX",
  659. "Global\\e39e99e3-451a-4fba-9ff9-3242516312ee",
  660. "Global\\.net clr networking"
  661.  
  662.  
  663. * Modified Files:
  664. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\__tmp_rar_sfx_access_check_15212046",
  665. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\mph.txt",
  666. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\phx=hvp",
  667. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\ktp.vbs",
  668. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\uqw.exe",
  669. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\dtx.mp3",
  670. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\cbm.jpg",
  671. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\nge.xl",
  672. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\pvf.ico",
  673. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\sid.mp3",
  674. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\mqg.ppt",
  675. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\qeu.jpg",
  676. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\vmf.docx",
  677. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\qhf.ppt",
  678. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\erb.ppt",
  679. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\ixs.mp4",
  680. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\nri.icm",
  681. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\vms.jpg",
  682. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\hiw.ppt",
  683. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\tuv.mp4",
  684. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\bae.mp4",
  685. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\pkb.txt",
  686. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\onq.xl",
  687. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\qow.mp4",
  688. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\swa.mp4",
  689. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\mbl.icm",
  690. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\tst.ico",
  691. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\rfj.xl",
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\bmq.jpg",
  693. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\jbu.pdf",
  694. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\jdq.bmp",
  695. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\ccn.icm",
  696. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\eqw.icm",
  697. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\qum.bmp",
  698. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\rol.icm",
  699. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\gsw.mp4",
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\xfd.ico",
  701. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\aca.docx",
  702. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\qlm.jpg",
  703. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\ada.docx",
  704. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\ugg.xl",
  705. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\pis.mp4",
  706. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\ddn.ico",
  707. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\xss.icm",
  708. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\wmh.pdf",
  709. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\VTJKY",
  710. "C:\\Users\\user\\AppData\\Roaming\\C1515A12-1764-4632-ACE9-A9DFF9253200\\run.dat",
  711. "C:\\Users\\user\\AppData\\Local\\Temp\\tmp7B21.tmp",
  712. "C:\\Users\\user\\AppData\\Roaming\\C1515A12-1764-4632-ACE9-A9DFF9253200\\task.dat",
  713. "C:\\Users\\user\\AppData\\Roaming\\C1515A12-1764-4632-ACE9-A9DFF9253200\\catalog.dat",
  714. "C:\\Windows\\sysnative\\Tasks\\DSL Subsystem",
  715. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  716. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk"
  717.  
  718.  
  719. * Deleted Files:
  720. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\__tmp_rar_sfx_access_check_15212046",
  721. "C:\\Users\\user\\AppData\\Local\\Temp\\11185820\\VTJKY",
  722. "C:\\Users\\user\\AppData\\Local\\Temp\\tmp7B21.tmp",
  723. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe:Zone.Identifier",
  724. "C:\\Windows\\Tasks\\DSL Subsystem.job",
  725. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log"
  726.  
  727.  
  728. * Modified Registry Keys:
  729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  731. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  732. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate",
  733. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A3B84170-26E8-412F-AAD7-FA6C2D04C052\\Path",
  734. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A3B84170-26E8-412F-AAD7-FA6C2D04C052\\Hash",
  735. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\DSL Subsystem\\Id",
  736. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\DSL Subsystem\\Index",
  737. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A3B84170-26E8-412F-AAD7-FA6C2D04C052\\Triggers"
  738.  
  739.  
  740. * Deleted Registry Keys:
  741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  742. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  744. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  745. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\DSL Subsystem.job",
  746. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\DSL Subsystem.job.fp"
  747.  
  748.  
  749. * DNS Communications:
  750.  
  751. "type": "A",
  752. "request": "madmulla.duckdns.org",
  753. "answers":
  754.  
  755. "data": "170.130.31.104",
  756. "type": "A"
  757.  
  758.  
  759.  
  760.  
  761.  
  762. * Domains:
  763.  
  764. "ip": "170.130.31.104",
  765. "domain": "madmulla.duckdns.org"
  766.  
  767.  
  768.  
  769. * Network Communication - ICMP:
  770.  
  771. * Network Communication - HTTP:
  772.  
  773. * Network Communication - SMTP:
  774.  
  775. * Network Communication - Hosts:
  776.  
  777. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!