API tools faq
paste
paladin316

2281AgentTesla_df4957fb92f40a7478b01e55242dc71e_exe_2019-09-18_13_30.txt

paladin316
Sep 18th, 2019
2,376
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 9.97 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * ID: 2281
  3. * MalFamily: "Malicious"
  4.  
  5. * MalScore: 10.0
  6.  
  7. * File Name: "AgentTesla_df4957fb92f40a7478b01e55242dc71e.exe"
  8. * File Size: 949248
  9. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  10. * SHA256: "cf02549faef08f98e623e4bec2bd4f60b2931bce249649b188bdaa63ae26f435"
  11. * MD5: "df4957fb92f40a7478b01e55242dc71e"
  12. * SHA1: "0679f9b8bd05ebe3d0dd0ab1dae22ef456800eab"
  13. * SHA512: "5c610763d4aff15b76bb15ef52d04cb236f8ffc0a1c52bf86c5e4376597ff9863d67f0292832482da2e8ffa01cf595341ef59a77dccac4943a722b18d39a4e45"
  14. * CRC32: "97F9690A"
  15. * SSDEEP: "24576:JhofYZe7q+mOgmwJCcFLYYNmEl+5IvjxpAjuUsxZ0WTy:Jm+bN5EkYwAyUgZq"
  16.  
  17. * Process Execution:
  18. "CFiogU.exe",
  19. "CFiogU.exe",
  20. "svchost.exe",
  21. "WmiPrvSE.exe",
  22. "svchost.exe",
  23. "taskeng.exe",
  24. "taskeng.exe",
  25. "msoia.exe",
  26. "msoia.exe",
  27. "WMIADAP.exe",
  28. "taskeng.exe",
  29. "taskeng.exe"
  30.  
  31.  
  32. * Executed Commands:
  33. "\"C:\\Users\\user\\AppData\\Local\\Temp\\CFiogU.exe\"",
  34. "taskeng.exe DA0ED248-9EDB-4144-B9E7-AFC1D00A662A S-1-5-18:NT AUTHORITY\\System:Service:",
  35. "taskeng.exe A14B62F8-6D27-44D8-BFCB-66F44117F2A4 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  36. "\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE wmiadap.exe /F /T /R",
  37. "taskeng.exe C1806AB2-87C8-4C1E-9841-B309890E8556 S-1-5-18:NT AUTHORITY\\System:Service:",
  38. "taskeng.exe CB63B63C-06DB-4BCC-82F3-E7DB55E62E8E S-1-5-18:NT AUTHORITY\\System:Service:",
  39. "\"C:\\Program Files\\Common Files\\Microsoft Shared\\Office15\\OLicenseHeartbeat.exe\"",
  40. "\"C:\\Program Files\\Microsoft Office\\Office15\\msoia.exe\" scan upload mininterval:2880",
  41. "\"C:\\Program Files\\Microsoft Office\\Office15\\msoia.exe\" scan upload"
  42.  
  43.  
  44. * Signatures Detected:
  45.  
  46. "Description": "Behavioural detection: Executable code extraction",
  47. "Details":
  48.  
  49.  
  50. "Description": "SetUnhandledExceptionFilter detected (possible anti-debug)",
  51. "Details":
  52.  
  53.  
  54. "Description": "Guard pages use detected - possible anti-debugging.",
  55. "Details":
  56.  
  57.  
  58. "Description": "A process attempted to delay the analysis task.",
  59. "Details":
  60.  
  61. "Process": "svchost.exe tried to sleep 300 seconds, actually delayed analysis time by 0 seconds"
  62.  
  63.  
  64. "Process": "taskeng.exe tried to sleep 541 seconds, actually delayed analysis time by 0 seconds"
  65.  
  66.  
  67.  
  68.  
  69. "Description": "A process created a hidden window",
  70. "Details":
  71.  
  72. "Process": "svchost.exe -> \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE"
  73.  
  74.  
  75.  
  76.  
  77. "Description": "The binary likely contains encrypted or compressed data.",
  78. "Details":
  79.  
  80. "section": "name: .rsrc, entropy: 7.27, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ, raw_size: 0x0004a400, virtual_size: 0x0004a208"
  81.  
  82.  
  83.  
  84.  
  85. "Description": "Uses Windows utilities for basic functionality",
  86. "Details":
  87.  
  88. "command": "\"C:\\Program Files\\Common Files\\Microsoft Shared\\Office15\\OLicenseHeartbeat.exe\""
  89.  
  90.  
  91.  
  92.  
  93. "Description": "Behavioural detection: Injection (Process Hollowing)",
  94. "Details":
  95.  
  96. "Injection": "CFiogU.exe(3676) -> CFiogU.exe(3208)"
  97.  
  98.  
  99.  
  100.  
  101. "Description": "Executed a process and injected code into it, probably while unpacking",
  102. "Details":
  103.  
  104. "Injection": "CFiogU.exe(3676) -> CFiogU.exe(3208)"
  105.  
  106.  
  107.  
  108.  
  109. "Description": "Behavioural detection: Injection (inter-process)",
  110. "Details":
  111.  
  112.  
  113. "Description": "Tries to unhook or modify Windows functions monitored by Cuckoo",
  114. "Details":
  115.  
  116. "unhook": "function_name: NtCreateSection, type: modification"
  117.  
  118.  
  119.  
  120.  
  121. "Description": "Stack pivoting was detected when using a critical API",
  122. "Details":
  123.  
  124. "process": "taskeng.exe:1960"
  125.  
  126.  
  127. "process": "CFiogU.exe:3208"
  128.  
  129.  
  130. "process": "svchost.exe:888"
  131.  
  132.  
  133.  
  134.  
  135. "Description": "File has been identified by 38 Antiviruses on VirusTotal as malicious",
  136. "Details":
  137.  
  138. "MicroWorld-eScan": "Gen:Variant.Ulise.68047"
  139.  
  140.  
  141. "McAfee": "GenericRXIO-PV!DF4957FB92F4"
  142.  
  143.  
  144. "Cylance": "Unsafe"
  145.  
  146.  
  147. "CrowdStrike": "win/malicious_confidence_80% (D)"
  148.  
  149.  
  150. "BitDefender": "Gen:Variant.Ulise.68047"
  151.  
  152.  
  153. "K7AntiVirus": "Riskware ( 0040eff71 )"
  154.  
  155.  
  156. "TrendMicro": "TrojanSpy.Win32.LOKI.SMDD.hp"
  157.  
  158.  
  159. "Symantec": "Packed.Generic.516"
  160.  
  161.  
  162. "ESET-NOD32": "a variant of Win32/Injector.EHVA"
  163.  
  164.  
  165. "APEX": "Malicious"
  166.  
  167.  
  168. "Avast": "Win32:Trojan-gen"
  169.  
  170.  
  171. "GData": "Gen:Variant.Ulise.68047"
  172.  
  173.  
  174. "Kaspersky": "HEUR:Trojan-PSW.Win32.Azorult.gen"
  175.  
  176.  
  177. "Ad-Aware": "Gen:Variant.Ulise.68047"
  178.  
  179.  
  180. "Sophos": "Mal/Fareit-V"
  181.  
  182.  
  183. "DrWeb": "Trojan.PWS.Siggen2.31104"
  184.  
  185.  
  186. "Invincea": "heuristic"
  187.  
  188.  
  189. "McAfee-GW-Edition": "BehavesLike.Win32.Fareit.dc"
  190.  
  191.  
  192. "Trapmine": "malicious.high.ml.score"
  193.  
  194.  
  195. "FireEye": "Generic.mg.df4957fb92f40a74"
  196.  
  197.  
  198. "Emsisoft": "Gen:Variant.Ulise.68047 (B)"
  199.  
  200.  
  201. "SentinelOne": "DFI - Malicious PE"
  202.  
  203.  
  204. "MAX": "malware (ai score=80)"
  205.  
  206.  
  207. "Endgame": "malicious (high confidence)"
  208.  
  209.  
  210. "Arcabit": "Trojan.Ulise.D109CF"
  211.  
  212.  
  213. "ZoneAlarm": "HEUR:Trojan-PSW.Win32.Azorult.gen"
  214.  
  215.  
  216. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  217.  
  218.  
  219. "AhnLab-V3": "Trojan/Win32.Infostealer.R291746"
  220.  
  221.  
  222. "Acronis": "suspicious"
  223.  
  224.  
  225. "Malwarebytes": "Spyware.LokiBot"
  226.  
  227.  
  228. "TrendMicro-HouseCall": "TrojanSpy.Win32.LOKI.SMDD.hp"
  229.  
  230.  
  231. "Rising": "Trojan.Injector!1.AFE3 (CLASSIC)"
  232.  
  233.  
  234. "Ikarus": "Trojan-Spy.LokiBot"
  235.  
  236.  
  237. "Fortinet": "W32/Injector.EHDJ!tr"
  238.  
  239.  
  240. "Webroot": "W32.Loki.Smdd"
  241.  
  242.  
  243. "AVG": "Win32:Trojan-gen"
  244.  
  245.  
  246. "Cybereason": "malicious.8bd05e"
  247.  
  248.  
  249. "Qihoo-360": "HEUR/QVM05.1.F737.Malware.Gen"
  250.  
  251.  
  252.  
  253.  
  254. "Description": "Anomalous binary characteristics",
  255. "Details":
  256.  
  257. "anomaly": "Timestamp on binary predates the release date of the OS version it requires by at least a year"
  258.  
  259.  
  260.  
  261.  
  262.  
  263. * Started Service:
  264.  
  265. * Mutexes:
  266. "Global\\CLR_PerfMon_WrapMutex",
  267. "Global\\CLR_CASOFF_MUTEX",
  268. "Global\\ADAP_WMI_ENTRY",
  269. "Global\\RefreshRA_Mutex",
  270. "Global\\RefreshRA_Mutex_Lib",
  271. "Global\\RefreshRA_Mutex_Flag"
  272.  
  273.  
  274. * Modified Files:
  275. "\\Device\\LanmanDatagramReceiver",
  276. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  277. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
  278. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  279. "\\??\\WMIDataDevice"
  280.  
  281.  
  282. * Deleted Files:
  283. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log"
  284.  
  285.  
  286. * Modified Registry Keys:
  287. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\ED0D73D7-BC97-46E2-AC55-FD6EB3F72C05\\DynamicInfo",
  288. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\DA0ED248-9EDB-4144-B9E7-AFC1D00A662A",
  289. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\B17E070E-57E3-43F6-96F5-A9A9C921DEBF\\DynamicInfo",
  290. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\A14B62F8-6D27-44D8-BFCB-66F44117F2A4",
  291. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\DF000DCA-3FA2-48A6-9E59-C0606F9F8D73\\DynamicInfo",
  292. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\C1806AB2-87C8-4C1E-9841-B309890E8556",
  293. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\CB63B63C-06DB-4BCC-82F3-E7DB55E62E8E",
  294. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\DA0ED248-9EDB-4144-B9E7-AFC1D00A662A\\data",
  295. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\A14B62F8-6D27-44D8-BFCB-66F44117F2A4\\data",
  296. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\C1806AB2-87C8-4C1E-9841-B309890E8556\\data",
  297. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\CB63B63C-06DB-4BCC-82F3-E7DB55E62E8E\\data"
  298.  
  299.  
  300. * Deleted Registry Keys:
  301.  
  302. * DNS Communications:
  303.  
  304. * Domains:
  305.  
  306. * Network Communication - ICMP:
  307.  
  308. * Network Communication - HTTP:
  309.  
  310. * Network Communication - SMTP:
  311.  
  312. * Network Communication - Hosts:
  313.  
  314. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!