API tools faq
paste
paladin316

Exes_bc49f827d8221a481007b37e546d7e7e_exe_2019-07-23_13_30.txt

paladin316
Jul 23rd, 2019
2,761
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 11.45 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Bladabindi"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_bc49f827d8221a481007b37e546d7e7e.exe"
  7. * File Size: 620544
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "d5e002437ccd0fec74ebd78af3e74afd03391507da532128e60252679e08b1ec"
  10. * MD5: "bc49f827d8221a481007b37e546d7e7e"
  11. * SHA1: "cd75f4a5b5627039269249f7720154b161610f16"
  12. * SHA512: "5d51e33ae9ba28ed05da536b6b0e56655cda95bdad6953459aa30b6e7c3c5ae5deeb9d1b4d49af3819f55896d040f617ca1aaf05e775efd3d05fd6568ff31cc4"
  13. * CRC32: "799AD033"
  14. * SSDEEP: "12288:2bVhq6CC8DZHZsPOy6AhcO7MxRoq1K2wuHYOH1vO:eO6UZs4AvgDt1K2wu4K8"
  15.  
  16. * Process Execution:
  17. "Exes_bc49f827d8221a481007b37e546d7e7e.exe",
  18. "Exes_bc49f827d8221a481007b37e546d7e7e.exe",
  19. "fs4rPP.exe",
  20. "fs4rPP.exe",
  21. "netsh.exe",
  22. "svchost.exe",
  23. "WmiPrvSE.exe"
  24.  
  25.  
  26. * Executed Commands:
  27. "\"C:\\Users\\user\\AppData\\Local\\Temp\\Exes_bc49f827d8221a481007b37e546d7e7e.exe\"",
  28. "C:\\Users\\user\\AppData\\Roaming\\fs4rPP.exe ",
  29. "\"C:\\Users\\user\\AppData\\Roaming\\fs4rPP.exe\"",
  30. "netsh firewall add allowedprogram \"C:\\Users\\user\\AppData\\Roaming\\fs4rPP.exe\" \"fs4rPP.exe\" ENABLE",
  31. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"
  32.  
  33.  
  34. * Signatures Detected:
  35.  
  36. "Description": "Creates RWX memory",
  37. "Details":
  38.  
  39.  
  40. "Description": "Reads data out of its own binary image",
  41. "Details":
  42.  
  43. "self_read": "process: Exes_bc49f827d8221a481007b37e546d7e7e.exe, pid: 2976, offset: 0x00000000, length: 0x00097800"
  44.  
  45.  
  46.  
  47.  
  48. "Description": "Drops a binary and executes it",
  49. "Details":
  50.  
  51. "binary": "C:\\Users\\user\\AppData\\Roaming\\fs4rPP.exe"
  52.  
  53.  
  54.  
  55.  
  56. "Description": "Executed a process and injected code into it, probably while unpacking",
  57. "Details":
  58.  
  59. "Injection": "Exes_bc49f827d8221a481007b37e546d7e7e.exe(1664) -> Exes_bc49f827d8221a481007b37e546d7e7e.exe(2976)"
  60.  
  61.  
  62.  
  63.  
  64. "Description": "Sniffs keystrokes",
  65. "Details":
  66.  
  67. "GetAsyncKeyState": "Process: fs4rPP.exe(2628)"
  68.  
  69.  
  70.  
  71.  
  72. "Description": "A process was set to shut the system down when terminated",
  73. "Details":
  74.  
  75. "process": "fs4rPP.exe:2628"
  76.  
  77.  
  78.  
  79.  
  80. "Description": "Installs itself for autorun at Windows startup",
  81. "Details":
  82.  
  83. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\c73c4c013b7a13549d50abe459b1d1a5"
  84.  
  85.  
  86. "data": "\"C:\\Users\\user\\AppData\\Roaming\\fs4rPP.exe\" .."
  87.  
  88.  
  89. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\c73c4c013b7a13549d50abe459b1d1a5"
  90.  
  91.  
  92. "data": "\"C:\\Users\\user\\AppData\\Roaming\\fs4rPP.exe\" .."
  93.  
  94.  
  95. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Mp3.vbs"
  96.  
  97.  
  98. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Mp3.vbs"
  99.  
  100.  
  101. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\c73c4c013b7a13549d50abe459b1d1a5.exe"
  102.  
  103.  
  104. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\c73c4c013b7a13549d50abe459b1d1a5.exe"
  105.  
  106.  
  107. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Mp3.vbs"
  108.  
  109.  
  110.  
  111.  
  112. "Description": "Retrieves Windows ProductID, probably to fingerprint the sandbox",
  113. "Details":
  114.  
  115.  
  116. "Description": "File has been identified by 34 Antiviruses on VirusTotal as malicious",
  117. "Details":
  118.  
  119. "MicroWorld-eScan": "Trojan.Agent.EAYB"
  120.  
  121.  
  122. "K7GW": "Riskware ( 0040eff71 )"
  123.  
  124.  
  125. "K7AntiVirus": "Riskware ( 0040eff71 )"
  126.  
  127.  
  128. "Arcabit": "Trojan.Agent.EAYB"
  129.  
  130.  
  131. "Invincea": "heuristic"
  132.  
  133.  
  134. "Symantec": "Packed.Generic.516"
  135.  
  136.  
  137. "APEX": "Malicious"
  138.  
  139.  
  140. "Avast": "Win32:Malware-gen"
  141.  
  142.  
  143. "Kaspersky": "HEUR:Trojan.Win32.Crypt.gen"
  144.  
  145.  
  146. "BitDefender": "Trojan.Agent.EAYB"
  147.  
  148.  
  149. "Paloalto": "generic.ml"
  150.  
  151.  
  152. "Rising": "Trojan.Injector!1.AFE3 (CLASSIC)"
  153.  
  154.  
  155. "Ad-Aware": "Trojan.Agent.EAYB"
  156.  
  157.  
  158. "Emsisoft": "Trojan.Agent.EAYB (B)"
  159.  
  160.  
  161. "TrendMicro": "TrojanSpy.Win32.LOKI.SMDD.hp"
  162.  
  163.  
  164. "McAfee-GW-Edition": "BehavesLike.Win32.Fareit.jh"
  165.  
  166.  
  167. "Trapmine": "malicious.high.ml.score"
  168.  
  169.  
  170. "FireEye": "Generic.mg.bc49f827d8221a48"
  171.  
  172.  
  173. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  174.  
  175.  
  176. "Endgame": "malicious (high confidence)"
  177.  
  178.  
  179. "ZoneAlarm": "HEUR:Trojan.Win32.Crypt.gen"
  180.  
  181.  
  182. "GData": "Trojan.Agent.EAYB"
  183.  
  184.  
  185. "AhnLab-V3": "Win-Trojan/Delphiless.Exp"
  186.  
  187.  
  188. "Acronis": "suspicious"
  189.  
  190.  
  191. "MAX": "malware (ai score=84)"
  192.  
  193.  
  194. "Cylance": "Unsafe"
  195.  
  196.  
  197. "ESET-NOD32": "a variant of Win32/Injector.EGTK"
  198.  
  199.  
  200. "TrendMicro-HouseCall": "TrojanSpy.Win32.LOKI.SMDD.hp"
  201.  
  202.  
  203. "Fortinet": "W32/Injector.EGKJ!tr"
  204.  
  205.  
  206. "AVG": "Win32:Malware-gen"
  207.  
  208.  
  209. "Cybereason": "malicious.5b5627"
  210.  
  211.  
  212. "Panda": "Trj/GdSda.A"
  213.  
  214.  
  215. "CrowdStrike": "win/malicious_confidence_80% (D)"
  216.  
  217.  
  218. "Qihoo-360": "HEUR/QVM05.1.B453.Malware.Gen"
  219.  
  220.  
  221.  
  222.  
  223. "Description": "Creates a copy of itself",
  224. "Details":
  225.  
  226. "copy": "C:\\Users\\user\\AppData\\Roaming\\fs4rPP.exe"
  227.  
  228.  
  229. "copy": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\c73c4c013b7a13549d50abe459b1d1a5.exe"
  230.  
  231.  
  232.  
  233.  
  234. "Description": "Collects information to fingerprint the system",
  235. "Details":
  236.  
  237.  
  238. "Description": "Anomalous binary characteristics",
  239. "Details":
  240.  
  241. "anomaly": "Timestamp on binary predates the release date of the OS version it requires by at least a year"
  242.  
  243.  
  244.  
  245.  
  246. "Description": "Created network traffic indicative of malicious activity",
  247. "Details":
  248.  
  249. "signature": "ET TROJAN Bladabindi/njRAT CnC Command (ll)"
  250.  
  251.  
  252.  
  253.  
  254.  
  255. * Started Service:
  256.  
  257. * Mutexes:
  258. "Global\\CLR_CASOFF_MUTEX",
  259. "c73c4c013b7a13549d50abe459b1d1a5",
  260. "Global\\.net clr networking"
  261.  
  262.  
  263. * Modified Files:
  264. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Mp3.vbs",
  265. "C:\\Users\\user\\AppData\\Roaming\\fs4rPP.exe",
  266. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\c73c4c013b7a13549d50abe459b1d1a5.exe",
  267. "\\Device\\Http\\Communication",
  268. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  269. "\\??\\PIPE\\wkssvc",
  270. "\\??\\PIPE\\srvsvc"
  271.  
  272.  
  273. * Deleted Files:
  274. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Mp3.vbs",
  275. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2976.21924281",
  276. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2976.21924281",
  277. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2976.21924281"
  278.  
  279.  
  280. * Modified Registry Keys:
  281. "HKEY_CURRENT_USER\\di",
  282. "HKEY_CURRENT_USER\\Environment\\SEE_MASK_NOZONECHECKS",
  283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\c73c4c013b7a13549d50abe459b1d1a5",
  284. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\c73c4c013b7a13549d50abe459b1d1a5",
  285. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  286. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\dhcpqec.dll,-100",
  287. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\dhcpqec.dll,-101",
  288. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\dhcpqec.dll,-103",
  289. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\dhcpqec.dll,-102",
  290. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\napipsec.dll,-1",
  291. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\napipsec.dll,-2",
  292. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\napipsec.dll,-4",
  293. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\napipsec.dll,-3",
  294. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\tsgqec.dll,-100",
  295. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\tsgqec.dll,-101",
  296. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\tsgqec.dll,-102",
  297. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\tsgqec.dll,-103",
  298. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\eapqec.dll,-100",
  299. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\eapqec.dll,-101",
  300. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\eapqec.dll,-102",
  301. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\eapqec.dll,-103"
  302.  
  303.  
  304. * Deleted Registry Keys:
  305.  
  306. * DNS Communications:
  307.  
  308. "type": "A",
  309. "request": "g2rt.gq",
  310. "answers":
  311.  
  312. "data": "103.136.43.131",
  313. "type": "A"
  314.  
  315.  
  316.  
  317.  
  318.  
  319. * Domains:
  320.  
  321. "ip": "103.136.43.131",
  322. "domain": "g2rt.gq"
  323.  
  324.  
  325.  
  326. * Network Communication - ICMP:
  327.  
  328. * Network Communication - HTTP:
  329.  
  330. * Network Communication - SMTP:
  331.  
  332. * Network Communication - Hosts:
  333.  
  334. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!