API tools faq
paste
MalwareMustDie

File list clicked by password stealer dropped by Cridex troj

MalwareMustDie
Dec 15th, 2012
1,519
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.97 KB | None | 0 0
raw download clone embed print report
  1. // #MalwareMustDie - File list clicked by password stealer dropped by Cridex trojan:
  2. // base: https://www.virustotal.com/file/7546e60e2f215585f8102a5a08674b946c2affe478a88b4966695f6009e76a9c/analysis/
  3.  
  4. //Opened files...
  5.  
  6. \\.\PIPE\lsarpc (successful)
  7. C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\HWID (failed)
  8. C:\WINDOWS\wcx_ftp.ini (failed)
  9. C:\Documents and Settings\<USER>\wcx_ftp.ini (failed)
  10. C:\Documents and Settings\<USER>\Application Data\GHISLER\wcx_ftp.ini (failed)
  11. C:\Documents and Settings\All Users\Application Data\GHISLER\wcx_ftp.ini (failed)
  12. C:\Documents and Settings\<USER>\Local Settings\Application Data\GHISLER\wcx_ftp.ini (failed)
  13. C:\Documents and Settings\<USER>\Application Data\GlobalSCAPE\CuteFTP\sm.dat (failed)
  14. C:\Documents and Settings\<USER>\Application Data\GlobalSCAPE\CuteFTP Pro\sm.dat (failed)
  15. C:\Documents and Settings\<USER>\Application Data\GlobalSCAPE\CuteFTP Lite\sm.dat (failed)
  16. C:\Documents and Settings\<USER>\Application Data\CuteFTP\sm.dat (failed)
  17. C:\Documents and Settings\All Users\Application Data\GlobalSCAPE\CuteFTP\sm.dat (failed)
  18. C:\Documents and Settings\All Users\Application Data\GlobalSCAPE\CuteFTP Pro\sm.dat (failed)
  19. C:\Documents and Settings\All Users\Application Data\GlobalSCAPE\CuteFTP Lite\sm.dat (failed)
  20. C:\Documents and Settings\All Users\Application Data\CuteFTP\sm.dat (failed)
  21. C:\Documents and Settings\<USER>\Local Settings\Application Data\GlobalSCAPE\CuteFTP\sm.dat (failed)
  22. C:\Documents and Settings\<USER>\Local Settings\Application Data\GlobalSCAPE\CuteFTP Pro\sm.dat (failed)
  23. C:\Documents and Settings\<USER>\Local Settings\Application Data\GlobalSCAPE\CuteFTP Lite\sm.dat (failed)
  24. C:\Documents and Settings\<USER>\Local Settings\Application Data\CuteFTP\sm.dat (failed)
  25. C:\Program Files\GlobalSCAPE\CuteFTP\sm.dat (failed)
  26. C:\Program Files\GlobalSCAPE\CuteFTP Pro\sm.dat (failed)
  27. C:\Program Files\GlobalSCAPE\CuteFTP Lite\sm.dat (failed)
  28. C:\Program Files\CuteFTP\sm.dat (failed)
  29. C:\Documents and Settings\<USER>\Application Data\FlashFXP\3\Sites.dat (failed)
  30. C:\Documents and Settings\<USER>\Application Data\FlashFXP\4\Sites.dat (failed)
  31. C:\Documents and Settings\<USER>\Application Data\FlashFXP\3\Quick.dat (failed)
  32. C:\Documents and Settings\<USER>\Application Data\FlashFXP\4\Quick.dat (failed)
  33. C:\Documents and Settings\<USER>\Application Data\FlashFXP\3\History.dat (failed)
  34. C:\Documents and Settings\<USER>\Application Data\FlashFXP\4\History.dat (failed)
  35. C:\Documents and Settings\All Users\Application Data\FlashFXP\3\Sites.dat (failed)
  36. C:\Documents and Settings\All Users\Application Data\FlashFXP\4\Sites.dat (failed)
  37. C:\Documents and Settings\All Users\Application Data\FlashFXP\3\Quick.dat (failed)
  38. C:\Documents and Settings\All Users\Application Data\FlashFXP\4\Quick.dat (failed)
  39. C:\Documents and Settings\All Users\Application Data\FlashFXP\3\History.dat (failed)
  40. C:\Documents and Settings\All Users\Application Data\FlashFXP\4\History.dat (failed)
  41. C:\Documents and Settings\<USER>\Local Settings\Application Data\FlashFXP\3\Sites.dat (failed)
  42. C:\Documents and Settings\<USER>\Local Settings\Application Data\FlashFXP\4\Sites.dat (failed)
  43. C:\Documents and Settings\<USER>\Local Settings\Application Data\FlashFXP\3\Quick.dat (failed)
  44. C:\Documents and Settings\<USER>\Local Settings\Application Data\FlashFXP\4\Quick.dat (failed)
  45. C:\Documents and Settings\<USER>\Local Settings\Application Data\FlashFXP\3\History.dat (failed)
  46. C:\Documents and Settings\<USER>\Local Settings\Application Data\FlashFXP\4\History.dat (failed)
  47. C:\Documents and Settings\<USER>\Application Data\FileZilla\sitemanager.xml (failed)
  48. C:\Documents and Settings\<USER>\Application Data\FileZilla\recentservers.xml (failed)
  49. C:\Documents and Settings\<USER>\Application Data\FileZilla\filezilla.xml (failed)
  50. C:\Documents and Settings\All Users\Application Data\FileZilla\sitemanager.xml (failed)
  51. C:\Documents and Settings\All Users\Application Data\FileZilla\recentservers.xml (failed)
  52. C:\Documents and Settings\All Users\Application Data\FileZilla\filezilla.xml (failed)
  53. C:\Documents and Settings\<USER>\Local Settings\Application Data\FileZilla\sitemanager.xml (failed)
  54. C:\Documents and Settings\<USER>\Local Settings\Application Data\FileZilla\recentservers.xml (failed)
  55. C:\Documents and Settings\<USER>\Local Settings\Application Data\FileZilla\filezilla.xml (failed)
  56. C:\Documents and Settings\<USER>\Application Data\ExpanDrive\drives.js (failed)
  57. C:\Documents and Settings\<USER>\Local Settings\Application Data\ExpanDrive\drives.js (failed)
  58. C:\Documents and Settings\All Users\Application Data\ExpanDrive\drives.js (failed)
  59. C:\Documents and Settings\<USER>\Application Data\SharedSettings.ccs (failed)
  60. C:\Documents and Settings\<USER>\Application Data\SharedSettings.sqlite (failed)
  61. C:\Documents and Settings\<USER>\Application Data\SharedSettings_1_0_5.ccs (failed)
  62. C:\Documents and Settings\<USER>\Application Data\SharedSettings_1_0_5.sqlite (failed)
  63. C:\Documents and Settings\All Users\Application Data\SharedSettings.ccs (failed)
  64. C:\Documents and Settings\All Users\Application Data\SharedSettings.sqlite (failed)
  65. C:\Documents and Settings\All Users\Application Data\SharedSettings_1_0_5.ccs (failed)
  66. C:\Documents and Settings\All Users\Application Data\SharedSettings_1_0_5.sqlite (failed)
  67. C:\Documents and Settings\<USER>\Local Settings\Application Data\SharedSettings.ccs (failed)
  68. C:\Documents and Settings\<USER>\Local Settings\Application Data\SharedSettings.sqlite (failed)
  69. C:\Documents and Settings\<USER>\Local Settings\Application Data\SharedSettings_1_0_5.ccs (failed)
  70. C:\Documents and Settings\<USER>\Local Settings\Application Data\SharedSettings_1_0_5.sqlite (failed)
  71. C:\Documents and Settings\<USER>\Application Data\CoffeeCup Software\SharedSettings.ccs (failed)
  72. C:\Documents and Settings\<USER>\Application Data\CoffeeCup Software\SharedSettings.sqlite (failed)
  73. C:\Documents and Settings\<USER>\Application Data\CoffeeCup Software\SharedSettings_1_0_5.ccs (failed)
  74. C:\Documents and Settings\<USER>\Application Data\CoffeeCup Software\SharedSettings_1_0_5.sqlite (failed)
  75. C:\Documents and Settings\All Users\Application Data\CoffeeCup Software\SharedSettings.ccs (failed)
  76. C:\Documents and Settings\All Users\Application Data\CoffeeCup Software\SharedSettings.sqlite (failed)
  77. C:\Documents and Settings\All Users\Application Data\CoffeeCup Software\SharedSettings_1_0_5.ccs (failed)
  78. C:\Documents and Settings\All Users\Application Data\CoffeeCup Software\SharedSettings_1_0_5.sqlite (failed)
  79. C:\Documents and Settings\<USER>\Local Settings\Application Data\CoffeeCup Software\SharedSettings.ccs (failed)
  80. C:\Documents and Settings\<USER>\Local Settings\Application Data\CoffeeCup Software\SharedSettings.sqlite (failed)
  81. C:\Documents and Settings\<USER>\Local Settings\Application Data\CoffeeCup Software\SharedSettings_1_0_5.ccs (failed)
  82. C:\Documents and Settings\<USER>\Local Settings\Application Data\CoffeeCup Software\SharedSettings_1_0_5.sqlite (failed)
  83. C:\WINDOWS\32BitFtp.ini (failed)
  84. c:\autoexec.bat (successful)
  85. C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Client Hash (failed)
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!