API tools faq
paste
paladin316

NanoCore_0815afb4d19082d1bf2b26b58f44a061_exe_2019-07-17_09_30.txt

paladin316
Jul 17th, 2019
2,206
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 20.35 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Nanocore"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe"
  7. * File Size: 926727
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive"
  9. * SHA256: "311a237c74ca1d843c37beea9a51535c88314ce1bb82dd31a98611079867420b"
  10. * MD5: "0815afb4d19082d1bf2b26b58f44a061"
  11. * SHA1: "2235f36b296334fcbe57c4b900561ef5ac67d8e4"
  12. * SHA512: "8c6bac60c7707d48ad423030dbc4561b791f420b5568895adb414c0351ec476885109e9df8f3579188e48d52752e9d2a0e0f8d88701f18ce4189e1e53d23b9a5"
  13. * CRC32: "571B7447"
  14. * SSDEEP: "24576:D2O/GlbLz2Yas1zCQ4haYPC/3wmxhKbH3rUO46Gz:rYDO0YPqwmxUT3iL"
  15.  
  16. * Process Execution:
  17. "NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe",
  18. "dih.exe",
  19. "dih.exe",
  20. "RegSvcs.exe"
  21.  
  22.  
  23. * Executed Commands:
  24. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\dih.exe dun=spq",
  25. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\dih.exe C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\FTHJZ"
  26.  
  27.  
  28. * Signatures Detected:
  29.  
  30. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  31. "Details":
  32.  
  33. "IP": "185.247.228.54:6969"
  34.  
  35.  
  36.  
  37.  
  38. "Description": "Creates RWX memory",
  39. "Details":
  40.  
  41.  
  42. "Description": "A process attempted to delay the analysis task.",
  43. "Details":
  44.  
  45. "Process": "RegSvcs.exe tried to sleep 1060 seconds, actually delayed analysis time by 0 seconds"
  46.  
  47.  
  48.  
  49.  
  50. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  51. "Details":
  52.  
  53. "ioc": "v2.0.50727"
  54.  
  55.  
  56.  
  57.  
  58. "Description": "Reads data out of its own binary image",
  59. "Details":
  60.  
  61. "self_read": "process: NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe, pid: 1908, offset: 0x00000000, length: 0x00000007"
  62.  
  63.  
  64. "self_read": "process: NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe, pid: 1908, offset: 0x00000000, length: 0x00002000"
  65.  
  66.  
  67. "self_read": "process: NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe, pid: 1908, offset: 0x00000007, length: 0x000e2400"
  68.  
  69.  
  70. "self_read": "process: NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe, pid: 1908, offset: 0x00001ff0, length: 0x00002000"
  71.  
  72.  
  73. "self_read": "process: NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe, pid: 1908, offset: 0x00003fe0, length: 0x00002000"
  74.  
  75.  
  76. "self_read": "process: NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe, pid: 1908, offset: 0x00005fd0, length: 0x00002000"
  77.  
  78.  
  79. "self_read": "process: NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe, pid: 1908, offset: 0x00007fc0, length: 0x00002000"
  80.  
  81.  
  82. "self_read": "process: NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe, pid: 1908, offset: 0x00009fb0, length: 0x00002000"
  83.  
  84.  
  85. "self_read": "process: NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe, pid: 1908, offset: 0x0000bfa0, length: 0x00002000"
  86.  
  87.  
  88. "self_read": "process: NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe, pid: 1908, offset: 0x0000df90, length: 0x00002000"
  89.  
  90.  
  91. "self_read": "process: NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe, pid: 1908, offset: 0x0000ff80, length: 0x00002000"
  92.  
  93.  
  94. "self_read": "process: NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe, pid: 1908, offset: 0x00011f70, length: 0x00002000"
  95.  
  96.  
  97. "self_read": "process: NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe, pid: 1908, offset: 0x00013f60, length: 0x00002000"
  98.  
  99.  
  100. "self_read": "process: NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe, pid: 1908, offset: 0x00015f50, length: 0x00002000"
  101.  
  102.  
  103. "self_read": "process: NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe, pid: 1908, offset: 0x00017f40, length: 0x00002000"
  104.  
  105.  
  106. "self_read": "process: NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe, pid: 1908, offset: 0x00019f30, length: 0x00002000"
  107.  
  108.  
  109. "self_read": "process: NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe, pid: 1908, offset: 0x0001bf20, length: 0x00002000"
  110.  
  111.  
  112. "self_read": "process: NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe, pid: 1908, offset: 0x0001df10, length: 0x00002000"
  113.  
  114.  
  115. "self_read": "process: NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe, pid: 1908, offset: 0x0001ff00, length: 0x00002000"
  116.  
  117.  
  118. "self_read": "process: NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe, pid: 1908, offset: 0x00021000, length: 0x00000037"
  119.  
  120.  
  121. "self_read": "process: NanoCore_0815afb4d19082d1bf2b26b58f44a061.exe, pid: 1908, offset: 0x00021014, length: 0x000c13ec"
  122.  
  123.  
  124. "self_read": "process: RegSvcs.exe, pid: 1840, offset: 0x00000000, length: 0x00001000"
  125.  
  126.  
  127. "self_read": "process: RegSvcs.exe, pid: 1840, offset: 0x00000080, length: 0x00000200"
  128.  
  129.  
  130. "self_read": "process: RegSvcs.exe, pid: 1840, offset: 0x00000178, length: 0x00000200"
  131.  
  132.  
  133. "self_read": "process: RegSvcs.exe, pid: 1840, offset: 0x00005b20, length: 0x00000200"
  134.  
  135.  
  136. "self_read": "process: RegSvcs.exe, pid: 1840, offset: 0x00005b3c, length: 0x00000200"
  137.  
  138.  
  139.  
  140.  
  141. "Description": "Drops a binary and executes it",
  142. "Details":
  143.  
  144. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\dih.exe"
  145.  
  146.  
  147.  
  148.  
  149. "Description": "Executed a process and injected code into it, probably while unpacking",
  150. "Details":
  151.  
  152. "Injection": "dih.exe(1696) -> RegSvcs.exe(1840)"
  153.  
  154.  
  155.  
  156.  
  157. "Description": "Attempts to remove evidence of file being downloaded from the Internet",
  158. "Details":
  159.  
  160. "file": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe:Zone.Identifier"
  161.  
  162.  
  163.  
  164.  
  165. "Description": "Installs itself for autorun at Windows startup",
  166. "Details":
  167.  
  168. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate"
  169.  
  170.  
  171. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\dih.exe C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\DUN_SP~1"
  172.  
  173.  
  174.  
  175.  
  176. "Description": "Exhibits behavior characteristic of Nanocore RAT",
  177. "Details":
  178.  
  179.  
  180. "Description": "Creates a hidden or system file",
  181. "Details":
  182.  
  183. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\ait.dat"
  184.  
  185.  
  186. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\aou.xl"
  187.  
  188.  
  189. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\bah.icm"
  190.  
  191.  
  192. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\bdv.docx"
  193.  
  194.  
  195. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\bjt.ppt"
  196.  
  197.  
  198. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\cah.xl"
  199.  
  200.  
  201. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\ComboConstants.docx"
  202.  
  203.  
  204. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\cov.mp4"
  205.  
  206.  
  207. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\crq.jpg"
  208.  
  209.  
  210. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\ctr.xl"
  211.  
  212.  
  213. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\dbi.ico"
  214.  
  215.  
  216. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\dge.icm"
  217.  
  218.  
  219. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\dih.exe"
  220.  
  221.  
  222. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\dun=spq"
  223.  
  224.  
  225. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\FileConstants.jpg"
  226.  
  227.  
  228. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\hde.mp4"
  229.  
  230.  
  231. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\hmm.dat"
  232.  
  233.  
  234. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\jsp.xl"
  235.  
  236.  
  237. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\kwr.jpg"
  238.  
  239.  
  240. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\lcd.ppt"
  241.  
  242.  
  243. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\lgw.icm"
  244.  
  245.  
  246. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\meg.mp3"
  247.  
  248.  
  249. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\mhp.dat"
  250.  
  251.  
  252. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\ntl.docx"
  253.  
  254.  
  255. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\nug.dat"
  256.  
  257.  
  258. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\nva.jpg"
  259.  
  260.  
  261. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\omi.mp3"
  262.  
  263.  
  264. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\opr.pdf"
  265.  
  266.  
  267. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\paj.icm"
  268.  
  269.  
  270. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\pgr.ico"
  271.  
  272.  
  273. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\pgt.docx"
  274.  
  275.  
  276. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\pqx.dat"
  277.  
  278.  
  279. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\qhg.xl"
  280.  
  281.  
  282. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\qlx.icm"
  283.  
  284.  
  285. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\rbf.ico"
  286.  
  287.  
  288. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\req.bmp"
  289.  
  290.  
  291. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\rwa.ico"
  292.  
  293.  
  294. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\soo.mp3"
  295.  
  296.  
  297. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\tvw.icm"
  298.  
  299.  
  300. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\uic.icm"
  301.  
  302.  
  303. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\uik.jpg"
  304.  
  305.  
  306. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\ukm.bmp"
  307.  
  308.  
  309. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\vtw.ppt"
  310.  
  311.  
  312. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\wba.ppt"
  313.  
  314.  
  315. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\wkx.txt"
  316.  
  317.  
  318. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\xxk.bmp"
  319.  
  320.  
  321. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\81911458"
  322.  
  323.  
  324.  
  325.  
  326. "Description": "File has been identified by 38 Antiviruses on VirusTotal as malicious",
  327. "Details":
  328.  
  329. "MicroWorld-eScan": "Trojan.GenericKD.31938923"
  330.  
  331.  
  332. "McAfee": "Artemis!0815AFB4D190"
  333.  
  334.  
  335. "Cylance": "Unsafe"
  336.  
  337.  
  338. "Alibaba": "Trojan:Win32/Starter.ali2000005"
  339.  
  340.  
  341. "K7GW": "Riskware ( 0040eff71 )"
  342.  
  343.  
  344. "K7AntiVirus": "Riskware ( 0040eff71 )"
  345.  
  346.  
  347. "Arcabit": "Trojan.Generic.D1E7596B"
  348.  
  349.  
  350. "Invincea": "heuristic"
  351.  
  352.  
  353. "Symantec": "Trojan.Gen.MBT"
  354.  
  355.  
  356. "TrendMicro-HouseCall": "TROJ_GEN.R061H0CE119"
  357.  
  358.  
  359. "Avast": "Win32:Malware-gen"
  360.  
  361.  
  362. "ClamAV": "Win.Trojan.Autoit-6870735-0"
  363.  
  364.  
  365. "Kaspersky": "HEUR:Trojan.Win32.Generic"
  366.  
  367.  
  368. "BitDefender": "Trojan.GenericKD.31938923"
  369.  
  370.  
  371. "Paloalto": "generic.ml"
  372.  
  373.  
  374. "ViRobot": "Trojan.Win32.Z.Autoit.926727"
  375.  
  376.  
  377. "Tencent": "Win32.Trojan.Autoit.Auto"
  378.  
  379.  
  380. "Ad-Aware": "Trojan.GenericKD.31938923"
  381.  
  382.  
  383. "F-Secure": "Dropper.DR/AutoIt.Gen"
  384.  
  385.  
  386. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.dc"
  387.  
  388.  
  389. "Trapmine": "malicious.moderate.ml.score"
  390.  
  391.  
  392. "FireEye": "Generic.mg.0815afb4d19082d1"
  393.  
  394.  
  395. "Emsisoft": "Trojan.GenericKD.31938923 (B)"
  396.  
  397.  
  398. "Cyren": "W32/Trojan.IGQV-0014"
  399.  
  400.  
  401. "Jiangmin": "Trojan.Miner.ffr"
  402.  
  403.  
  404. "Avira": "DR/AutoIt.Gen"
  405.  
  406.  
  407. "MAX": "malware (ai score=99)"
  408.  
  409.  
  410. "Microsoft": "Trojan:Win32/Tiggre!plock"
  411.  
  412.  
  413. "Endgame": "malicious (high confidence)"
  414.  
  415.  
  416. "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
  417.  
  418.  
  419. "GData": "MSIL.Backdoor.Nancat.46PM20"
  420.  
  421.  
  422. "AhnLab-V3": "Trojan/Win32.Autoit.C1942121"
  423.  
  424.  
  425. "Malwarebytes": "Trojan.MalPack.AISFX"
  426.  
  427.  
  428. "Zoner": "Probably RARAutorun"
  429.  
  430.  
  431. "AVG": "Win32:Malware-gen"
  432.  
  433.  
  434. "Cybereason": "malicious.b29633"
  435.  
  436.  
  437. "CrowdStrike": "win/malicious_confidence_60% (W)"
  438.  
  439.  
  440. "Qihoo-360": "HEUR/QVM06.3.F317.Malware.Gen"
  441.  
  442.  
  443.  
  444.  
  445. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  446. "Details":
  447.  
  448. "target": "clamav:Win.Trojan.Autoit-6870735-0, sha256:311a237c74ca1d843c37beea9a51535c88314ce1bb82dd31a98611079867420b, type:PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive"
  449.  
  450.  
  451.  
  452.  
  453. "Description": "Collects information to fingerprint the system",
  454. "Details":
  455.  
  456.  
  457. "Description": "Created network traffic indicative of malicious activity",
  458. "Details":
  459.  
  460. "signature": "ET DNS Query to a .tk domain - Likely Hostile"
  461.  
  462.  
  463.  
  464.  
  465.  
  466. * Started Service:
  467.  
  468. * Mutexes:
  469. "DefaultTabtip-MainUI",
  470. "CicLoadWinStaWinSta0",
  471. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  472. "Global\\CLR_CASOFF_MUTEX",
  473. "Global\\a0956d49-aad6-4ec0-b774-7e982337600d",
  474. "Global\\.net clr networking"
  475.  
  476.  
  477. * Modified Files:
  478. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\__tmp_rar_sfx_access_check_3455203",
  479. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\rwa.ico",
  480. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\dun=spq",
  481. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\FileConstants.jpg",
  482. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\ComboConstants.docx",
  483. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\dih.exe",
  484. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\wkx.txt",
  485. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\opr.pdf",
  486. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\pqx.dat",
  487. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\wba.ppt",
  488. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\hde.mp4",
  489. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\dge.icm",
  490. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\nva.jpg",
  491. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\uic.icm",
  492. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\qlx.icm",
  493. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\cov.mp4",
  494. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\ait.dat",
  495. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\bah.icm",
  496. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\qhg.xl",
  497. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\meg.mp3",
  498. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\pgt.docx",
  499. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\omi.mp3",
  500. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\rbf.ico",
  501. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\ntl.docx",
  502. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\pgr.ico",
  503. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\tvw.icm",
  504. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\mhp.dat",
  505. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\paj.icm",
  506. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\nug.dat",
  507. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\soo.mp3",
  508. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\uik.jpg",
  509. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\ctr.xl",
  510. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\bdv.docx",
  511. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\ukm.bmp",
  512. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\kwr.jpg",
  513. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\dbi.ico",
  514. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\lgw.icm",
  515. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\bjt.ppt",
  516. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\hmm.dat",
  517. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\crq.jpg",
  518. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\aou.xl",
  519. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\cah.xl",
  520. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\req.bmp",
  521. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\lcd.ppt",
  522. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\vtw.ppt",
  523. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\xxk.bmp",
  524. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\jsp.xl",
  525. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\FTHJZ",
  526. "C:\\Users\\user\\AppData\\Roaming\\C1515A12-1764-4632-ACE9-A9DFF9253200\\run.dat"
  527.  
  528.  
  529. * Deleted Files:
  530. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\__tmp_rar_sfx_access_check_3455203",
  531. "C:\\Users\\user\\AppData\\Local\\Temp\\81911458\\FTHJZ",
  532. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe:Zone.Identifier"
  533.  
  534.  
  535. * Modified Registry Keys:
  536. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate"
  537.  
  538.  
  539. * Deleted Registry Keys:
  540.  
  541. * DNS Communications:
  542.  
  543. "type": "A",
  544. "request": "femolampa.tk",
  545. "answers":
  546.  
  547. "data": "185.247.228.54",
  548. "type": "A"
  549.  
  550.  
  551.  
  552.  
  553. "type": "A",
  554. "request": "tojah77.duckdns.org",
  555. "answers":
  556.  
  557. "data": "185.247.228.54",
  558. "type": "A"
  559.  
  560.  
  561.  
  562.  
  563.  
  564. * Domains:
  565.  
  566. "ip": "185.247.228.54",
  567. "domain": "femolampa.tk"
  568.  
  569.  
  570. "ip": "185.247.228.54",
  571. "domain": "tojah77.duckdns.org"
  572.  
  573.  
  574.  
  575. * Network Communication - ICMP:
  576.  
  577. * Network Communication - HTTP:
  578.  
  579. * Network Communication - SMTP:
  580.  
  581. * Network Communication - Hosts:
  582.  
  583. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!