API tools faq
paste
paladin316

Exes_5c8b71d251c8824c5660f36a6a5f8d53_exe_2019-07-31_19_30.txt

paladin316
Jul 31st, 2019
2,118
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 26.56 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe"
  7. * File Size: 1364078
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "754992adab2faf86a30e88d59572c504bce08dfc8ad1f4e132b9562eb4bb426f"
  10. * MD5: "5c8b71d251c8824c5660f36a6a5f8d53"
  11. * SHA1: "9f870401f088a4f5970ee09bcf39dfbe00627176"
  12. * SHA512: "0b3aff40f36b826bc8674668c6c1c99a5f34b620f879104af28c678ae7c46389dc2a3fbd8732828d102c44f9db368805f0eede11be762869d71f36152f502257"
  13. * CRC32: "D8785D44"
  14. * SSDEEP: "24576:bNA3R5drXTLPdGETjEIdfnnCUQ7aKfhZjnFMDJneDbeiRpoLDKHHHF:G5PlPPEIFnCUWLB+nURpoqHF"
  15.  
  16. * Process Execution:
  17. "Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe",
  18. "wscript.exe",
  19. "rfw.exe",
  20. "rfw.exe",
  21. "RegSvcs.exe"
  22.  
  23.  
  24. * Executed Commands:
  25. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\tjb.vbs\"",
  26. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\tjb.vbs ",
  27. "\"C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\rfw.exe\" gfj=hxf",
  28. "rfw.exe gfj=hxf",
  29. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\rfw.exe C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\KNUWM"
  30.  
  31.  
  32. * Signatures Detected:
  33.  
  34. "Description": "Attempts to connect to a dead IP:Port (2 unique times)",
  35. "Details":
  36.  
  37. "IP": "213.208.152.216:3376"
  38.  
  39.  
  40. "IP": "213.208.152.216:3373"
  41.  
  42.  
  43.  
  44.  
  45. "Description": "Possible date expiration check, exits too soon after checking local time",
  46. "Details":
  47.  
  48. "process": "rfw.exe, PID 2720"
  49.  
  50.  
  51.  
  52.  
  53. "Description": "Creates RWX memory",
  54. "Details":
  55.  
  56.  
  57. "Description": "Detected script timer window indicative of sleep style evasion",
  58. "Details":
  59.  
  60. "Window": "WSH-Timer"
  61.  
  62.  
  63.  
  64.  
  65. "Description": "A process attempted to delay the analysis task.",
  66. "Details":
  67.  
  68. "Process": "RegSvcs.exe tried to sleep 1875 seconds, actually delayed analysis time by 0 seconds"
  69.  
  70.  
  71.  
  72.  
  73. "Description": "Reads data out of its own binary image",
  74. "Details":
  75.  
  76. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00000000, length: 0x00000007"
  77.  
  78.  
  79. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00000000, length: 0x00002000"
  80.  
  81.  
  82. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00000007, length: 0x0014d067"
  83.  
  84.  
  85. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00001ff0, length: 0x00002000"
  86.  
  87.  
  88. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00003fe0, length: 0x00002000"
  89.  
  90.  
  91. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00005fd0, length: 0x00002000"
  92.  
  93.  
  94. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00007fc0, length: 0x00002000"
  95.  
  96.  
  97. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00009fb0, length: 0x00002000"
  98.  
  99.  
  100. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0000bfa0, length: 0x00002000"
  101.  
  102.  
  103. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0000df90, length: 0x00002000"
  104.  
  105.  
  106. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0000ff80, length: 0x00002000"
  107.  
  108.  
  109. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00011f70, length: 0x00002000"
  110.  
  111.  
  112. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00013f60, length: 0x00002000"
  113.  
  114.  
  115. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00015f50, length: 0x00002000"
  116.  
  117.  
  118. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00017f40, length: 0x00002000"
  119.  
  120.  
  121. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00019f30, length: 0x00002000"
  122.  
  123.  
  124. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0001bf20, length: 0x00002000"
  125.  
  126.  
  127. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0001df10, length: 0x00002000"
  128.  
  129.  
  130. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0001ff00, length: 0x00002000"
  131.  
  132.  
  133. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00021ef0, length: 0x00002000"
  134.  
  135.  
  136. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00023ee0, length: 0x00002000"
  137.  
  138.  
  139. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00025ed0, length: 0x00002000"
  140.  
  141.  
  142. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00027ec0, length: 0x00002000"
  143.  
  144.  
  145. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00029eb0, length: 0x00002000"
  146.  
  147.  
  148. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0002bea0, length: 0x00002000"
  149.  
  150.  
  151. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0002de90, length: 0x00002000"
  152.  
  153.  
  154. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0002fe80, length: 0x00002000"
  155.  
  156.  
  157. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00031e70, length: 0x00002000"
  158.  
  159.  
  160. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00033e60, length: 0x00002000"
  161.  
  162.  
  163. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00035e50, length: 0x00002000"
  164.  
  165.  
  166. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00037e40, length: 0x00002000"
  167.  
  168.  
  169. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00039e30, length: 0x00002000"
  170.  
  171.  
  172. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0003be20, length: 0x00002000"
  173.  
  174.  
  175. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0003de10, length: 0x00002000"
  176.  
  177.  
  178. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0003fe00, length: 0x00002000"
  179.  
  180.  
  181. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00041df0, length: 0x00002000"
  182.  
  183.  
  184. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00043de0, length: 0x00002000"
  185.  
  186.  
  187. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00045dd0, length: 0x00002000"
  188.  
  189.  
  190. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00047dc0, length: 0x00002000"
  191.  
  192.  
  193. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00049db0, length: 0x00002000"
  194.  
  195.  
  196. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0004bda0, length: 0x00002000"
  197.  
  198.  
  199. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0004dd90, length: 0x00002000"
  200.  
  201.  
  202. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0004fd80, length: 0x00002000"
  203.  
  204.  
  205. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00050a00, length: 0x00000031"
  206.  
  207.  
  208. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x00050a19, length: 0x000f95d0"
  209.  
  210.  
  211. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014a1be, length: 0x00000028"
  212.  
  213.  
  214. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014a387, length: 0x00000027"
  215.  
  216.  
  217. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014a572, length: 0x00000027"
  218.  
  219.  
  220. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014a74f, length: 0x00000028"
  221.  
  222.  
  223. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014a948, length: 0x00000027"
  224.  
  225.  
  226. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014ab1f, length: 0x00000028"
  227.  
  228.  
  229. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014ad03, length: 0x00000028"
  230.  
  231.  
  232. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014aede, length: 0x00000028"
  233.  
  234.  
  235. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014b0c2, length: 0x00000028"
  236.  
  237.  
  238. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014b2c8, length: 0x00000028"
  239.  
  240.  
  241. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014b497, length: 0x00000028"
  242.  
  243.  
  244. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014b694, length: 0x00000027"
  245.  
  246.  
  247. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014b89d, length: 0x00000028"
  248.  
  249.  
  250. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014baad, length: 0x00000027"
  251.  
  252.  
  253. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014bc99, length: 0x00000028"
  254.  
  255.  
  256. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014be62, length: 0x00000028"
  257.  
  258.  
  259. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014c03f, length: 0x00000028"
  260.  
  261.  
  262. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014c245, length: 0x00000027"
  263.  
  264.  
  265. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014c443, length: 0x00000027"
  266.  
  267.  
  268. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014c63b, length: 0x00000028"
  269.  
  270.  
  271. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014c82a, length: 0x00000028"
  272.  
  273.  
  274. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014ca04, length: 0x00000027"
  275.  
  276.  
  277. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014cc01, length: 0x00000028"
  278.  
  279.  
  280. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014cdd7, length: 0x00000028"
  281.  
  282.  
  283. "self_read": "process: Exes_5c8b71d251c8824c5660f36a6a5f8d53.exe, pid: 696, offset: 0x0014cfb5, length: 0x0000001b"
  284.  
  285.  
  286. "self_read": "process: wscript.exe, pid: 2460, offset: 0x00000000, length: 0x00000040"
  287.  
  288.  
  289. "self_read": "process: wscript.exe, pid: 2460, offset: 0x000000f0, length: 0x00000018"
  290.  
  291.  
  292. "self_read": "process: wscript.exe, pid: 2460, offset: 0x000001e8, length: 0x00000078"
  293.  
  294.  
  295. "self_read": "process: wscript.exe, pid: 2460, offset: 0x00018000, length: 0x00000020"
  296.  
  297.  
  298. "self_read": "process: wscript.exe, pid: 2460, offset: 0x00018058, length: 0x00000018"
  299.  
  300.  
  301. "self_read": "process: wscript.exe, pid: 2460, offset: 0x000181a8, length: 0x00000018"
  302.  
  303.  
  304. "self_read": "process: wscript.exe, pid: 2460, offset: 0x00018470, length: 0x00000010"
  305.  
  306.  
  307. "self_read": "process: wscript.exe, pid: 2460, offset: 0x00018640, length: 0x00000012"
  308.  
  309.  
  310.  
  311.  
  312. "Description": "Drops a binary and executes it",
  313. "Details":
  314.  
  315. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\rfw.exe"
  316.  
  317.  
  318.  
  319.  
  320. "Description": "Executed a process and injected code into it, probably while unpacking",
  321. "Details":
  322.  
  323. "Injection": "rfw.exe(2616) -> RegSvcs.exe(2300)"
  324.  
  325.  
  326.  
  327.  
  328. "Description": "Installs itself for autorun at Windows startup",
  329. "Details":
  330.  
  331. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate"
  332.  
  333.  
  334. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\rfw.exe C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\GFJ_HX~1"
  335.  
  336.  
  337.  
  338.  
  339. "Description": "Creates a hidden or system file",
  340. "Details":
  341.  
  342. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\rfw.exe"
  343.  
  344.  
  345. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\aab.xl"
  346.  
  347.  
  348. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\asl.ico"
  349.  
  350.  
  351. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\bcn.xl"
  352.  
  353.  
  354. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\biv.icm"
  355.  
  356.  
  357. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\bkv.xl"
  358.  
  359.  
  360. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\bse.bmp"
  361.  
  362.  
  363. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\ckn.xl"
  364.  
  365.  
  366. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\cqc.mp3"
  367.  
  368.  
  369. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\elv.ico"
  370.  
  371.  
  372. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\emm.docx"
  373.  
  374.  
  375. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\emx.ico"
  376.  
  377.  
  378. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\epo.xl"
  379.  
  380.  
  381. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\erm.dat"
  382.  
  383.  
  384. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\fmw.ppt"
  385.  
  386.  
  387. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\frb.mp4"
  388.  
  389.  
  390. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\gav.ppt"
  391.  
  392.  
  393. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\gfj=hxf"
  394.  
  395.  
  396. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\gop.icm"
  397.  
  398.  
  399. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\hfo.mp4"
  400.  
  401.  
  402. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\hkf.dat"
  403.  
  404.  
  405. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\hlw.xl"
  406.  
  407.  
  408. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\hui.xl"
  409.  
  410.  
  411. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\ikp.mp3"
  412.  
  413.  
  414. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\inj.icm"
  415.  
  416.  
  417. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\jwq.pdf"
  418.  
  419.  
  420. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\kuc.txt"
  421.  
  422.  
  423. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\kxa.ico"
  424.  
  425.  
  426. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\llj.xl"
  427.  
  428.  
  429. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\npc.mp4"
  430.  
  431.  
  432. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\ofv.pdf"
  433.  
  434.  
  435. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\phg.docx"
  436.  
  437.  
  438. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\pmr.dat"
  439.  
  440.  
  441. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\pse.xl"
  442.  
  443.  
  444. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\qhc.bmp"
  445.  
  446.  
  447. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\qje.ico"
  448.  
  449.  
  450. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\qju.mp4"
  451.  
  452.  
  453. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\qln.ico"
  454.  
  455.  
  456. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\qto.jpg"
  457.  
  458.  
  459. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\rjk.pdf"
  460.  
  461.  
  462. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\rtg.txt"
  463.  
  464.  
  465. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\str.pdf"
  466.  
  467.  
  468. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\tjb.vbs"
  469.  
  470.  
  471. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\vba.ppt"
  472.  
  473.  
  474. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\vbc.xl"
  475.  
  476.  
  477. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\wop.jpg"
  478.  
  479.  
  480. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\13903468"
  481.  
  482.  
  483.  
  484.  
  485. "Description": "File has been identified by 20 Antiviruses on VirusTotal as malicious",
  486. "Details":
  487.  
  488. "K7GW": "Riskware ( 0040eff71 )"
  489.  
  490.  
  491. "K7AntiVirus": "Riskware ( 0040eff71 )"
  492.  
  493.  
  494. "F-Prot": "W32/Autoit.ADJ"
  495.  
  496.  
  497. "APEX": "Malicious"
  498.  
  499.  
  500. "Paloalto": "generic.ml"
  501.  
  502.  
  503. "ClamAV": "Win.Malware.Autoit-7083004-0"
  504.  
  505.  
  506. "Avast": "Win32:Malware-gen"
  507.  
  508.  
  509. "Endgame": "malicious (high confidence)"
  510.  
  511.  
  512. "Invincea": "heuristic"
  513.  
  514.  
  515. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  516.  
  517.  
  518. "FireEye": "Generic.mg.5c8b71d251c8824c"
  519.  
  520.  
  521. "Cyren": "W32/Autoit.QZWK-0973"
  522.  
  523.  
  524. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  525.  
  526.  
  527. "AegisLab": "Trojan.BAT.Crypter.tqa8"
  528.  
  529.  
  530. "AhnLab-V3": "Trojan/Win32.RL_Agent.R273974"
  531.  
  532.  
  533. "Zoner": "Probably RARAutorun"
  534.  
  535.  
  536. "AVG": "Win32:Malware-gen"
  537.  
  538.  
  539. "Cybereason": "malicious.1f088a"
  540.  
  541.  
  542. "CrowdStrike": "win/malicious_confidence_100% (D)"
  543.  
  544.  
  545. "Qihoo-360": "HEUR/QVM10.1.E501.Malware.Gen"
  546.  
  547.  
  548.  
  549.  
  550. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  551. "Details":
  552.  
  553. "target": "clamav:Win.Malware.Autoit-7083004-0, sha256:754992adab2faf86a30e88d59572c504bce08dfc8ad1f4e132b9562eb4bb426f, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  554.  
  555.  
  556.  
  557.  
  558.  
  559. * Started Service:
  560.  
  561. * Mutexes:
  562. "DefaultTabtip-MainUI",
  563. "CicLoadWinStaWinSta0",
  564. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  565. "Local\\ZoneAttributeCacheCounterMutex",
  566. "Local\\ZonesCacheCounterMutex",
  567. "Local\\ZonesLockedCacheCounterMutex",
  568. "-"
  569.  
  570.  
  571. * Modified Files:
  572. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\__tmp_rar_sfx_access_check_33903109",
  573. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\bse.bmp",
  574. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\gfj=hxf",
  575. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\tjb.vbs",
  576. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\rfw.exe",
  577. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\phg.docx",
  578. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\wop.jpg",
  579. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\hlw.xl",
  580. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\ikp.mp3",
  581. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\cqc.mp3",
  582. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\emm.docx",
  583. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\biv.icm",
  584. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\qju.mp4",
  585. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\str.pdf",
  586. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\asl.ico",
  587. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\frb.mp4",
  588. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\gav.ppt",
  589. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\qln.ico",
  590. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\bcn.xl",
  591. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\vba.ppt",
  592. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\npc.mp4",
  593. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\qje.ico",
  594. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\qhc.bmp",
  595. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\rtg.txt",
  596. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\llj.xl",
  597. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\bkv.xl",
  598. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\ofv.pdf",
  599. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\epo.xl",
  600. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\kxa.ico",
  601. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\hkf.dat",
  602. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\inj.icm",
  603. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\fmw.ppt",
  604. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\rjk.pdf",
  605. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\erm.dat",
  606. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\hui.xl",
  607. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\hfo.mp4",
  608. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\aab.xl",
  609. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\elv.ico",
  610. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\kuc.txt",
  611. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\jwq.pdf",
  612. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\pse.xl",
  613. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\vbc.xl",
  614. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\qto.jpg",
  615. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\pmr.dat",
  616. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\ckn.xl",
  617. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\emx.ico",
  618. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\gop.icm",
  619. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\KNUWM"
  620.  
  621.  
  622. * Deleted Files:
  623. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\__tmp_rar_sfx_access_check_33903109",
  624. "C:\\Users\\user\\AppData\\Local\\Temp\\13903468\\KNUWM"
  625.  
  626.  
  627. * Modified Registry Keys:
  628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  630. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  631. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate"
  632.  
  633.  
  634. * Deleted Registry Keys:
  635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  636. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  638. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  639.  
  640.  
  641. * DNS Communications:
  642.  
  643. * Domains:
  644.  
  645. * Network Communication - ICMP:
  646.  
  647. * Network Communication - HTTP:
  648.  
  649. * Network Communication - SMTP:
  650.  
  651. * Network Communication - Hosts:
  652.  
  653. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!