upjnyh_msi_2019-07-11_13_30.txt

* MalFamily: ""

* MalScore: 10.0

* File Name: "upjnyh.msi"
* File Size: 1146880
* File Type: "Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 09:56:09 2012, Create Time/Date: Fri Sep 21 09:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: C35CF0AA-9B3F-4903-9F05-EBF606D58D3E Last Saved Time/Date: Tue May 21 11:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0"
* SHA256: "cf38bb4de5b3cb4a3dc19b3ea3138c4ae1d82ed0a12febb1510d2e43bf61d7b3"
* MD5: "fc1f1a02ddd2ed0b69f6be23417f9be7"
* SHA1: "183cab873cf0dedba414ed8240bde9a63975d565"
* SHA512: "7308a15991dc7e2194d8dbfba76a422887340765a7820b4a0eb855f6f8ccd86c6afd110b03174a7d7db4f1538a6809ace08fa34f75909ebd8b48a556e91e707d"
* CRC32: "859BC48C"
* SSDEEP: "24576:XEnthEVaPqLaB4yi2Lvj/+TLUD3cxJ3LOzCgKU8viKpPYBFRoR:XErEVUcamsvj/2LUD3c779vFZgbO"

* Process Execution:
    "msiexec.exe"


* Executed Commands:

* Signatures Detected:

        "Description": "File has been identified by 25 Antiviruses on VirusTotal as malicious",
        "Details":

                "Symantec": "Trojan.Gen.2"


                "ESET-NOD32": "a variant of MSIL/GenKryptik.DMRD"


                "Avast": "Win32:RATX-gen Trj"


                "ClamAV": "Win.Packed.LokiBot-6963314-0"


                "GData": "Gen:Variant.Ursu.527091 (2x)"


                "Kaspersky": "HEUR:Trojan.MSIL.Hesv.gen"


                "BitDefender": "AIT:Trojan.Nymeria.219"


                "NANO-Antivirus": "Trojan.Win32.Hesv.fstpgl"


                "AegisLab": "Trojan.MSIL.Hesv.4!c"


                "Sophos": "Mal/Generic-S"


                "F-Secure": "Trojan.TR/Kryptik.zetbi"


                "Invincea": "heuristic"


                "McAfee-GW-Edition": "Artemis!Trojan"


                "FireEye": "AIT:Trojan.Nymeria.219"


                "Emsisoft": "AIT:Trojan.Nymeria.219 (B)"


                "Cyren": "W32/Kryptik.QUZK-7259"


                "Avira": "TR/Kryptik.zetbi"


                "ZoneAlarm": "HEUR:Trojan.MSIL.Hesv.gen"


                "Microsoft": "Trojan:Win32/Fuerboos.C!cl"


                "AhnLab-V3": "Trojan/Win32.AutoIt.C2019675"


                "VBA32": "Trojan-Downloader.Autoit.gen"


                "MAX": "malware (ai score=100)"


                "Rising": "Attention.APT-Bait.ContainShellCode!1.9E28 (CLASSIC)"


                "Ikarus": "Trojan.Autoit"


                "AVG": "Win32:RATX-gen Trj"




        "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
        "Details":

                "target": "clamav:Win.Packed.LokiBot-6963314-0, sha256:cf38bb4de5b3cb4a3dc19b3ea3138c4ae1d82ed0a12febb1510d2e43bf61d7b3, type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 09:56:09 2012, Create Time/Date: Fri Sep 21 09:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: C35CF0AA-9B3F-4903-9F05-EBF606D58D3E Last Saved Time/Date: Tue May 21 11:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0"





* Started Service:

* Mutexes:
    "CicLoadWinStaWinSta0",
    "Local\\MSCTF.CtfMonitorInstMutexDefault1",
    "Global\\_MSIExecute"


* Modified Files:

* Deleted Files:

* Modified Registry Keys:

* Deleted Registry Keys:

* DNS Communications:

        "type": "A",
        "request": "vemvemserver.duckdns.org",
        "answers":

                "data": "205.185.125.42",
                "type": "A"





* Domains:

        "ip": "205.185.125.42",
        "domain": "vemvemserver.duckdns.org"



* Network Communication - ICMP:

* Network Communication - HTTP:

* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: