Exes_77fe24f9247f36f17c62ec39b770dfbc_exe_2019-07-15_12_30.txt

* MalFamily: ""

* MalScore: 10.0

* File Name: "Exes_77fe24f9247f36f17c62ec39b770dfbc.exe"
* File Size: 171008
* File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
* SHA256: "ce4877859b83eef6a955045f1f474238b9c5df9ea991623e4373f4a728e98f78"
* MD5: "77fe24f9247f36f17c62ec39b770dfbc"
* SHA1: "1a81df9eb8494230c8aeb19be64e25ccded7460a"
* SHA512: "ec5d7bbcd7b3d9e5b14b5e2677bdc7fbb7713f1189c81b655d701180457e8e3b52011604ce368d42dbc79974422d41472244828f90b95cea7e22b80d19052ce0"
* CRC32: "D70CA25A"
* SSDEEP: "3072:T9SVyZHsOe0lY63Q77Nlc4UKG+Q8baRYXyHIxCtOxv6Ik7WdMEskL:1Hfe0lrQ7Jojjk"

* Process Execution:
    "Exes_77fe24f9247f36f17c62ec39b770dfbc.exe",
    "svchost.exe"


* Executed Commands:
    "C:\\Windows\\svchost.exe "


* Signatures Detected:

        "Description": "Creates RWX memory",
        "Details":


        "Description": "Reads data out of its own binary image",
        "Details":

                "self_read": "process: Exes_77fe24f9247f36f17c62ec39b770dfbc.exe, pid: 1168, offset: 0x00000000, length: 0x00029c00"




        "Description": "Drops a binary and executes it",
        "Details":

                "binary": "C:\\Windows\\svchost.exe"




        "Description": "File has been identified by 44 Antiviruses on VirusTotal as malicious",
        "Details":

                "MicroWorld-eScan": "Gen:Variant.MSILPerseus.54726"


                "CAT-QuickHeal": "Backdoor.Bladabindi"


                "McAfee": "Packed-MR!77FE24F9247F"


                "K7GW": "Trojan ( 004d92531 )"


                "K7AntiVirus": "Trojan ( 004d92531 )"


                "NANO-Antivirus": "Trojan.Win32.Zapchast.egpzef"


                "ESET-NOD32": "a variant of MSIL/Kryptik.EOO"


                "TrendMicro-HouseCall": "TROJ_GEN.R002C0PI418"


                "Avast": "Win32:Rootkit-gen Rtk"


                "Kaspersky": "HEUR:Trojan-Ransom.Win32.Generic"


                "BitDefender": "Gen:Variant.MSILPerseus.54726"


                "Paloalto": "generic.ml"


                "Tencent": "Msil.Trojan.Zapchast.Akzm"


                "Ad-Aware": "Gen:Variant.MSILPerseus.54726"


                "Comodo": "Malware@#3bkmn6wlr1lyw"


                "F-Secure": "Heuristic.HEUR/AGEN.1008560"


                "DrWeb": "BackDoor.Bladabindi.13678"


                "Zillya": "Trojan.Kryptik.Win32.1219545"


                "Invincea": "heuristic"


                "McAfee-GW-Edition": "Packed-MR!77FE24F9247F"


                "Trapmine": "suspicious.low.ml.score"


                "Emsisoft": "Gen:Variant.MSILPerseus.54726 (B)"


                "Ikarus": "Trojan.SuspectCRC"


                "Jiangmin": "Trojan.MSIL.eazr"


                "Avira": "HEUR/AGEN.1008560"


                "Microsoft": "Backdoor:MSIL/Bladabindi"


                "Endgame": "malicious (high confidence)"


                "Arcabit": "Trojan.MSILPerseus.DD5C6"


                "AhnLab-V3": "Trojan/Win32.Zapchast.C1663824"


                "ZoneAlarm": "HEUR:Trojan-Ransom.Win32.Generic"


                "GData": "Gen:Variant.MSILPerseus.54726"


                "Acronis": "suspicious"


                "ALYac": "Gen:Variant.MSILPerseus.54726"


                "MAX": "malware (ai score=100)"


                "Rising": "Ransom.Generic!8.E315 (CLOUD)"


                "Yandex": "Trojan.Zapchast!gSCA26K51L0"


                "SentinelOne": "DFI - Malicious PE"


                "eGambit": "Generic.Malware"


                "Fortinet": "MSIL/Kryptik.EOO!tr"


                "AVG": "Win32:Rootkit-gen Rtk"


                "Cybereason": "malicious.9247f3"


                "Panda": "Trj/GdSda.A"


                "CrowdStrike": "win/malicious_confidence_100% (W)"


                "Qihoo-360": "Win32/Trojan.7b6"




        "Description": "Creates a copy of itself",
        "Details":

                "copy": "C:\\Windows\\svchost.exe"





* Started Service:

* Mutexes:
    "Global\\CLR_CASOFF_MUTEX",
    "f497dfd998155558ed591c65cb1136d5"


* Modified Files:
    "C:\\Users\\user\\AppData\\Local\\GDIPFONTCACHEV1.DAT",
    "C:\\Windows\\svchost.exe"


* Deleted Files:
    "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.1168.8255250",
    "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1168.8255250",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.1168.8255265"


* Modified Registry Keys:
    "HKEY_CURRENT_USER\\di"


* Deleted Registry Keys:

* DNS Communications:

* Domains:

* Network Communication - ICMP:

* Network Communication - HTTP:

* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: