API tools faq
paste
paladin316

Exes_fa51e5d5ee9ea586e29b6510cb9facd1_exe_2019-08-26_10_20.txt

paladin316
Aug 26th, 2019
2,203
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 27.16 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Cobianrat"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_fa51e5d5ee9ea586e29b6510cb9facd1.exe"
  7. * File Size: 1285435
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "b9b8ec5492af06d330b379944779e573a9bb4d554844cde8eb1a703d5e5c6262"
  10. * MD5: "fa51e5d5ee9ea586e29b6510cb9facd1"
  11. * SHA1: "9dd74decdc50236ee3c782f295cc68f0d2f4bad7"
  12. * SHA512: "8a4388c80624b35adbab8d34e11df18260687db32991d294d9a95b1a54e585d95e7661e9866aa9bbaeb6b37c916b2bc0ebe336aebea8c8fc5d975b5382ff06a2"
  13. * CRC32: "BDEEB8BA"
  14. * SSDEEP: "24576:8NA3R5drXIvJiNa/NExeSo2zYsCIszsPG1/4u1h6LId7nf1RMMaReV5BHFAPVI:95Ix9CEjPgOtL1h6LIdzfXMf25BlSC"
  15.  
  16. * Process Execution:
  17. "IUbKFYUAxRAaA.exe",
  18. "wscript.exe",
  19. "mur.exe",
  20. "RegSvcs.exe",
  21. "svchost.exe",
  22. "WmiPrvSE.exe",
  23. "svchost.exe"
  24.  
  25.  
  26. * Executed Commands:
  27. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\fng.vbs\"",
  28. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\fng.vbs ",
  29. "\"C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\mur.exe\" sfo=anb",
  30. "mur.exe sfo=anb"
  31.  
  32.  
  33. * Signatures Detected:
  34.  
  35. "Description": "SetUnhandledExceptionFilter detected (possible anti-debug)",
  36. "Details":
  37.  
  38.  
  39. "Description": "Behavioural detection: Executable code extraction",
  40. "Details":
  41.  
  42.  
  43. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  44. "Details":
  45.  
  46. "IP": "116.206.8.52:56355 (Indonesia)"
  47.  
  48.  
  49.  
  50.  
  51. "Description": "Creates RWX memory",
  52. "Details":
  53.  
  54.  
  55. "Description": "Guard pages use detected - possible anti-debugging.",
  56. "Details":
  57.  
  58.  
  59. "Description": "Detected script timer window indicative of sleep style evasion",
  60. "Details":
  61.  
  62. "Window": "WSH-Timer"
  63.  
  64.  
  65.  
  66.  
  67. "Description": "A process attempted to delay the analysis task.",
  68. "Details":
  69.  
  70. "Process": "RegSvcs.exe tried to sleep 1228 seconds, actually delayed analysis time by 0 seconds"
  71.  
  72.  
  73.  
  74.  
  75. "Description": "Reads data out of its own binary image",
  76. "Details":
  77.  
  78. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00000000, length: 0x00000007"
  79.  
  80.  
  81. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00000000, length: 0x00002000"
  82.  
  83.  
  84. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00000007, length: 0x00139d34"
  85.  
  86.  
  87. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00001ff0, length: 0x00002000"
  88.  
  89.  
  90. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00003fe0, length: 0x00002000"
  91.  
  92.  
  93. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00005fd0, length: 0x00002000"
  94.  
  95.  
  96. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00007fc0, length: 0x00002000"
  97.  
  98.  
  99. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00009fb0, length: 0x00002000"
  100.  
  101.  
  102. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x0000bfa0, length: 0x00002000"
  103.  
  104.  
  105. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x0000df90, length: 0x00002000"
  106.  
  107.  
  108. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x0000ff80, length: 0x00002000"
  109.  
  110.  
  111. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00011f70, length: 0x00002000"
  112.  
  113.  
  114. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00013f60, length: 0x00002000"
  115.  
  116.  
  117. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00015f50, length: 0x00002000"
  118.  
  119.  
  120. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00017f40, length: 0x00002000"
  121.  
  122.  
  123. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00019f30, length: 0x00002000"
  124.  
  125.  
  126. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x0001bf20, length: 0x00002000"
  127.  
  128.  
  129. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x0001df10, length: 0x00002000"
  130.  
  131.  
  132. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x0001ff00, length: 0x00002000"
  133.  
  134.  
  135. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00021ef0, length: 0x00002000"
  136.  
  137.  
  138. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00023ee0, length: 0x00002000"
  139.  
  140.  
  141. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00025ed0, length: 0x00002000"
  142.  
  143.  
  144. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00027ec0, length: 0x00002000"
  145.  
  146.  
  147. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00029eb0, length: 0x00002000"
  148.  
  149.  
  150. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x0002bea0, length: 0x00002000"
  151.  
  152.  
  153. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x0002de90, length: 0x00002000"
  154.  
  155.  
  156. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x0002fe80, length: 0x00002000"
  157.  
  158.  
  159. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00031e70, length: 0x00002000"
  160.  
  161.  
  162. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00033e60, length: 0x00002000"
  163.  
  164.  
  165. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00035e50, length: 0x00002000"
  166.  
  167.  
  168. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00037e40, length: 0x00002000"
  169.  
  170.  
  171. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00039e30, length: 0x00002000"
  172.  
  173.  
  174. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x0003be20, length: 0x00002000"
  175.  
  176.  
  177. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x0003de10, length: 0x00002000"
  178.  
  179.  
  180. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x0003fe00, length: 0x00002000"
  181.  
  182.  
  183. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00041df0, length: 0x00002000"
  184.  
  185.  
  186. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00043de0, length: 0x00002000"
  187.  
  188.  
  189. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00045600, length: 0x000ee89f"
  190.  
  191.  
  192. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00134084, length: 0x00000027"
  193.  
  194.  
  195. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00134274, length: 0x00000028"
  196.  
  197.  
  198. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x0013448b, length: 0x00000028"
  199.  
  200.  
  201. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00134658, length: 0x00000028"
  202.  
  203.  
  204. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x0013484a, length: 0x00000028"
  205.  
  206.  
  207. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00134a12, length: 0x00000028"
  208.  
  209.  
  210. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00134be7, length: 0x00000028"
  211.  
  212.  
  213. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00134de8, length: 0x00000029"
  214.  
  215.  
  216. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00134fe2, length: 0x00000028"
  217.  
  218.  
  219. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x001351b6, length: 0x00000028"
  220.  
  221.  
  222. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00135388, length: 0x00000029"
  223.  
  224.  
  225. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x001355cd, length: 0x00000028"
  226.  
  227.  
  228. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x001357d5, length: 0x00000028"
  229.  
  230.  
  231. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x001359a4, length: 0x00000028"
  232.  
  233.  
  234. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00135bb4, length: 0x00000028"
  235.  
  236.  
  237. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00135d8e, length: 0x00000028"
  238.  
  239.  
  240. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00135f5b, length: 0x00000028"
  241.  
  242.  
  243. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00136175, length: 0x00000028"
  244.  
  245.  
  246. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x0013636d, length: 0x00000028"
  247.  
  248.  
  249. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00136541, length: 0x00000028"
  250.  
  251.  
  252. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00136715, length: 0x00000028"
  253.  
  254.  
  255. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00136947, length: 0x00000028"
  256.  
  257.  
  258. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00136b59, length: 0x00000028"
  259.  
  260.  
  261. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00136d7b, length: 0x00000028"
  262.  
  263.  
  264. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00136f4c, length: 0x00000029"
  265.  
  266.  
  267. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x0013711b, length: 0x00000028"
  268.  
  269.  
  270. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x001372e3, length: 0x00000028"
  271.  
  272.  
  273. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x001374b9, length: 0x00000028"
  274.  
  275.  
  276. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x001376b5, length: 0x00000028"
  277.  
  278.  
  279. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x001378b2, length: 0x00000028"
  280.  
  281.  
  282. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00137aca, length: 0x00000028"
  283.  
  284.  
  285. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00137c9b, length: 0x00000028"
  286.  
  287.  
  288. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00137e88, length: 0x00000028"
  289.  
  290.  
  291. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x001380c1, length: 0x00000028"
  292.  
  293.  
  294. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x001382d8, length: 0x00000028"
  295.  
  296.  
  297. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x001384a2, length: 0x00000028"
  298.  
  299.  
  300. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x001386df, length: 0x00000029"
  301.  
  302.  
  303. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x001388d5, length: 0x00000028"
  304.  
  305.  
  306. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00138ad2, length: 0x00000028"
  307.  
  308.  
  309. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00138cc1, length: 0x00000028"
  310.  
  311.  
  312. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00138eaf, length: 0x00000027"
  313.  
  314.  
  315. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x001390a1, length: 0x00000028"
  316.  
  317.  
  318. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x001392b2, length: 0x00000028"
  319.  
  320.  
  321. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x001394b0, length: 0x00000028"
  322.  
  323.  
  324. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x0013967e, length: 0x00000028"
  325.  
  326.  
  327. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00139889, length: 0x00000028"
  328.  
  329.  
  330. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00139a70, length: 0x00000028"
  331.  
  332.  
  333. "self_read": "process: IUbKFYUAxRAaA.exe, pid: 2936, offset: 0x00139c4d, length: 0x0000001b"
  334.  
  335.  
  336. "self_read": "process: wscript.exe, pid: 1876, offset: 0x00000000, length: 0x00000040"
  337.  
  338.  
  339. "self_read": "process: wscript.exe, pid: 1876, offset: 0x000000f0, length: 0x00000018"
  340.  
  341.  
  342. "self_read": "process: wscript.exe, pid: 1876, offset: 0x000001e8, length: 0x00000078"
  343.  
  344.  
  345. "self_read": "process: wscript.exe, pid: 1876, offset: 0x00018000, length: 0x00000020"
  346.  
  347.  
  348. "self_read": "process: wscript.exe, pid: 1876, offset: 0x00018058, length: 0x00000018"
  349.  
  350.  
  351. "self_read": "process: wscript.exe, pid: 1876, offset: 0x000181a8, length: 0x00000018"
  352.  
  353.  
  354. "self_read": "process: wscript.exe, pid: 1876, offset: 0x00018470, length: 0x00000010"
  355.  
  356.  
  357. "self_read": "process: wscript.exe, pid: 1876, offset: 0x00018640, length: 0x00000012"
  358.  
  359.  
  360.  
  361.  
  362. "Description": "Drops a binary and executes it",
  363. "Details":
  364.  
  365. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\mur.exe"
  366.  
  367.  
  368.  
  369.  
  370. "Description": "A scripting utility was executed",
  371. "Details":
  372.  
  373. "command": "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\fng.vbs\""
  374.  
  375.  
  376.  
  377.  
  378. "Description": "Behavioural detection: Injection (Process Hollowing)",
  379. "Details":
  380.  
  381. "Injection": "mur.exe(372) -> RegSvcs.exe(1720)"
  382.  
  383.  
  384.  
  385.  
  386. "Description": "Executed a process and injected code into it, probably while unpacking",
  387. "Details":
  388.  
  389. "Injection": "mur.exe(372) -> RegSvcs.exe(1720)"
  390.  
  391.  
  392.  
  393.  
  394. "Description": "Sniffs keystrokes",
  395. "Details":
  396.  
  397. "GetAsyncKeyState": "Process: RegSvcs.exe(1720)"
  398.  
  399.  
  400.  
  401.  
  402. "Description": "Behavioural detection: Injection (inter-process)",
  403. "Details":
  404.  
  405.  
  406. "Description": "Creates a hidden or system file",
  407. "Details":
  408.  
  409. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\mur.exe"
  410.  
  411.  
  412. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\44927314"
  413.  
  414.  
  415. "file": "C:\\Users\\user\\temp"
  416.  
  417.  
  418.  
  419.  
  420. "Description": "File has been identified by 25 Antiviruses on VirusTotal as malicious",
  421. "Details":
  422.  
  423. "CrowdStrike": "win/malicious_confidence_90% (D)"
  424.  
  425.  
  426. "K7GW": "Trojan ( 005559bd1 )"
  427.  
  428.  
  429. "K7AntiVirus": "Trojan ( 005559bd1 )"
  430.  
  431.  
  432. "APEX": "Malicious"
  433.  
  434.  
  435. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  436.  
  437.  
  438. "F-Secure": "Dropper.DR/AutoIt.Gen"
  439.  
  440.  
  441. "Invincea": "heuristic"
  442.  
  443.  
  444. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  445.  
  446.  
  447. "Trapmine": "suspicious.low.ml.score"
  448.  
  449.  
  450. "FireEye": "Generic.mg.fa51e5d5ee9ea586"
  451.  
  452.  
  453. "Cyren": "W32/AutoIt.EN.gen!Eldorado"
  454.  
  455.  
  456. "Avira": "DR/AutoIt.Gen"
  457.  
  458.  
  459. "Antiy-AVL": "TrojanArcBomb/Win32.Agent"
  460.  
  461.  
  462. "AegisLab": "Trojan.BAT.Crypter.tqa8"
  463.  
  464.  
  465. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  466.  
  467.  
  468. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  469.  
  470.  
  471. "AhnLab-V3": "Malware/Win32.RL_Generic.R286428"
  472.  
  473.  
  474. "Acronis": "suspicious"
  475.  
  476.  
  477. "Malwarebytes": "Trojan.MalPack.AISFX.Generic"
  478.  
  479.  
  480. "Zoner": "Probably RARAutorun"
  481.  
  482.  
  483. "Rising": "Trojan.Pack-RAR!1.BB61 (CLASSIC)"
  484.  
  485.  
  486. "Yandex": "Trojan.Agent!nS7qVYN4VgU"
  487.  
  488.  
  489. "Ikarus": "Trojan.Agent"
  490.  
  491.  
  492. "Cybereason": "malicious.cdc502"
  493.  
  494.  
  495. "Qihoo-360": "HEUR/QVM10.1.75D5.Malware.Gen"
  496.  
  497.  
  498.  
  499.  
  500. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  501. "Details":
  502.  
  503. "dropped": "clamav:Win.Trojan.Autoit-6922942-0, sha256:fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\mur.exe, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  504.  
  505.  
  506.  
  507.  
  508. "Description": "Collects information to fingerprint the system",
  509. "Details":
  510.  
  511.  
  512. "Description": "Created network traffic indicative of malicious activity",
  513. "Details":
  514.  
  515. "signature": "ET TROJAN CobianRAT Receiving Config Commands from CnC"
  516.  
  517.  
  518. "signature": "ET TROJAN CobianRAT Checkin to CnC"
  519.  
  520.  
  521. "signature": "ET TROJAN CobianRAT Receiving Commands From CnC"
  522.  
  523.  
  524. "signature": "ET TROJAN CobianRAT Screenshot Exfil to CnC"
  525.  
  526.  
  527.  
  528.  
  529.  
  530. * Started Service:
  531.  
  532. * Mutexes:
  533. "DefaultTabtip-MainUI",
  534. "Local\\ZoneAttributeCacheCounterMutex",
  535. "Local\\ZonesCacheCounterMutex",
  536. "Local\\ZonesLockedCacheCounterMutex",
  537. "Global\\CLR_PerfMon_WrapMutex",
  538. "Global\\CLR_CASOFF_MUTEX",
  539. "XGOXY2WV-106361-DNVDE2-DNVDE2CB2Z",
  540. "Global\\.net clr networking"
  541.  
  542.  
  543. * Modified Files:
  544. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\__tmp_rar_sfx_access_check_20057265",
  545. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\mmu.docx",
  546. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\sfo=anb",
  547. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\fng.vbs",
  548. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\mur.exe",
  549. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\vtn.mp3",
  550. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\xtm.bin",
  551. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\ebj.log",
  552. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\qhs.log",
  553. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\lbf.msc",
  554. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\sqh.dat",
  555. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\qfm.docx",
  556. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\qvx.txt",
  557. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\cxu.cpl",
  558. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\ird.dll",
  559. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\lrp.pdf",
  560. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\aiw.ini",
  561. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\wce.cpl",
  562. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\rlp.xls",
  563. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\lph.pdf",
  564. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\sgj.txt",
  565. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\kak.txt",
  566. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\cto.xl",
  567. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\xwc.dll",
  568. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\wei.mp3",
  569. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\ogb.pdf",
  570. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\kgt.mp3",
  571. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\wkj.log",
  572. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\ogh.dat",
  573. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\ekt.docx",
  574. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\tij.pdf",
  575. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\vul.ico",
  576. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\rat.docx",
  577. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\nng.msc",
  578. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\nfh.exe",
  579. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\bbv.msc",
  580. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\pxk.jpg",
  581. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\xfp.pdf",
  582. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\dwx.ico",
  583. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\vit.xls",
  584. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\gqn.ppt",
  585. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\akv.xml",
  586. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\ruk.cpl",
  587. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\qbv.ini",
  588. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\nds.ini",
  589. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\imh.msc",
  590. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\ktn.docx",
  591. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\tbn.bin",
  592. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\imp.ico",
  593. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\sjx.log",
  594. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\tsn.mp3",
  595. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\pvx.bin",
  596. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\bfx.xml",
  597. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\uug.xml",
  598. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\nwv.ico",
  599. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\cif.bin",
  600. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\lfb.xls",
  601. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\ufs.msc",
  602. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\tdb.docx",
  603. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\tws.jpg",
  604. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\uug.jpg",
  605. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\efh.xml",
  606. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\efo.xl",
  607. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\pdr.dll",
  608. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\rik.dat",
  609. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\whl.ico",
  610. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\hrm.ini",
  611. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\oak.dll",
  612. "C:\\Users\\user\\AppData\\Local\\Temp\\44927314\\ivb.icm",
  613. "C:\\Users\\user\\temp\\mmu.docx",
  614. "\\??\\PIPE\\samr",
  615. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  616. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  617. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  618. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  619. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  620. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  621. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  622. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
  623. "\\??\\PIPE\\wkssvc",
  624. "\\??\\PIPE\\srvsvc"
  625.  
  626.  
  627. * Deleted Files:
  628.  
  629. * Modified Registry Keys:
  630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  632. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  633. "HKEY_CURRENT_USER\\Software\\XGOXY2WV-106361-DNVDE2-DNVDE2CB2Z",
  634. "HKEY_CURRENT_USER\\Software\\XGOXY2WV-106361-DNVDE2-DNVDE2CB2Z\\H",
  635. "HKEY_CURRENT_USER\\Software\\XGOXY2WV-106361-DNVDE2-DNVDE2CB2Z\\log",
  636. "HKEY_CURRENT_USER\\Software\\XGOXY2WV-106361-DNVDE2-DNVDE2CB2Z\\log\\8/26/2019",
  637. "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MediaResources\\msvideo",
  638. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  639. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  640. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  641. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  642. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  643. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  644. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  645. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider"
  646.  
  647.  
  648. * Deleted Registry Keys:
  649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  650. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  652. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  653.  
  654.  
  655. * DNS Communications:
  656.  
  657. "type": "A",
  658. "request": "momogilagi.ddns.net",
  659. "answers":
  660.  
  661. "data": "116.206.8.52",
  662. "type": "A"
  663.  
  664.  
  665.  
  666.  
  667.  
  668. * Domains:
  669.  
  670. "ip": "116.206.8.52",
  671. "domain": "momogilagi.ddns.net"
  672.  
  673.  
  674.  
  675. * Network Communication - ICMP:
  676.  
  677. * Network Communication - HTTP:
  678.  
  679. * Network Communication - SMTP:
  680.  
  681. * Network Communication - Hosts:
  682.  
  683. "country_name": "Switzerland",
  684. "ip": "79.134.225.116",
  685. "inaddrarpa": "",
  686. "hostname": ""
  687.  
  688.  
  689. "country_name": "Indonesia",
  690. "ip": "116.206.8.52",
  691. "inaddrarpa": "",
  692. "hostname": "momogilagi.ddns.net"
  693.  
  694.  
  695.  
  696. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!