API tools faq
paste
paladin316

Exes_e9e2884a33dfd642dffd258f94c999a7_exe_2019-07-23_09_30.txt

paladin316
Jul 23rd, 2019
2,101
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 41.67 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Sharik"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_e9e2884a33dfd642dffd258f94c999a7.exe"
  7. * File Size: 1298226
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "0bbece0b96b92a855570b6ebeacf963bd1cd6451b99778b2d703b99ed5c73f78"
  10. * MD5: "e9e2884a33dfd642dffd258f94c999a7"
  11. * SHA1: "6e0da363aa01ea9d2e8ebbd1590bb54f54fdbbb3"
  12. * SHA512: "46794f54c45fd85e6fe26d5289bc6cd3dd2a775cb1ddf0624eaf40a9637122069ebb436ccba1eb0a94747d89a75d50a4a83d1be71a1f85828d8710680f6e3d5c"
  13. * CRC32: "8940C67A"
  14. * SSDEEP: "24576:bNA3R5drXpdV1gkB8a/AXurveke1a4F9lPUFHGJYxGJH5SLMGw0nmd:G5XVSkKwAy2hbF/PUU+xsH5So4nm"
  15.  
  16. * Process Execution:
  17. "Exes_e9e2884a33dfd642dffd258f94c999a7.exe",
  18. "wscript.exe",
  19. "olk.exe",
  20. "olk.exe",
  21. "RegSvcs.exe",
  22. "wscript.exe",
  23. "olk.exe",
  24. "olk.exe",
  25. "RegSvcs.exe",
  26. "wscript.exe",
  27. "olk.exe",
  28. "olk.exe",
  29. "RegSvcs.exe",
  30. "explorer.exe",
  31. "explorer.exe",
  32. "explorer.exe",
  33. "explorer.exe",
  34. "explorer.exe",
  35. "explorer.exe",
  36. "cmd.exe",
  37. "explorer.exe",
  38. "services.exe",
  39. "svchost.exe",
  40. "taskhost.exe",
  41. "dwm.exe",
  42. "conhost.exe"
  43.  
  44.  
  45. * Executed Commands:
  46. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\sfx.vbs\"",
  47. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\sfx.vbs ",
  48. "\"C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\olk.exe\" ahl=xef",
  49. "olk.exe ahl=xef",
  50. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\olk.exe C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\YTJTH",
  51. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\run.vbs\"",
  52. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\run.vbs ",
  53. "C:\\Windows\\SysWOW64\\explorer.exe",
  54. "C:\\Windows\\explorer.exe",
  55. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\olk.exe C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\OCJCI",
  56. "C:\\Windows\\system32\\lsass.exe",
  57. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\olk.exe C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\RRKIT"
  58.  
  59.  
  60. * Signatures Detected:
  61.  
  62. "Description": "Attempts to connect to a dead IP:Port (2 unique times)",
  63. "Details":
  64.  
  65. "IP": "23.59.190.120:80"
  66.  
  67.  
  68. "IP": "47.254.215.29:80"
  69.  
  70.  
  71.  
  72.  
  73. "Description": "Possible date expiration check, exits too soon after checking local time",
  74. "Details":
  75.  
  76. "process": "olk.exe, PID 1952"
  77.  
  78.  
  79.  
  80.  
  81. "Description": "Creates RWX memory",
  82. "Details":
  83.  
  84.  
  85. "Description": "Detected script timer window indicative of sleep style evasion",
  86. "Details":
  87.  
  88. "Window": "WSH-Timer"
  89.  
  90.  
  91.  
  92.  
  93. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  94. "Details":
  95.  
  96. "ioc": "olk.exe-55903874724083"
  97.  
  98.  
  99. "ioc": "cript.exe-55903874722603"
  100.  
  101.  
  102. "ioc": "olk.exe-5590387473723"
  103.  
  104.  
  105. "ioc": "wm.exe-55903874719683"
  106.  
  107.  
  108. "ioc": "taskhost.exe-55903874713043"
  109.  
  110.  
  111. "ioc": "olk.exe-55903874711443"
  112.  
  113.  
  114. "ioc": "olk.exe-55903874711442"
  115.  
  116.  
  117. "ioc": "cmd.exe-5590387478683"
  118.  
  119.  
  120. "ioc": "conhost.exe-55903874711843"
  121.  
  122.  
  123.  
  124.  
  125. "Description": "Expresses interest in specific running processes",
  126. "Details":
  127.  
  128. "process": "lsm.exe"
  129.  
  130.  
  131. "process": "dwm.exe"
  132.  
  133.  
  134. "process": "RegSvcs.exe"
  135.  
  136.  
  137. "process": "taskhost.exe"
  138.  
  139.  
  140. "process": "System"
  141.  
  142.  
  143. "process": "csrss.exe"
  144.  
  145.  
  146. "process": "taskeng.exe"
  147.  
  148.  
  149. "process": "spoolsv.exe"
  150.  
  151.  
  152. "process": "smss.exe"
  153.  
  154.  
  155. "process": "wininit.exe"
  156.  
  157.  
  158. "process": "sppsvc.exe"
  159.  
  160.  
  161. "process": "mscorsvw.exe"
  162.  
  163.  
  164. "process": "lsass.exe"
  165.  
  166.  
  167. "process": "armsvc.exe"
  168.  
  169.  
  170. "process": "winlogon.exe"
  171.  
  172.  
  173. "process": "svchost.exe"
  174.  
  175.  
  176.  
  177.  
  178. "Description": "Repeatedly searches for a not-found process, may want to run with startbrowser=1 option",
  179. "Details":
  180.  
  181.  
  182. "Description": "Reads data out of its own binary image",
  183. "Details":
  184.  
  185. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00000000, length: 0x00000007"
  186.  
  187.  
  188. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00000000, length: 0x00002000"
  189.  
  190.  
  191. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00000007, length: 0x0013cf2b"
  192.  
  193.  
  194. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00001ff0, length: 0x00002000"
  195.  
  196.  
  197. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00003fe0, length: 0x00002000"
  198.  
  199.  
  200. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00005fd0, length: 0x00002000"
  201.  
  202.  
  203. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00007fc0, length: 0x00002000"
  204.  
  205.  
  206. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00009fb0, length: 0x00002000"
  207.  
  208.  
  209. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0000bfa0, length: 0x00002000"
  210.  
  211.  
  212. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0000df90, length: 0x00002000"
  213.  
  214.  
  215. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0000ff80, length: 0x00002000"
  216.  
  217.  
  218. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00011f70, length: 0x00002000"
  219.  
  220.  
  221. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00013f60, length: 0x00002000"
  222.  
  223.  
  224. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00015f50, length: 0x00002000"
  225.  
  226.  
  227. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00017f40, length: 0x00002000"
  228.  
  229.  
  230. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00019f30, length: 0x00002000"
  231.  
  232.  
  233. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0001bf20, length: 0x00002000"
  234.  
  235.  
  236. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0001df10, length: 0x00002000"
  237.  
  238.  
  239. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0001ff00, length: 0x00002000"
  240.  
  241.  
  242. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00021ef0, length: 0x00002000"
  243.  
  244.  
  245. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00023ee0, length: 0x00002000"
  246.  
  247.  
  248. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00025ed0, length: 0x00002000"
  249.  
  250.  
  251. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00027ec0, length: 0x00002000"
  252.  
  253.  
  254. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00029eb0, length: 0x00002000"
  255.  
  256.  
  257. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0002bea0, length: 0x00002000"
  258.  
  259.  
  260. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0002de90, length: 0x00002000"
  261.  
  262.  
  263. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0002fe80, length: 0x00002000"
  264.  
  265.  
  266. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00031e70, length: 0x00002000"
  267.  
  268.  
  269. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00033e60, length: 0x00002000"
  270.  
  271.  
  272. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00035e50, length: 0x00002000"
  273.  
  274.  
  275. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00037e40, length: 0x00002000"
  276.  
  277.  
  278. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00039e30, length: 0x00002000"
  279.  
  280.  
  281. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0003be20, length: 0x00002000"
  282.  
  283.  
  284. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0003de10, length: 0x00002000"
  285.  
  286.  
  287. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0003fe00, length: 0x00002000"
  288.  
  289.  
  290. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00041df0, length: 0x00002000"
  291.  
  292.  
  293. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00043de0, length: 0x00002000"
  294.  
  295.  
  296. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00045dd0, length: 0x00002000"
  297.  
  298.  
  299. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00047dc0, length: 0x00002000"
  300.  
  301.  
  302. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00049db0, length: 0x00002000"
  303.  
  304.  
  305. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0004bda0, length: 0x00002000"
  306.  
  307.  
  308. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0004dd90, length: 0x00002000"
  309.  
  310.  
  311. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0004fd80, length: 0x00002000"
  312.  
  313.  
  314. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00050a00, length: 0x00000032"
  315.  
  316.  
  317. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00050a1a, length: 0x000e920a"
  318.  
  319.  
  320. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00139de2, length: 0x00000028"
  321.  
  322.  
  323. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x00139fd7, length: 0x00000028"
  324.  
  325.  
  326. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013a21d, length: 0x00000028"
  327.  
  328.  
  329. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013a40f, length: 0x00000028"
  330.  
  331.  
  332. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013a5de, length: 0x00000028"
  333.  
  334.  
  335. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013a7c7, length: 0x00000028"
  336.  
  337.  
  338. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013a9a3, length: 0x00000027"
  339.  
  340.  
  341. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013ab97, length: 0x00000028"
  342.  
  343.  
  344. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013adae, length: 0x00000028"
  345.  
  346.  
  347. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013afa2, length: 0x00000028"
  348.  
  349.  
  350. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013b173, length: 0x00000028"
  351.  
  352.  
  353. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013b33e, length: 0x00000029"
  354.  
  355.  
  356. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013b550, length: 0x00000028"
  357.  
  358.  
  359. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013b720, length: 0x00000028"
  360.  
  361.  
  362. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013b8f3, length: 0x00000028"
  363.  
  364.  
  365. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013bac2, length: 0x00000028"
  366.  
  367.  
  368. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013bccb, length: 0x00000028"
  369.  
  370.  
  371. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013bec4, length: 0x00000028"
  372.  
  373.  
  374. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013c0a3, length: 0x00000027"
  375.  
  376.  
  377. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013c2b5, length: 0x00000028"
  378.  
  379.  
  380. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013c4d4, length: 0x00000028"
  381.  
  382.  
  383. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013c6bc, length: 0x00000028"
  384.  
  385.  
  386. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013c8bf, length: 0x00000027"
  387.  
  388.  
  389. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013ca94, length: 0x00000028"
  390.  
  391.  
  392. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013cca0, length: 0x00000028"
  393.  
  394.  
  395. "self_read": "process: Exes_e9e2884a33dfd642dffd258f94c999a7.exe, pid: 2988, offset: 0x0013ce75, length: 0x0000001b"
  396.  
  397.  
  398. "self_read": "process: wscript.exe, pid: 348, offset: 0x00000000, length: 0x00000040"
  399.  
  400.  
  401. "self_read": "process: wscript.exe, pid: 348, offset: 0x000000f0, length: 0x00000018"
  402.  
  403.  
  404. "self_read": "process: wscript.exe, pid: 348, offset: 0x000001e8, length: 0x00000078"
  405.  
  406.  
  407. "self_read": "process: wscript.exe, pid: 348, offset: 0x00018000, length: 0x00000020"
  408.  
  409.  
  410. "self_read": "process: wscript.exe, pid: 348, offset: 0x00018058, length: 0x00000018"
  411.  
  412.  
  413. "self_read": "process: wscript.exe, pid: 348, offset: 0x000181a8, length: 0x00000018"
  414.  
  415.  
  416. "self_read": "process: wscript.exe, pid: 348, offset: 0x00018470, length: 0x00000010"
  417.  
  418.  
  419. "self_read": "process: wscript.exe, pid: 348, offset: 0x00018640, length: 0x00000012"
  420.  
  421.  
  422. "self_read": "process: wscript.exe, pid: 2880, offset: 0x00000000, length: 0x00000040"
  423.  
  424.  
  425. "self_read": "process: wscript.exe, pid: 2880, offset: 0x000000f0, length: 0x00000018"
  426.  
  427.  
  428. "self_read": "process: wscript.exe, pid: 2880, offset: 0x000001e8, length: 0x00000078"
  429.  
  430.  
  431. "self_read": "process: wscript.exe, pid: 2880, offset: 0x00018000, length: 0x00000020"
  432.  
  433.  
  434. "self_read": "process: wscript.exe, pid: 2880, offset: 0x00018058, length: 0x00000018"
  435.  
  436.  
  437. "self_read": "process: wscript.exe, pid: 2880, offset: 0x000181a8, length: 0x00000018"
  438.  
  439.  
  440. "self_read": "process: wscript.exe, pid: 2880, offset: 0x00018470, length: 0x00000010"
  441.  
  442.  
  443. "self_read": "process: wscript.exe, pid: 2880, offset: 0x00018640, length: 0x00000012"
  444.  
  445.  
  446. "self_read": "process: wscript.exe, pid: 2260, offset: 0x00000000, length: 0x00000040"
  447.  
  448.  
  449. "self_read": "process: wscript.exe, pid: 2260, offset: 0x000000f0, length: 0x00000018"
  450.  
  451.  
  452. "self_read": "process: wscript.exe, pid: 2260, offset: 0x000001e8, length: 0x00000078"
  453.  
  454.  
  455. "self_read": "process: wscript.exe, pid: 2260, offset: 0x00018000, length: 0x00000020"
  456.  
  457.  
  458. "self_read": "process: wscript.exe, pid: 2260, offset: 0x00018058, length: 0x00000018"
  459.  
  460.  
  461. "self_read": "process: wscript.exe, pid: 2260, offset: 0x000181a8, length: 0x00000018"
  462.  
  463.  
  464. "self_read": "process: wscript.exe, pid: 2260, offset: 0x00018470, length: 0x00000010"
  465.  
  466.  
  467. "self_read": "process: wscript.exe, pid: 2260, offset: 0x00018640, length: 0x00000012"
  468.  
  469.  
  470.  
  471.  
  472. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  473. "Details":
  474.  
  475. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  476.  
  477.  
  478. "suspicious_request": "http://kingj4me5.xyz/zb/"
  479.  
  480.  
  481.  
  482.  
  483. "Description": "Performs some HTTP requests",
  484. "Details":
  485.  
  486. "url": "http://www.msftncsi.com/ncsi.txt"
  487.  
  488.  
  489. "url": "http://kingj4me5.xyz/zb/"
  490.  
  491.  
  492.  
  493.  
  494. "Description": "Executed a process and injected code into it, probably while unpacking",
  495. "Details":
  496.  
  497. "Injection": "olk.exe(2228) -> RegSvcs.exe(2568)"
  498.  
  499.  
  500.  
  501.  
  502. "Description": "Detects Sandboxie through the presence of a library",
  503. "Details":
  504.  
  505.  
  506. "Description": "Attempts to remove evidence of file being downloaded from the Internet",
  507. "Details":
  508.  
  509. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\tbtfsgew.exe:Zone.Identifier"
  510.  
  511.  
  512.  
  513.  
  514. "Description": "Tries to suspend Cuckoo threads to prevent logging of malicious activity",
  515. "Details":
  516.  
  517. "Process": "olk.exe (2408)"
  518.  
  519.  
  520.  
  521.  
  522. "Description": "Code injection with CreateRemoteThread in a remote process",
  523. "Details":
  524.  
  525. "Injection": "explorer.exe(2532) -> olk.exe(2408)"
  526.  
  527.  
  528.  
  529.  
  530. "Description": "Tries to unhook or modify Windows functions monitored by Cuckoo",
  531. "Details":
  532.  
  533. "unhook": "function_name: WSASend, type: modification"
  534.  
  535.  
  536. "unhook": "function_name: send, type: modification"
  537.  
  538.  
  539.  
  540.  
  541. "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
  542. "Details":
  543.  
  544. "regkeyval": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage2\\ProgramsCache"
  545.  
  546.  
  547.  
  548.  
  549. "Description": "Installs itself for autorun at Windows startup",
  550. "Details":
  551.  
  552. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate"
  553.  
  554.  
  555. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\olk.exe C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\AHL_XE~1"
  556.  
  557.  
  558. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\04962900"
  559.  
  560.  
  561. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\start.vbs"
  562.  
  563.  
  564. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\start.lnk"
  565.  
  566.  
  567. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\hviticat.lnk"
  568.  
  569.  
  570.  
  571.  
  572. "Description": "Creates a hidden or system file",
  573. "Details":
  574.  
  575. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\olk.exe"
  576.  
  577.  
  578. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\ahl=xef"
  579.  
  580.  
  581. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\arf.bmp"
  582.  
  583.  
  584. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\aug.ppt"
  585.  
  586.  
  587. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\bhe.icm"
  588.  
  589.  
  590. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\cbo.mp3"
  591.  
  592.  
  593. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\chs.icm"
  594.  
  595.  
  596. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\det.bmp"
  597.  
  598.  
  599. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\dtw.ico"
  600.  
  601.  
  602. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\egr.icm"
  603.  
  604.  
  605. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\epv.mp4"
  606.  
  607.  
  608. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\esg.xl"
  609.  
  610.  
  611. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\fwa.ico"
  612.  
  613.  
  614. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\fwc.mp4"
  615.  
  616.  
  617. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\fxn.icm"
  618.  
  619.  
  620. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\gsj.mp3"
  621.  
  622.  
  623. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\gwq.pdf"
  624.  
  625.  
  626. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\hnt.pdf"
  627.  
  628.  
  629. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\huv.pdf"
  630.  
  631.  
  632. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\ihq.txt"
  633.  
  634.  
  635. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\isg.ppt"
  636.  
  637.  
  638. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\itt.ppt"
  639.  
  640.  
  641. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\ivd.jpg"
  642.  
  643.  
  644. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\jlj.xl"
  645.  
  646.  
  647. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\jnl.ppt"
  648.  
  649.  
  650. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\jon.docx"
  651.  
  652.  
  653. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\luf.mp4"
  654.  
  655.  
  656. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\mjq.pdf"
  657.  
  658.  
  659. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\mrm.pdf"
  660.  
  661.  
  662. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\nqu.xl"
  663.  
  664.  
  665. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\nrv.jpg"
  666.  
  667.  
  668. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\ojr.xl"
  669.  
  670.  
  671. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\orc.icm"
  672.  
  673.  
  674. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\oxm.jpg"
  675.  
  676.  
  677. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\qhm.pdf"
  678.  
  679.  
  680. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\qqo.txt"
  681.  
  682.  
  683. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\rvm.bmp"
  684.  
  685.  
  686. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\rxt.icm"
  687.  
  688.  
  689. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\sfx.vbs"
  690.  
  691.  
  692. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\skk.dat"
  693.  
  694.  
  695. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\slb.mp3"
  696.  
  697.  
  698. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\sma.jpg"
  699.  
  700.  
  701. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\uak.xl"
  702.  
  703.  
  704. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\vts.mp4"
  705.  
  706.  
  707. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\wus.jpg"
  708.  
  709.  
  710. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\xmf.dat"
  711.  
  712.  
  713. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\xmp.dat"
  714.  
  715.  
  716. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900"
  717.  
  718.  
  719. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\tbtfsgew.exe"
  720.  
  721.  
  722. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat"
  723.  
  724.  
  725. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\hviticat"
  726.  
  727.  
  728. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\ini"
  729.  
  730.  
  731. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\run.vbs"
  732.  
  733.  
  734. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\start.cmd"
  735.  
  736.  
  737. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\start.vbs"
  738.  
  739.  
  740.  
  741.  
  742. "Description": "File has been identified by 29 Antiviruses on VirusTotal as malicious",
  743. "Details":
  744.  
  745. "MicroWorld-eScan": "Trojan.GenericKD.41489996"
  746.  
  747.  
  748. "FireEye": "Generic.mg.e9e2884a33dfd642"
  749.  
  750.  
  751. "McAfee": "Artemis!E9E2884A33DF"
  752.  
  753.  
  754. "K7AntiVirus": "Riskware ( 0040eff71 )"
  755.  
  756.  
  757. "K7GW": "Riskware ( 0040eff71 )"
  758.  
  759.  
  760. "Cybereason": "malicious.3aa01e"
  761.  
  762.  
  763. "Arcabit": "Trojan.Generic.D279164C"
  764.  
  765.  
  766. "APEX": "Malicious"
  767.  
  768.  
  769. "ClamAV": "Win.Dropper.Fakexls-7058214-0"
  770.  
  771.  
  772. "Kaspersky": "Trojan.Win32.Propagate.mdy"
  773.  
  774.  
  775. "BitDefender": "Trojan.GenericKD.41489996"
  776.  
  777.  
  778. "Ad-Aware": "Trojan.GenericKD.41489996"
  779.  
  780.  
  781. "Emsisoft": "Trojan.GenericKD.41489996 (B)"
  782.  
  783.  
  784. "Invincea": "heuristic"
  785.  
  786.  
  787. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  788.  
  789.  
  790. "Paloalto": "generic.ml"
  791.  
  792.  
  793. "Avira": "TR/Autoit.rtyvv"
  794.  
  795.  
  796. "MAX": "malware (ai score=82)"
  797.  
  798.  
  799. "Microsoft": "Trojan:Win32/Fuery.C!cl"
  800.  
  801.  
  802. "Endgame": "malicious (high confidence)"
  803.  
  804.  
  805. "ZoneAlarm": "Trojan.Win32.Propagate.mdy"
  806.  
  807.  
  808. "GData": "Trojan.GenericKD.41489996"
  809.  
  810.  
  811. "AhnLab-V3": "Malware/Win32.Generic.C3338047"
  812.  
  813.  
  814. "Zoner": "Probably RARAutorun"
  815.  
  816.  
  817. "ESET-NOD32": "Win32/Injector.Autoit.EDS"
  818.  
  819.  
  820. "Ikarus": "Trojan.Inject"
  821.  
  822.  
  823. "Fortinet": "AutoIt/Injector.EDS!tr"
  824.  
  825.  
  826. "CrowdStrike": "win/malicious_confidence_100% (D)"
  827.  
  828.  
  829. "Qihoo-360": "HEUR/QVM10.1.B335.Malware.Gen"
  830.  
  831.  
  832.  
  833.  
  834. "Description": "Checks the presence of disk drives in the registry, possibly for anti-virtualization",
  835. "Details":
  836.  
  837.  
  838. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  839. "Details":
  840.  
  841. "target": "clamav:Win.Dropper.Fakexls-7058214-0, sha256:0bbece0b96b92a855570b6ebeacf963bd1cd6451b99778b2d703b99ed5c73f78, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  842.  
  843.  
  844.  
  845.  
  846. "Description": "Harvests information related to installed mail clients",
  847. "Details":
  848.  
  849. "file": "C:\\Users\\user\\Documents\\Outlook Files\\Outlook.pst"
  850.  
  851.  
  852.  
  853.  
  854. "Description": "Created network traffic indicative of malicious activity",
  855. "Details":
  856.  
  857. "signature": "ET TROJAN Sharik/Smoke CnC Beacon 7"
  858.  
  859.  
  860.  
  861.  
  862.  
  863. * Started Service:
  864.  
  865. * Mutexes:
  866. "DefaultTabtip-MainUI",
  867. "CicLoadWinStaWinSta0",
  868. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  869. "Local\\ZoneAttributeCacheCounterMutex",
  870. "Local\\ZonesCacheCounterMutex",
  871. "Local\\ZonesLockedCacheCounterMutex",
  872. "7E8C820C05FE53DA70B24D931AD9346CC1C5B64F",
  873. "0440B5C82D5A6CE49A9518567783A13A",
  874. "opera_shared_counter",
  875. "CFA1A52F2D72120D86493C49D55A126E",
  876. "D28CCEE8D946381A04EC9F6342436965",
  877. "opera_shared_counter64",
  878. "9BF03F1F979831EA60ED8F68E878B3EC",
  879. "1F04C47D97A4E0C2E492457C0C8E99E3",
  880. "FC373693D9A68FE6C8A57648A2FFB927",
  881. "546165F881DC8D58C55E3DC2E747EBE9",
  882. "EF0F7F744A0B3DF346EDD51C304A6C60",
  883. "90627F6585354C4D0987F8FACC540FD5"
  884.  
  885.  
  886. * Modified Files:
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\__tmp_rar_sfx_access_check_2011828",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\bhe.icm",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\ahl=xef",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\sfx.vbs",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\olk.exe",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\nrv.jpg",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\ihq.txt",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\aug.ppt",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\oxm.jpg",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\luf.mp4",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\mjq.pdf",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\jlj.xl",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\xmf.dat",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\itt.ppt",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\epv.mp4",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\slb.mp3",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\orc.icm",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\esg.xl",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\hnt.pdf",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\sma.jpg",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\isg.ppt",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\cbo.mp3",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\det.bmp",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\dtw.ico",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\huv.pdf",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\qhm.pdf",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\fwa.ico",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\vts.mp4",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\qqo.txt",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\ojr.xl",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\ivd.jpg",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\rxt.icm",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\wus.jpg",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\mrm.pdf",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\jon.docx",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\skk.dat",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\xmp.dat",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\arf.bmp",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\rvm.bmp",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\fwc.mp4",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\fxn.icm",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\nqu.xl",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\gsj.mp3",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\chs.icm",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\egr.icm",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\uak.xl",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\jnl.ppt",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\gwq.pdf",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\YTJTH",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\ini",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\start.vbs",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\start.cmd",
  939. "\\??\\PIPE\\srvsvc",
  940. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\start.lnk",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\run.vbs",
  942. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\tbtfsgew.exe",
  943. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat",
  944. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\hviticat.lnk",
  945. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\hviticat",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\OCJCI",
  947. "C:\\Windows\\sysnative\\Tasks\\Opera scheduled Autoupdate 3131961349",
  948. "C:\\Windows\\appcompat\\Programs\\RecentFileCache.bcf",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\RRKIT"
  950.  
  951.  
  952. * Deleted Files:
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\__tmp_rar_sfx_access_check_2011828",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\YTJTH",
  955. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\tbtfsgew.exe",
  956. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe",
  957. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\tbtfsgew.exe:Zone.Identifier",
  958. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\hviticat",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\OCJCI",
  960. "C:\\Windows\\Tasks\\Opera scheduled Autoupdate 3131961349.job",
  961. "C:\\Windows\\sysnative\\Tasks\\Opera scheduled Autoupdate 3131961349",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\04962900\\RRKIT"
  963.  
  964.  
  965. * Modified Registry Keys:
  966. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  967. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  968. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  969. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",
  970. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr",
  971. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate",
  972. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\04962900",
  973. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage2\\ProgramsCache",
  974. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.vbs\\OpenWithProgids\\VBSFile",
  975. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A1AA291B-3BCB-43BF-96F4-D85996580F80\\Path",
  976. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A1AA291B-3BCB-43BF-96F4-D85996580F80\\Hash",
  977. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Opera scheduled Autoupdate 3131961349\\Id",
  978. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Opera scheduled Autoupdate 3131961349\\Index",
  979. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A1AA291B-3BCB-43BF-96F4-D85996580F80\\Triggers",
  980. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A1AA291B-3BCB-43BF-96F4-D85996580F80\\DynamicInfo",
  981. "HKEY_CURRENT_USER\\Software\\ec9f8cd7",
  982. "HKEY_CURRENT_USER\\Software\\bac9da81"
  983.  
  984.  
  985. * Deleted Registry Keys:
  986. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  987. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  988. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  989. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  990. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Opera scheduled Autoupdate 3131961349.job",
  991. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Opera scheduled Autoupdate 3131961349.job.fp"
  992.  
  993.  
  994. * DNS Communications:
  995.  
  996. "type": "A",
  997. "request": "kingj4me5.xyz",
  998. "answers":
  999.  
  1000. "data": "47.254.215.29",
  1001. "type": "A"
  1002.  
  1003.  
  1004.  
  1005.  
  1006.  
  1007. * Domains:
  1008.  
  1009. "ip": "47.254.215.29",
  1010. "domain": "kingj4me5.xyz"
  1011.  
  1012.  
  1013.  
  1014. * Network Communication - ICMP:
  1015.  
  1016. * Network Communication - HTTP:
  1017.  
  1018. "count": 3,
  1019. "body": "",
  1020. "uri": "http://www.msftncsi.com/ncsi.txt",
  1021. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1022. "method": "GET",
  1023. "host": "www.msftncsi.com",
  1024. "version": "1.1",
  1025. "path": "/ncsi.txt",
  1026. "data": "GET /ncsi.txt HTTP/1.1\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nPragma: no-cache\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: www.msftncsi.com\r\n\r\n",
  1027. "port": 80
  1028.  
  1029.  
  1030. "count": 1,
  1031. "body": "",
  1032. "uri": "http://kingj4me5.xyz/zb/",
  1033. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1034. "method": "POST",
  1035. "host": "kingj4me5.xyz",
  1036. "version": "1.1",
  1037. "path": "/zb/",
  1038. "data": "POST /zb/ HTTP/1.1\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nPragma: no-cache\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nContent-Length: 63\r\nHost: kingj4me5.xyz\r\n\r\n",
  1039. "port": 80
  1040.  
  1041.  
  1042.  
  1043. * Network Communication - SMTP:
  1044.  
  1045. * Network Communication - Hosts:
  1046.  
  1047. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!