Exes_0665e5a1c1a8b5ac1f78d6763e0576b9_msi_2019-07-09_08_30.txt

* MalFamily: ""

* MalScore: 10.0

* File Name: "Exes_0665e5a1c1a8b5ac1f78d6763e0576b9.msi"
* File Size: 454656
* File Type: "Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 09:56:09 2012, Create Time/Date: Fri Sep 21 09:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: C35CF0AA-9B3F-4903-9F05-EBF606D58D3E Last Saved Time/Date: Tue May 21 11:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0"
* SHA256: "1d0c2086c750b244de0541eded768d43d927f2fd512cdf0f168704921f81fb9f"
* MD5: "0665e5a1c1a8b5ac1f78d6763e0576b9"
* SHA1: "ac2402669226616686dcf872ae4edae1b15a59a3"
* SHA512: "e74f5286294c4550cb61aca3ea4ba0447c44b29688d2982586380fb52a3dd6eeef5ab148b17053028365dfb96f7c656bfefbd9da49aac1cae87bb47c1cd4a2f1"
* CRC32: "BB639966"
* SSDEEP: "12288:mER6Wq4aaE6KwyF5L0Y2D1PqLcV0OrtxjEjD:mEnthEVaPqL3ozEjD"

* Process Execution:
    "msiexec.exe"


* Executed Commands:

* Signatures Detected:

        "Description": "Performs some HTTP requests",
        "Details":

                "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"


                "url": "http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D"


                "url": "http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQAU7Bfe6xSRj1%2Bo83zCN%2BY2wTgIAQU1LD0%2FU%2BcQqRs3D0u7ltBGMmtA%2FYCEGbZBgaEG1afQkxO0Kqs%2FzU%3D"




        "Description": "File has been identified by 29 Antiviruses on VirusTotal as malicious",
        "Details":

                "FireEye": "AIT:Trojan.Nymeria.1006"


                "CAT-QuickHeal": "Trojanspy.Powershell"


                "McAfee": "RDN/Generic PWS.y"


                "Arcabit": "AIT:Trojan.Nymeria.D3EE"


                "TrendMicro": "TROJ_HPUTOTI.SMO"


                "Symantec": "Trojan.Gen.MBT"


                "TrendMicro-HouseCall": "TROJ_HPUTOTI.SMO"


                "Avast": "Win32:Trojan-gen"


                "ClamAV": "Win.Packed.LokiBot-6963314-0"


                "Kaspersky": "Trojan-Spy.PowerShell.KeyLogger.c"


                "BitDefender": "AIT:Trojan.Nymeria.1006"


                "NANO-Antivirus": "Trojan.Win32.PowerShell.fsmvaa"


                "Emsisoft": "AIT:Trojan.Nymeria.1006 (B)"


                "F-Secure": "Heuristic.HEUR/AGEN.1007116"


                "VIPRE": "Trojan.Win32.Generic!BT"


                "Invincea": "heuristic"


                "McAfee-GW-Edition": "RDN/Generic PWS.y"


                "Sophos": "Mal/Generic-S"


                "Cyren": "W32/Kryptik.QUZK-7259"


                "Microsoft": "PUA:Win32/Puamson.A!ml"


                "ZoneAlarm": "Trojan-Spy.PowerShell.KeyLogger.c"


                "GData": "AIT:Trojan.Nymeria.1006 (2x)"


                "AhnLab-V3": "Trojan/Win32.AutoIt.C2019675"


                "VBA32": "Trojan-Downloader.Autoit.gen"


                "MAX": "malware (ai score=87)"


                "ESET-NOD32": "a variant of Win32/Autoit.DB"


                "Rising": "Attention.APT-Bait.ContainShellCode!1.9E28 (CLASSIC)"


                "Ikarus": "Trojan.Autoit"


                "AVG": "Win32:Trojan-gen"




        "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
        "Details":

                "target": "clamav:Win.Packed.LokiBot-6963314-0, sha256:1d0c2086c750b244de0541eded768d43d927f2fd512cdf0f168704921f81fb9f, type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 09:56:09 2012, Create Time/Date: Fri Sep 21 09:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: C35CF0AA-9B3F-4903-9F05-EBF606D58D3E Last Saved Time/Date: Tue May 21 11:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0"





* Started Service:

* Mutexes:
    "CicLoadWinStaWinSta0",
    "Local\\MSCTF.CtfMonitorInstMutexDefault1"


* Modified Files:

* Deleted Files:

* Modified Registry Keys:

* Deleted Registry Keys:

* DNS Communications:

        "type": "A",
        "request": "ipapi.co",
        "answers":

                "data": "104.25.210.99",
                "type": "A"


                "data": "104.25.209.99",
                "type": "A"




        "type": "A",
        "request": "ocsp.comodoca4.com",
        "answers":

                "data": "t3j2g9x7.stackpathcdn.com",
                "type": "CNAME"


                "data": "151.139.128.14",
                "type": "A"




        "type": "A",
        "request": "vemvemserver.duckdns.org",
        "answers":

                "data": "205.185.125.42",
                "type": "A"





* Domains:

        "ip": "205.185.125.42",
        "domain": "vemvemserver.duckdns.org"


        "ip": "151.139.128.14",
        "domain": "ocsp.comodoca4.com"


        "ip": "104.25.210.99",
        "domain": "ipapi.co"



* Network Communication - ICMP:

* Network Communication - HTTP:

        "count": 1,
        "body": "",
        "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.usertrust.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
        "port": 80


        "count": 1,
        "body": "",
        "uri": "http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.comodoca4.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca4.com\r\n\r\n",
        "port": 80


        "count": 1,
        "body": "",
        "uri": "http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQAU7Bfe6xSRj1%2Bo83zCN%2BY2wTgIAQU1LD0%2FU%2BcQqRs3D0u7ltBGMmtA%2FYCEGbZBgaEG1afQkxO0Kqs%2FzU%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.comodoca4.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQAU7Bfe6xSRj1%2Bo83zCN%2BY2wTgIAQU1LD0%2FU%2BcQqRs3D0u7ltBGMmtA%2FYCEGbZBgaEG1afQkxO0Kqs%2FzU%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQAU7Bfe6xSRj1%2Bo83zCN%2BY2wTgIAQU1LD0%2FU%2BcQqRs3D0u7ltBGMmtA%2FYCEGbZBgaEG1afQkxO0Kqs%2FzU%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca4.com\r\n\r\n",
        "port": 80



* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: