API tools faq
paste
Advertisement
paladin316

AgentTesla_e68d921c648e8a7fd09d924b317e04c4_exe_2019-08-19_12_17.txt

paladin316
Aug 19th, 2019
2,067
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 34.67 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "AgentTesla"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "AgentTesla_e68d921c648e8a7fd09d924b317e04c4.exe"
  7. * File Size: 1606504
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "5f0808cb644524e6b6868c9534232afa5bb43845e709eacbeb761002dad0b965"
  10. * MD5: "e68d921c648e8a7fd09d924b317e04c4"
  11. * SHA1: "b66b0de65d009ff961a6a418b09990ddc0f4082b"
  12. * SHA512: "4f730e5e4c40128aa6b746316f5b107b82cfcdb254f23bd79f9e9d4a54833365958a6e58ba016f54cbfd18472bc71a228c9aee3f92d318372b6639697d3f344c"
  13. * CRC32: "02CBC0FF"
  14. * SSDEEP: "49152:95IxDJYZaf2Kpd9GN28Be1h6LIdzfXMf/fBMZ:95IX32KD9GBBI8MhkBMZ"
  15.  
  16. * Process Execution:
  17. "LLmXBZW.exe",
  18. "wscript.exe",
  19. "sfe.exe",
  20. "RegSvcs.exe",
  21. "wscript.exe",
  22. "sfe.exe",
  23. "services.exe",
  24. "svchost.exe",
  25. "WmiPrvSE.exe",
  26. "lsass.exe",
  27. "WMIADAP.exe"
  28.  
  29.  
  30. * Executed Commands:
  31. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\lvu.vbs\"",
  32. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\lvu.vbs ",
  33. "\"C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\sfe.exe\" tfw=ere",
  34. "sfe.exe tfw=ere",
  35. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\run.vbs\"",
  36. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\run.vbs ",
  37. "C:\\Windows\\system32\\lsass.exe"
  38.  
  39.  
  40. * Signatures Detected:
  41.  
  42. "Description": "SetUnhandledExceptionFilter detected (possible anti-debug)",
  43. "Details":
  44.  
  45.  
  46. "Description": "Behavioural detection: Executable code extraction",
  47. "Details":
  48.  
  49.  
  50. "Description": "Creates RWX memory",
  51. "Details":
  52.  
  53.  
  54. "Description": "Guard pages use detected - possible anti-debugging.",
  55. "Details":
  56.  
  57.  
  58. "Description": "Detected script timer window indicative of sleep style evasion",
  59. "Details":
  60.  
  61. "Window": "WSH-Timer"
  62.  
  63.  
  64.  
  65.  
  66. "Description": "A process attempted to delay the analysis task.",
  67. "Details":
  68.  
  69. "Process": "RegSvcs.exe tried to sleep 797 seconds, actually delayed analysis time by 0 seconds"
  70.  
  71.  
  72. "Process": "WmiPrvSE.exe tried to sleep 422 seconds, actually delayed analysis time by 0 seconds"
  73.  
  74.  
  75.  
  76.  
  77. "Description": "Expresses interest in specific running processes",
  78. "Details":
  79.  
  80. "process": "RegSvcs.exe"
  81.  
  82.  
  83.  
  84.  
  85. "Description": "Reads data out of its own binary image",
  86. "Details":
  87.  
  88. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00000000, length: 0x00000007"
  89.  
  90.  
  91. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00000000, length: 0x00002000"
  92.  
  93.  
  94. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00000007, length: 0x00188361"
  95.  
  96.  
  97. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00001ff0, length: 0x00002000"
  98.  
  99.  
  100. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00003fe0, length: 0x00002000"
  101.  
  102.  
  103. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00005fd0, length: 0x00002000"
  104.  
  105.  
  106. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00007fc0, length: 0x00002000"
  107.  
  108.  
  109. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00009fb0, length: 0x00002000"
  110.  
  111.  
  112. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x0000bfa0, length: 0x00002000"
  113.  
  114.  
  115. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x0000df90, length: 0x00002000"
  116.  
  117.  
  118. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x0000ff80, length: 0x00002000"
  119.  
  120.  
  121. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00011f70, length: 0x00002000"
  122.  
  123.  
  124. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00013f60, length: 0x00002000"
  125.  
  126.  
  127. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00015f50, length: 0x00002000"
  128.  
  129.  
  130. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00017f40, length: 0x00002000"
  131.  
  132.  
  133. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00019f30, length: 0x00002000"
  134.  
  135.  
  136. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x0001bf20, length: 0x00002000"
  137.  
  138.  
  139. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x0001df10, length: 0x00002000"
  140.  
  141.  
  142. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x0001ff00, length: 0x00002000"
  143.  
  144.  
  145. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00021ef0, length: 0x00002000"
  146.  
  147.  
  148. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00023ee0, length: 0x00002000"
  149.  
  150.  
  151. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00025ed0, length: 0x00002000"
  152.  
  153.  
  154. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00027ec0, length: 0x00002000"
  155.  
  156.  
  157. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00029eb0, length: 0x00002000"
  158.  
  159.  
  160. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x0002bea0, length: 0x00002000"
  161.  
  162.  
  163. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x0002de90, length: 0x00002000"
  164.  
  165.  
  166. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x0002fe80, length: 0x00002000"
  167.  
  168.  
  169. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00031e70, length: 0x00002000"
  170.  
  171.  
  172. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00033e60, length: 0x00002000"
  173.  
  174.  
  175. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00035e50, length: 0x00002000"
  176.  
  177.  
  178. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00037e40, length: 0x00002000"
  179.  
  180.  
  181. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00039e30, length: 0x00002000"
  182.  
  183.  
  184. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x0003be20, length: 0x00002000"
  185.  
  186.  
  187. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x0003de10, length: 0x00002000"
  188.  
  189.  
  190. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x0003fe00, length: 0x00002000"
  191.  
  192.  
  193. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00041df0, length: 0x00002000"
  194.  
  195.  
  196. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00043de0, length: 0x00002000"
  197.  
  198.  
  199. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00045600, length: 0x0013d9be"
  200.  
  201.  
  202. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x0018319f, length: 0x00000027"
  203.  
  204.  
  205. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x0018336a, length: 0x00000028"
  206.  
  207.  
  208. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00183534, length: 0x00000028"
  209.  
  210.  
  211. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x0018373d, length: 0x00000028"
  212.  
  213.  
  214. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00183939, length: 0x00000028"
  215.  
  216.  
  217. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00183b70, length: 0x00000028"
  218.  
  219.  
  220. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00183d61, length: 0x00000028"
  221.  
  222.  
  223. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00183f5d, length: 0x00000028"
  224.  
  225.  
  226. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x0018413e, length: 0x00000028"
  227.  
  228.  
  229. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00184382, length: 0x00000028"
  230.  
  231.  
  232. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x0018457f, length: 0x00000028"
  233.  
  234.  
  235. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00184760, length: 0x00000028"
  236.  
  237.  
  238. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00184949, length: 0x00000029"
  239.  
  240.  
  241. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00184b1c, length: 0x00000028"
  242.  
  243.  
  244. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00184ce9, length: 0x00000028"
  245.  
  246.  
  247. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00184eba, length: 0x00000028"
  248.  
  249.  
  250. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x001850b8, length: 0x00000027"
  251.  
  252.  
  253. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00185299, length: 0x00000028"
  254.  
  255.  
  256. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x0018547b, length: 0x00000028"
  257.  
  258.  
  259. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00185669, length: 0x00000028"
  260.  
  261.  
  262. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00185840, length: 0x00000028"
  263.  
  264.  
  265. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00185a3b, length: 0x00000027"
  266.  
  267.  
  268. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00185c2b, length: 0x00000028"
  269.  
  270.  
  271. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00185e0d, length: 0x00000028"
  272.  
  273.  
  274. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00186003, length: 0x00000028"
  275.  
  276.  
  277. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x001861d1, length: 0x00000028"
  278.  
  279.  
  280. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x001863a8, length: 0x00000028"
  281.  
  282.  
  283. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x0018657a, length: 0x00000028"
  284.  
  285.  
  286. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00186762, length: 0x00000028"
  287.  
  288.  
  289. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x0018698d, length: 0x00000028"
  290.  
  291.  
  292. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00186b5e, length: 0x00000027"
  293.  
  294.  
  295. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00186d46, length: 0x00000029"
  296.  
  297.  
  298. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00186f0f, length: 0x00000028"
  299.  
  300.  
  301. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x001870e7, length: 0x00000028"
  302.  
  303.  
  304. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x001872d2, length: 0x00000028"
  305.  
  306.  
  307. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x001874b2, length: 0x00000028"
  308.  
  309.  
  310. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x001876ca, length: 0x00000027"
  311.  
  312.  
  313. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x001878ac, length: 0x00000028"
  314.  
  315.  
  316. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00187a93, length: 0x00000028"
  317.  
  318.  
  319. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00187c9f, length: 0x00000028"
  320.  
  321.  
  322. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x00187eb0, length: 0x00000028"
  323.  
  324.  
  325. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x001880cd, length: 0x00000028"
  326.  
  327.  
  328. "self_read": "process: LLmXBZW.exe, pid: 1964, offset: 0x001882ad, length: 0x0000001b"
  329.  
  330.  
  331. "self_read": "process: wscript.exe, pid: 2532, offset: 0x00000000, length: 0x00000040"
  332.  
  333.  
  334. "self_read": "process: wscript.exe, pid: 2532, offset: 0x000000f0, length: 0x00000018"
  335.  
  336.  
  337. "self_read": "process: wscript.exe, pid: 2532, offset: 0x000001e8, length: 0x00000078"
  338.  
  339.  
  340. "self_read": "process: wscript.exe, pid: 2532, offset: 0x00018000, length: 0x00000020"
  341.  
  342.  
  343. "self_read": "process: wscript.exe, pid: 2532, offset: 0x00018058, length: 0x00000018"
  344.  
  345.  
  346. "self_read": "process: wscript.exe, pid: 2532, offset: 0x000181a8, length: 0x00000018"
  347.  
  348.  
  349. "self_read": "process: wscript.exe, pid: 2532, offset: 0x00018470, length: 0x00000010"
  350.  
  351.  
  352. "self_read": "process: wscript.exe, pid: 2532, offset: 0x00018640, length: 0x00000012"
  353.  
  354.  
  355. "self_read": "process: wscript.exe, pid: 2656, offset: 0x00000000, length: 0x00000040"
  356.  
  357.  
  358. "self_read": "process: wscript.exe, pid: 2656, offset: 0x000000f0, length: 0x00000018"
  359.  
  360.  
  361. "self_read": "process: wscript.exe, pid: 2656, offset: 0x000001e8, length: 0x00000078"
  362.  
  363.  
  364. "self_read": "process: wscript.exe, pid: 2656, offset: 0x00018000, length: 0x00000020"
  365.  
  366.  
  367. "self_read": "process: wscript.exe, pid: 2656, offset: 0x00018058, length: 0x00000018"
  368.  
  369.  
  370. "self_read": "process: wscript.exe, pid: 2656, offset: 0x000181a8, length: 0x00000018"
  371.  
  372.  
  373. "self_read": "process: wscript.exe, pid: 2656, offset: 0x00018470, length: 0x00000010"
  374.  
  375.  
  376. "self_read": "process: wscript.exe, pid: 2656, offset: 0x00018640, length: 0x00000012"
  377.  
  378.  
  379.  
  380.  
  381. "Description": "Drops a binary and executes it",
  382. "Details":
  383.  
  384. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\sfe.exe"
  385.  
  386.  
  387.  
  388.  
  389. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  390. "Details":
  391.  
  392. "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"
  393.  
  394.  
  395. "suspicious_request": "http://checkip.amazonaws.com/"
  396.  
  397.  
  398.  
  399.  
  400. "Description": "Performs some HTTP requests",
  401. "Details":
  402.  
  403. "url": "http://checkip.amazonaws.com/"
  404.  
  405.  
  406.  
  407.  
  408. "Description": "A scripting utility was executed",
  409. "Details":
  410.  
  411. "command": "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\lvu.vbs\""
  412.  
  413.  
  414. "command": "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\run.vbs\""
  415.  
  416.  
  417.  
  418.  
  419. "Description": "Behavioural detection: Injection (Process Hollowing)",
  420. "Details":
  421.  
  422. "Injection": "sfe.exe(1680) -> RegSvcs.exe(2504)"
  423.  
  424.  
  425.  
  426.  
  427. "Description": "Executed a process and injected code into it, probably while unpacking",
  428. "Details":
  429.  
  430. "Injection": "sfe.exe(1680) -> RegSvcs.exe(2504)"
  431.  
  432.  
  433.  
  434.  
  435. "Description": "Attempts to remove evidence of file being downloaded from the Internet",
  436. "Details":
  437.  
  438. "file": "C:\\Users\\user\\AppData\\Roaming\\appgfx\\appgfx.exe:Zone.Identifier"
  439.  
  440.  
  441.  
  442.  
  443. "Description": "Sniffs keystrokes",
  444. "Details":
  445.  
  446. "SetWindowsHookExW": "Process: RegSvcs.exe(2504)"
  447.  
  448.  
  449.  
  450.  
  451. "Description": "Behavioural detection: Injection (inter-process)",
  452. "Details":
  453.  
  454.  
  455. "Description": "Behavioural detection: Injection with CreateRemoteThread in a remote process",
  456. "Details":
  457.  
  458.  
  459. "Description": "Steals private information from local Internet browsers",
  460. "Details":
  461.  
  462. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies"
  463.  
  464.  
  465. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
  466.  
  467.  
  468.  
  469.  
  470. "Description": "Installs itself for autorun at Windows startup",
  471. "Details":
  472.  
  473. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate"
  474.  
  475.  
  476. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\sfe.exe C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\TFW_ER~1"
  477.  
  478.  
  479. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\appgfx"
  480.  
  481.  
  482. "data": "C:\\Users\\user\\AppData\\Roaming\\appgfx\\appgfx.exe"
  483.  
  484.  
  485.  
  486.  
  487. "Description": "Creates a hidden or system file",
  488. "Details":
  489.  
  490. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\sfe.exe"
  491.  
  492.  
  493. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\22586684"
  494.  
  495.  
  496. "file": "C:\\Users\\user\\temp"
  497.  
  498.  
  499.  
  500.  
  501. "Description": "File has been identified by 23 Antiviruses on VirusTotal as malicious",
  502. "Details":
  503.  
  504. "FireEye": "Generic.mg.e68d921c648e8a7f"
  505.  
  506.  
  507. "Malwarebytes": "Trojan.MalPack.AISFX.Generic"
  508.  
  509.  
  510. "K7AntiVirus": "Trojan ( 005559bd1 )"
  511.  
  512.  
  513. "K7GW": "Trojan ( 005559bd1 )"
  514.  
  515.  
  516. "Cybereason": "malicious.65d009"
  517.  
  518.  
  519. "Invincea": "heuristic"
  520.  
  521.  
  522. "APEX": "Malicious"
  523.  
  524.  
  525. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  526.  
  527.  
  528. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  529.  
  530.  
  531. "Trapmine": "suspicious.low.ml.score"
  532.  
  533.  
  534. "Cyren": "W32/AutoIt.EN.gen!Eldorado"
  535.  
  536.  
  537. "Antiy-AVL": "TrojanArcBomb/Win32.Agent"
  538.  
  539.  
  540. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  541.  
  542.  
  543. "AegisLab": "Trojan.BAT.Crypter.tqa8"
  544.  
  545.  
  546. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  547.  
  548.  
  549. "AhnLab-V3": "Malware/Win32.RL_Generic.R286428"
  550.  
  551.  
  552. "Zoner": "Probably RARAutorun"
  553.  
  554.  
  555. "Rising": "Trojan.Win32.Presenoker.a (CLASSIC)"
  556.  
  557.  
  558. "Yandex": "Trojan.Agent!nS7qVYN4VgU"
  559.  
  560.  
  561. "Fortinet": "W32/Generic.AC.45A0E1!tr"
  562.  
  563.  
  564. "AVG": "FileRepMetagen Malware"
  565.  
  566.  
  567. "CrowdStrike": "win/malicious_confidence_90% (D)"
  568.  
  569.  
  570. "Qihoo-360": "HEUR/QVM10.1.4D8F.Malware.Gen"
  571.  
  572.  
  573.  
  574.  
  575. "Description": "Checks the CPU name from registry, possibly for anti-virtualization",
  576. "Details":
  577.  
  578.  
  579. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  580. "Details":
  581.  
  582. "dropped": "clamav:Win.Trojan.Autoit-6922942-0, sha256:fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\sfe.exe, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  583.  
  584.  
  585.  
  586.  
  587. "Description": "Harvests credentials from local FTP client softwares",
  588. "Details":
  589.  
  590. "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\recentservers.xml"
  591.  
  592.  
  593. "file": "C:\\Users\\user\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\"
  594.  
  595.  
  596. "file": "C:\\Users\\user\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\*.xml"
  597.  
  598.  
  599. "file": "C:\\Users\\user\\AppData\\Roaming\\FTPGetter\\servers.xml"
  600.  
  601.  
  602. "file": "C:\\Users\\user\\AppData\\Roaming\\Ipswitch\\WS_FTP\\Sites\\ws_ftp.ini"
  603.  
  604.  
  605. "file": "C:\\cftp\\Ftplist.txt"
  606.  
  607.  
  608. "key": "HKEY_CURRENT_USER\\Software\\FTPWare\\COREFTP\\Sites"
  609.  
  610.  
  611.  
  612.  
  613. "Description": "Harvests information related to installed mail clients",
  614. "Details":
  615.  
  616. "file": "C:\\Users\\user\\AppData\\Roaming\\Thunderbird\\profiles.ini"
  617.  
  618.  
  619. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676"
  620.  
  621.  
  622. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  623.  
  624.  
  625. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Password"
  626.  
  627.  
  628. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
  629.  
  630.  
  631. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP Password"
  632.  
  633.  
  634. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  635.  
  636.  
  637. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP Password"
  638.  
  639.  
  640. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  641.  
  642.  
  643. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Password"
  644.  
  645.  
  646. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
  647.  
  648.  
  649. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Password"
  650.  
  651.  
  652. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Password"
  653.  
  654.  
  655. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
  656.  
  657.  
  658. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Password"
  659.  
  660.  
  661. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Password"
  662.  
  663.  
  664. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
  665.  
  666.  
  667.  
  668.  
  669. "Description": "Collects information to fingerprint the system",
  670. "Details":
  671.  
  672.  
  673.  
  674. * Started Service:
  675. "VaultSvc"
  676.  
  677.  
  678. * Mutexes:
  679. "DefaultTabtip-MainUI",
  680. "Local\\ZoneAttributeCacheCounterMutex",
  681. "Local\\ZonesCacheCounterMutex",
  682. "Local\\ZonesLockedCacheCounterMutex",
  683. "Global\\CLR_PerfMon_WrapMutex",
  684. "Global\\CLR_CASOFF_MUTEX",
  685. "Global\\.net clr networking",
  686. "Local\\_!MSFTHISTORY!_",
  687. "Local\\c:!users!user!appdata!local!microsoft!windows!temporary internet files!content.ie5!",
  688. "Local\\c:!users!user!appdata!roaming!microsoft!windows!cookies!",
  689. "Local\\c:!users!user!appdata!local!microsoft!windows!history!history.ie5!",
  690. "Global\\ADAP_WMI_ENTRY",
  691. "Global\\RefreshRA_Mutex",
  692. "Global\\RefreshRA_Mutex_Lib",
  693. "Global\\RefreshRA_Mutex_Flag"
  694.  
  695.  
  696. * Modified Files:
  697. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\__tmp_rar_sfx_access_check_21251359",
  698. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\mog.txt",
  699. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\tfw=ere",
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\lvu.vbs",
  701. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\sfe.exe",
  702. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\agv.exe",
  703. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\bxh.exe",
  704. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\jsa.xl",
  705. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\ece.mp3",
  706. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\hqk.dat",
  707. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\bdq.pdf",
  708. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\jlg.bin",
  709. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\qwf.pdf",
  710. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\eai.bmp",
  711. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\vxl.cpl",
  712. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\fhv.icm",
  713. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\gtd.pdf",
  714. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\pwk.msc",
  715. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\xbd.xml",
  716. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\jji.ppt",
  717. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\nrw.exe",
  718. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\bee.msc",
  719. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\dix.xl",
  720. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\pce.ini",
  721. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\cei.cpl",
  722. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\lhm.txt",
  723. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\cov.txt",
  724. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\pje.xls",
  725. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\qof.exe",
  726. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\enn.icm",
  727. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\rhe.cpl",
  728. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\eij.bmp",
  729. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\mro.mp3",
  730. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\rao.exe",
  731. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\roi.docx",
  732. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\lrr.xls",
  733. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\ape.txt",
  734. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\ipj.ini",
  735. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\vdw.xl",
  736. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\pcb.dll",
  737. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\jvi.cpl",
  738. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\qbf.ini",
  739. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\viw.pdf",
  740. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\lpl.xl",
  741. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\xno.log",
  742. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\nwc.xls",
  743. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\vax.cpl",
  744. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\uuf.bmp",
  745. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\swj.jpg",
  746. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\jtd.ppt",
  747. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\vrm.xml",
  748. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\ter.cpl",
  749. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\sif.xl",
  750. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\rnu.docx",
  751. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\adv.xls",
  752. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\nrp.jpg",
  753. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\pxj.ico",
  754. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\ssm.xml",
  755. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\rvs.xl",
  756. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\bpa.dll",
  757. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\mnt.xls",
  758. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\fra.cpl",
  759. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\cfn.exe",
  760. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\kmh.msc",
  761. "C:\\Users\\user\\temp\\mog.txt",
  762. "C:\\Users\\user\\AppData\\Local\\Temp\\22586684\\run.vbs",
  763. "C:\\Users\\user\\AppData\\Roaming\\appgfx\\appgfx.exe",
  764. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
  765. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
  766. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
  767. "C:\\Users\\user\\AppData\\Roaming\\nziaz1ut.3t0\\Chrome\\Default\\Cookies",
  768. "C:\\Users\\user\\AppData\\Roaming\\nziaz1ut.3t0.zip",
  769. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  770. "\\??\\WMIDataDevice",
  771. "\\??\\PIPE\\wkssvc",
  772. "\\??\\PIPE\\srvsvc"
  773.  
  774.  
  775. * Deleted Files:
  776. "C:\\Users\\user\\AppData\\Roaming\\appgfx\\appgfx.exe:Zone.Identifier",
  777. "C:\\Users\\user\\AppData\\Roaming\\nziaz1ut.3t0\\Chrome\\Default\\Cookies",
  778. "C:\\Users\\user\\AppData\\Roaming\\nziaz1ut.3t0\\Chrome\\Default",
  779. "C:\\Users\\user\\AppData\\Roaming\\nziaz1ut.3t0\\Chrome",
  780. "C:\\Users\\user\\AppData\\Roaming\\nziaz1ut.3t0",
  781. "C:\\Users\\user\\AppData\\Roaming\\nziaz1ut.3t0.zip"
  782.  
  783.  
  784. * Modified Registry Keys:
  785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  787. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  788. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate",
  789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\appgfx",
  790. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\RegSvcs_RASAPI32",
  791. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegSvcs_RASAPI32\\EnableFileTracing",
  792. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegSvcs_RASAPI32\\EnableConsoleTracing",
  793. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegSvcs_RASAPI32\\FileTracingMask",
  794. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegSvcs_RASAPI32\\ConsoleTracingMask",
  795. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegSvcs_RASAPI32\\MaxFileSize",
  796. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegSvcs_RASAPI32\\FileDirectory"
  797.  
  798.  
  799. * Deleted Registry Keys:
  800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  801. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  803. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  804.  
  805.  
  806. * DNS Communications:
  807.  
  808. "type": "A",
  809. "request": "checkip.amazonaws.com",
  810. "answers":
  811.  
  812. "data": "52.55.255.113",
  813. "type": "A"
  814.  
  815.  
  816. "data": "checkip.check-ip.aws.a2z.com",
  817. "type": "CNAME"
  818.  
  819.  
  820. "data": "52.44.169.135",
  821. "type": "A"
  822.  
  823.  
  824. "data": "checkip.us-east-1.prod.check-ip.aws.a2z.com",
  825. "type": "CNAME"
  826.  
  827.  
  828. "data": "18.205.71.63",
  829. "type": "A"
  830.  
  831.  
  832. "data": "3.224.145.145",
  833. "type": "A"
  834.  
  835.  
  836. "data": "18.204.189.102",
  837. "type": "A"
  838.  
  839.  
  840. "data": "34.196.181.158",
  841. "type": "A"
  842.  
  843.  
  844.  
  845.  
  846. "type": "A",
  847. "request": "server140.web-hosting.com",
  848. "answers":
  849.  
  850. "data": "104.219.248.51",
  851. "type": "A"
  852.  
  853.  
  854.  
  855.  
  856.  
  857. * Domains:
  858.  
  859. "ip": "104.219.248.51",
  860. "domain": "server140.web-hosting.com"
  861.  
  862.  
  863. "ip": "52.44.169.135",
  864. "domain": "checkip.amazonaws.com"
  865.  
  866.  
  867.  
  868. * Network Communication - ICMP:
  869.  
  870. * Network Communication - HTTP:
  871.  
  872. "count": 1,
  873. "body": "",
  874. "uri": "http://checkip.amazonaws.com/",
  875. "user-agent": "",
  876. "method": "GET",
  877. "host": "checkip.amazonaws.com",
  878. "version": "1.1",
  879. "path": "/",
  880. "data": "GET / HTTP/1.1\r\nHost: checkip.amazonaws.com\r\nConnection: Keep-Alive\r\n\r\n",
  881. "port": 80
  882.  
  883.  
  884.  
  885. * Network Communication - SMTP:
  886.  
  887. * Network Communication - Hosts:
  888.  
  889. "country_name": "United States",
  890. "ip": "52.44.169.135",
  891. "inaddrarpa": "",
  892. "hostname": "checkip.amazonaws.com"
  893.  
  894.  
  895. "country_name": "United States",
  896. "ip": "104.219.248.51",
  897. "inaddrarpa": "",
  898. "hostname": "server140.web-hosting.com"
  899.  
  900.  
  901.  
  902. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!