API tools faq
paste
paladin316

Exes_62ec48e0df46653812eea348437f07b1_exe_2019-08-16_00_30.txt

paladin316
Aug 15th, 2019
2,582
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 30.68 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Nanocore"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_62ec48e0df46653812eea348437f07b1.exe"
  7. * File Size: 1337453
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "7deb354d45516c86bf6baef87b912a5b858941d83a0f9d6c724bcd4e987c3a6e"
  10. * MD5: "62ec48e0df46653812eea348437f07b1"
  11. * SHA1: "e3489a77b634f6f9ef521594b729211466e27922"
  12. * SHA512: "e3a1904fd96745d364aabe597887f4bc1a3bcda1c5f38c5b891e00315a0f9aae570926ddae1ed64b92d845cf1e4da4d7bcd7e9de2474a493df208a570bdd1835"
  13. * CRC32: "78BFFDF4"
  14. * SSDEEP: "24576:8NA3R5drXeJC+p0ubAV05IGFO5XbpeoVG4z+fEaqgg5UhAesZW9beDbeiRpoLDKK:95qC+GubFO5bVV+fXguGhZYbURpoqtdW"
  15.  
  16. * Process Execution:
  17. "Exes_62ec48e0df46653812eea348437f07b1.exe",
  18. "wscript.exe",
  19. "xbv.exe",
  20. "RegSvcs.exe"
  21.  
  22.  
  23. * Executed Commands:
  24. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\isp.vbs\"",
  25. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\isp.vbs ",
  26. "\"C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\xbv.exe\" xab=mpo",
  27. "xbv.exe xab=mpo"
  28.  
  29.  
  30. * Signatures Detected:
  31.  
  32. "Description": "Attempts to connect to a dead IP:Port (2 unique times)",
  33. "Details":
  34.  
  35. "IP": "185.217.1.150:1605"
  36.  
  37.  
  38. "IP": "127.0.0.1:1605"
  39.  
  40.  
  41.  
  42.  
  43. "Description": "Creates RWX memory",
  44. "Details":
  45.  
  46.  
  47. "Description": "Possible date expiration check, exits too soon after checking local time",
  48. "Details":
  49.  
  50. "process": "xbv.exe, PID 2124"
  51.  
  52.  
  53.  
  54.  
  55. "Description": "Detected script timer window indicative of sleep style evasion",
  56. "Details":
  57.  
  58. "Window": "WSH-Timer"
  59.  
  60.  
  61.  
  62.  
  63. "Description": "A process attempted to delay the analysis task.",
  64. "Details":
  65.  
  66. "Process": "RegSvcs.exe tried to sleep 396 seconds, actually delayed analysis time by 0 seconds"
  67.  
  68.  
  69.  
  70.  
  71. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  72. "Details":
  73.  
  74. "ioc": "v2.0.50727"
  75.  
  76.  
  77.  
  78.  
  79. "Description": "Reads data out of its own binary image",
  80. "Details":
  81.  
  82. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00000000, length: 0x00000007"
  83.  
  84.  
  85. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00000000, length: 0x00002000"
  86.  
  87.  
  88. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00000007, length: 0x00146866"
  89.  
  90.  
  91. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00001ff0, length: 0x00002000"
  92.  
  93.  
  94. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00003fe0, length: 0x00002000"
  95.  
  96.  
  97. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00005fd0, length: 0x00002000"
  98.  
  99.  
  100. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00007fc0, length: 0x00002000"
  101.  
  102.  
  103. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00009fb0, length: 0x00002000"
  104.  
  105.  
  106. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0000bfa0, length: 0x00002000"
  107.  
  108.  
  109. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0000df90, length: 0x00002000"
  110.  
  111.  
  112. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0000ff80, length: 0x00002000"
  113.  
  114.  
  115. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00011f70, length: 0x00002000"
  116.  
  117.  
  118. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00013f60, length: 0x00002000"
  119.  
  120.  
  121. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00015f50, length: 0x00002000"
  122.  
  123.  
  124. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00017f40, length: 0x00002000"
  125.  
  126.  
  127. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00019f30, length: 0x00002000"
  128.  
  129.  
  130. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0001bf20, length: 0x00002000"
  131.  
  132.  
  133. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0001df10, length: 0x00002000"
  134.  
  135.  
  136. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0001ff00, length: 0x00002000"
  137.  
  138.  
  139. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00021ef0, length: 0x00002000"
  140.  
  141.  
  142. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00023ee0, length: 0x00002000"
  143.  
  144.  
  145. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00025ed0, length: 0x00002000"
  146.  
  147.  
  148. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00027ec0, length: 0x00002000"
  149.  
  150.  
  151. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00029eb0, length: 0x00002000"
  152.  
  153.  
  154. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0002bea0, length: 0x00002000"
  155.  
  156.  
  157. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0002de90, length: 0x00002000"
  158.  
  159.  
  160. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0002fe80, length: 0x00002000"
  161.  
  162.  
  163. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00031e70, length: 0x00002000"
  164.  
  165.  
  166. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00033e60, length: 0x00002000"
  167.  
  168.  
  169. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00035e50, length: 0x00002000"
  170.  
  171.  
  172. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00037e40, length: 0x00002000"
  173.  
  174.  
  175. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00039e30, length: 0x00002000"
  176.  
  177.  
  178. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0003be20, length: 0x00002000"
  179.  
  180.  
  181. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0003de10, length: 0x00002000"
  182.  
  183.  
  184. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0003fe00, length: 0x00002000"
  185.  
  186.  
  187. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00041df0, length: 0x00002000"
  188.  
  189.  
  190. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00043de0, length: 0x00002000"
  191.  
  192.  
  193. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00045600, length: 0x00000031"
  194.  
  195.  
  196. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00045619, length: 0x000f9abc"
  197.  
  198.  
  199. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0013f2a2, length: 0x00000028"
  200.  
  201.  
  202. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0013f46c, length: 0x00000029"
  203.  
  204.  
  205. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0013f640, length: 0x00000028"
  206.  
  207.  
  208. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0013f837, length: 0x00000029"
  209.  
  210.  
  211. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0013fa07, length: 0x00000028"
  212.  
  213.  
  214. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0013fbd5, length: 0x00000028"
  215.  
  216.  
  217. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0013fdaa, length: 0x00000028"
  218.  
  219.  
  220. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0013ff92, length: 0x00000028"
  221.  
  222.  
  223. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0014017f, length: 0x00000028"
  224.  
  225.  
  226. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0014035f, length: 0x00000028"
  227.  
  228.  
  229. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00140547, length: 0x00000028"
  230.  
  231.  
  232. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00140736, length: 0x00000029"
  233.  
  234.  
  235. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00140914, length: 0x00000028"
  236.  
  237.  
  238. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00140ae7, length: 0x00000028"
  239.  
  240.  
  241. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00140cc1, length: 0x00000028"
  242.  
  243.  
  244. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00140ee6, length: 0x00000028"
  245.  
  246.  
  247. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x001410f0, length: 0x00000028"
  248.  
  249.  
  250. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x001412f2, length: 0x00000028"
  251.  
  252.  
  253. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00141528, length: 0x00000028"
  254.  
  255.  
  256. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0014174d, length: 0x00000028"
  257.  
  258.  
  259. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00141964, length: 0x00000029"
  260.  
  261.  
  262. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00141b30, length: 0x00000028"
  263.  
  264.  
  265. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00141d1f, length: 0x00000028"
  266.  
  267.  
  268. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00141ee8, length: 0x00000028"
  269.  
  270.  
  271. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x001420bc, length: 0x00000028"
  272.  
  273.  
  274. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0014229f, length: 0x00000028"
  275.  
  276.  
  277. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00142467, length: 0x00000028"
  278.  
  279.  
  280. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00142632, length: 0x00000028"
  281.  
  282.  
  283. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x001427fd, length: 0x00000028"
  284.  
  285.  
  286. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x001429df, length: 0x00000028"
  287.  
  288.  
  289. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00142bdd, length: 0x00000028"
  290.  
  291.  
  292. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00142dbd, length: 0x00000028"
  293.  
  294.  
  295. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00142f96, length: 0x00000028"
  296.  
  297.  
  298. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0014319c, length: 0x00000028"
  299.  
  300.  
  301. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x001433b1, length: 0x00000028"
  302.  
  303.  
  304. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00143592, length: 0x00000028"
  305.  
  306.  
  307. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00143795, length: 0x00000028"
  308.  
  309.  
  310. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00143980, length: 0x00000028"
  311.  
  312.  
  313. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00143b4b, length: 0x00000028"
  314.  
  315.  
  316. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00143d26, length: 0x00000028"
  317.  
  318.  
  319. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00143f3c, length: 0x00000028"
  320.  
  321.  
  322. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0014414b, length: 0x00000028"
  323.  
  324.  
  325. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0014433c, length: 0x00000027"
  326.  
  327.  
  328. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00144515, length: 0x00000028"
  329.  
  330.  
  331. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x001446f6, length: 0x00000028"
  332.  
  333.  
  334. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0014490d, length: 0x00000028"
  335.  
  336.  
  337. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00144aed, length: 0x00000028"
  338.  
  339.  
  340. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00144ce7, length: 0x00000028"
  341.  
  342.  
  343. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00144ef0, length: 0x00000028"
  344.  
  345.  
  346. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x001450bd, length: 0x00000028"
  347.  
  348.  
  349. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x001452b8, length: 0x00000028"
  350.  
  351.  
  352. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00145489, length: 0x00000028"
  353.  
  354.  
  355. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00145673, length: 0x00000028"
  356.  
  357.  
  358. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00145870, length: 0x00000028"
  359.  
  360.  
  361. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00145a54, length: 0x00000028"
  362.  
  363.  
  364. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00145c56, length: 0x00000029"
  365.  
  366.  
  367. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x00145e4f, length: 0x00000028"
  368.  
  369.  
  370. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x0014601d, length: 0x00000028"
  371.  
  372.  
  373. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x001461ed, length: 0x00000028"
  374.  
  375.  
  376. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x001463da, length: 0x00000028"
  377.  
  378.  
  379. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x001465d6, length: 0x00000028"
  380.  
  381.  
  382. "self_read": "process: Exes_62ec48e0df46653812eea348437f07b1.exe, pid: 2272, offset: 0x001467b4, length: 0x0000001b"
  383.  
  384.  
  385. "self_read": "process: wscript.exe, pid: 2144, offset: 0x00000000, length: 0x00000040"
  386.  
  387.  
  388. "self_read": "process: wscript.exe, pid: 2144, offset: 0x000000f0, length: 0x00000018"
  389.  
  390.  
  391. "self_read": "process: wscript.exe, pid: 2144, offset: 0x000001e8, length: 0x00000078"
  392.  
  393.  
  394. "self_read": "process: wscript.exe, pid: 2144, offset: 0x00018000, length: 0x00000020"
  395.  
  396.  
  397. "self_read": "process: wscript.exe, pid: 2144, offset: 0x00018058, length: 0x00000018"
  398.  
  399.  
  400. "self_read": "process: wscript.exe, pid: 2144, offset: 0x000181a8, length: 0x00000018"
  401.  
  402.  
  403. "self_read": "process: wscript.exe, pid: 2144, offset: 0x00018470, length: 0x00000010"
  404.  
  405.  
  406. "self_read": "process: wscript.exe, pid: 2144, offset: 0x00018640, length: 0x00000012"
  407.  
  408.  
  409. "self_read": "process: RegSvcs.exe, pid: 1656, offset: 0x00000000, length: 0x00001000"
  410.  
  411.  
  412. "self_read": "process: RegSvcs.exe, pid: 1656, offset: 0x00000080, length: 0x00000200"
  413.  
  414.  
  415. "self_read": "process: RegSvcs.exe, pid: 1656, offset: 0x00000178, length: 0x00000200"
  416.  
  417.  
  418. "self_read": "process: RegSvcs.exe, pid: 1656, offset: 0x00005b20, length: 0x00000200"
  419.  
  420.  
  421. "self_read": "process: RegSvcs.exe, pid: 1656, offset: 0x00005b3c, length: 0x00000200"
  422.  
  423.  
  424.  
  425.  
  426. "Description": "Drops a binary and executes it",
  427. "Details":
  428.  
  429. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\xbv.exe"
  430.  
  431.  
  432.  
  433.  
  434. "Description": "Executed a process and injected code into it, probably while unpacking",
  435. "Details":
  436.  
  437. "Injection": "xbv.exe(2124) -> RegSvcs.exe(1656)"
  438.  
  439.  
  440.  
  441.  
  442. "Description": "Attempts to remove evidence of file being downloaded from the Internet",
  443. "Details":
  444.  
  445. "file": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe:Zone.Identifier"
  446.  
  447.  
  448.  
  449.  
  450. "Description": "Installs itself for autorun at Windows startup",
  451. "Details":
  452.  
  453. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\Winservice"
  454.  
  455.  
  456. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\xbv.exe C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\XAB_MP~1"
  457.  
  458.  
  459.  
  460.  
  461. "Description": "Exhibits behavior characteristic of Nanocore RAT",
  462. "Details":
  463.  
  464.  
  465. "Description": "Creates a hidden or system file",
  466. "Details":
  467.  
  468. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\xbv.exe"
  469.  
  470.  
  471. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\96354639"
  472.  
  473.  
  474. "file": "C:\\Users\\user\\temp"
  475.  
  476.  
  477.  
  478.  
  479. "Description": "File has been identified by 19 Antiviruses on VirusTotal as malicious",
  480. "Details":
  481.  
  482. "CrowdStrike": "win/malicious_confidence_90% (D)"
  483.  
  484.  
  485. "APEX": "Malicious"
  486.  
  487.  
  488. "ClamAV": "Win.Malware.0040eff-7088474-0"
  489.  
  490.  
  491. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  492.  
  493.  
  494. "AegisLab": "Trojan.BAT.Crypter.tqa8"
  495.  
  496.  
  497. "F-Secure": "Dropper.DR/AutoIt.Gen"
  498.  
  499.  
  500. "Invincea": "heuristic"
  501.  
  502.  
  503. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  504.  
  505.  
  506. "Trapmine": "suspicious.low.ml.score"
  507.  
  508.  
  509. "FireEye": "Generic.mg.62ec48e0df466538"
  510.  
  511.  
  512. "Avira": "DR/AutoIt.Gen"
  513.  
  514.  
  515. "Antiy-AVL": "TrojanArcBomb/Win32.Agent"
  516.  
  517.  
  518. "Microsoft": "Trojan:AutoIt/Wiausf.AC!MTB"
  519.  
  520.  
  521. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  522.  
  523.  
  524. "AhnLab-V3": "Malware/Win32.RL_Generic.R286428"
  525.  
  526.  
  527. "Zoner": "Probably RARAutorun"
  528.  
  529.  
  530. "Yandex": "Trojan.Agent!nS7qVYN4VgU"
  531.  
  532.  
  533. "Cybereason": "malicious.7b634f"
  534.  
  535.  
  536. "Qihoo-360": "HEUR/QVM10.1.3A41.Malware.Gen"
  537.  
  538.  
  539.  
  540.  
  541. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  542. "Details":
  543.  
  544. "target": "clamav:Win.Malware.0040eff-7088474-0, sha256:7deb354d45516c86bf6baef87b912a5b858941d83a0f9d6c724bcd4e987c3a6e, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  545.  
  546.  
  547.  
  548.  
  549. "Description": "Collects information to fingerprint the system",
  550. "Details":
  551.  
  552.  
  553.  
  554. * Started Service:
  555.  
  556. * Mutexes:
  557. "DefaultTabtip-MainUI",
  558. "CicLoadWinStaWinSta0",
  559. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  560. "Local\\ZoneAttributeCacheCounterMutex",
  561. "Local\\ZonesCacheCounterMutex",
  562. "Local\\ZonesLockedCacheCounterMutex",
  563. "Global\\CLR_CASOFF_MUTEX",
  564. "Global\\dbb130c2-5368-4dee-9bf6-0ef0216ad43d",
  565. "Global\\.net clr networking"
  566.  
  567.  
  568. * Modified Files:
  569. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\__tmp_rar_sfx_access_check_31422171",
  570. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\hrb.pdf",
  571. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\xab=mpo",
  572. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\isp.vbs",
  573. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\xbv.exe",
  574. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\tov.pdf",
  575. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\nqv.xl",
  576. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\fcb.xls",
  577. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\nhr.docx",
  578. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\pag.ini",
  579. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\pee.log",
  580. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\gmt.ppt",
  581. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\ejp.txt",
  582. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\lre.xml",
  583. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\ifr.xml",
  584. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\wad.log",
  585. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\rcb.xls",
  586. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\knu.bmp",
  587. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\jcg.icm",
  588. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\nma.xml",
  589. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\qpm.jpg",
  590. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\qxq.ppt",
  591. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\agx.pdf",
  592. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\jrs.xml",
  593. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\nrh.docx",
  594. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\sva.xls",
  595. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\ctd.docx",
  596. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\cec.pdf",
  597. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\hua.bmp",
  598. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\mom.icm",
  599. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\otr.txt",
  600. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\iou.txt",
  601. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\ftm.cpl",
  602. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\ert.ico",
  603. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\hsf.docx",
  604. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\onh.pdf",
  605. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\col.xml",
  606. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\cch.msc",
  607. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\bcu.log",
  608. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\hfl.icm",
  609. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\aep.bin",
  610. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\phx.msc",
  611. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\jpi.mp3",
  612. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\bao.docx",
  613. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\unx.dll",
  614. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\bol.exe",
  615. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\ucb.exe",
  616. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\tho.ico",
  617. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\bxx.bmp",
  618. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\scg.ppt",
  619. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\gid.dll",
  620. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\lvh.dll",
  621. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\ewb.ico",
  622. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\wvw.msc",
  623. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\kpa.txt",
  624. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\hpr.cpl",
  625. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\pmw.bmp",
  626. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\qqo.ini",
  627. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\axs.jpg",
  628. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\nqd.jpg",
  629. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\kvj.pdf",
  630. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\qex.log",
  631. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\dti.log",
  632. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\ffs.log",
  633. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\goi.bin",
  634. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\otq.xl",
  635. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\hbn.cpl",
  636. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\lww.dat",
  637. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\unc.ppt",
  638. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\bfc.exe",
  639. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\kuo.ppt",
  640. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\eih.bmp",
  641. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\obi.log",
  642. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\vth.bin",
  643. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\abg.mp3",
  644. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\ewg.dll",
  645. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\eni.xml",
  646. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\ivj.msc",
  647. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\hiw.docx",
  648. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\dcg.ppt",
  649. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\ixk.log",
  650. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\sfg.msc",
  651. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\hae.ppt",
  652. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\cjk.jpg",
  653. "C:\\Users\\user\\temp\\hrb.pdf",
  654. "C:\\Users\\user\\AppData\\Roaming\\C1515A12-1764-4632-ACE9-A9DFF9253200\\run.dat"
  655.  
  656.  
  657. * Deleted Files:
  658. "C:\\Users\\user\\AppData\\Local\\Temp\\96354639\\__tmp_rar_sfx_access_check_31422171",
  659. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe:Zone.Identifier"
  660.  
  661.  
  662. * Modified Registry Keys:
  663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  665. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  666. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\Winservice"
  667.  
  668.  
  669. * Deleted Registry Keys:
  670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  671. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  673. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  674.  
  675.  
  676. * DNS Communications:
  677.  
  678. "type": "A",
  679. "request": "serviceexpress.hopto.org",
  680. "answers":
  681.  
  682. "data": "185.217.1.150",
  683. "type": "A"
  684.  
  685.  
  686.  
  687.  
  688.  
  689. * Domains:
  690.  
  691. "ip": "185.217.1.150",
  692. "domain": "serviceexpress.hopto.org"
  693.  
  694.  
  695.  
  696. * Network Communication - ICMP:
  697.  
  698. * Network Communication - HTTP:
  699.  
  700. * Network Communication - SMTP:
  701.  
  702. * Network Communication - Hosts:
  703.  
  704. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!