Exes_dbb395378e4e5f8cdc0bdfdeb2c5eb19_msi_2019-07-09_09_30.txt

* MalFamily: "Nymeria"

* MalScore: 10.0

* File Name: "Exes_dbb395378e4e5f8cdc0bdfdeb2c5eb19.msi"
* File Size: 458752
* File Type: "Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 09:56:09 2012, Create Time/Date: Fri Sep 21 09:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: C35CF0AA-9B3F-4903-9F05-EBF606D58D3E Last Saved Time/Date: Tue May 21 11:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0"
* SHA256: "2de9a4fce17e67c70ae3fd9312d975b513e863ceb809e51a7127c2fa3c57fd1b"
* MD5: "dbb395378e4e5f8cdc0bdfdeb2c5eb19"
* SHA1: "c7b2d174f485e331890172ad04145cf7e87ef7ff"
* SHA512: "0f2f2599942e1c61c5eb950b087cd7eb7b1a39f0120f649d42b495cfe8a8858d2e13c35cfe5a679efb25e5760b6627ac92469acddaf7b63041150facd1bc4a3f"
* CRC32: "0E037477"
* SSDEEP: "12288:dER6Wq4aaE6KwyF5L0Y2D1PqL1deW+ovjt2:dEnthEVaPqLzRZZ"

* Process Execution:
    "msiexec.exe"


* Executed Commands:

* Signatures Detected:

        "Description": "Performs some HTTP requests",
        "Details":

                "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"


                "url": "http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D"


                "url": "http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQAU7Bfe6xSRj1%2Bo83zCN%2BY2wTgIAQU1LD0%2FU%2BcQqRs3D0u7ltBGMmtA%2FYCEGbZBgaEG1afQkxO0Kqs%2FzU%3D"




        "Description": "File has been identified by 20 Antiviruses on VirusTotal as malicious",
        "Details":

                "FireEye": "AIT:Trojan.Nymeria.1006"


                "Arcabit": "AIT:Trojan.Nymeria.D3EE"


                "Invincea": "heuristic"


                "TrendMicro-HouseCall": "TROJ_HPUTOTI.SMO"


                "ClamAV": "Win.Packed.LokiBot-6963314-0"


                "Kaspersky": "Trojan-Spy.PowerShell.KeyLogger.c"


                "BitDefender": "AIT:Trojan.Nymeria.1006"


                "Emsisoft": "AIT:Trojan.Nymeria.1006 (B)"


                "F-Secure": "Heuristic.HEUR/AGEN.1007116"


                "TrendMicro": "TROJ_HPUTOTI.SMO"


                "Ikarus": "Trojan.Autoit"


                "Cyren": "W32/Kryptik.QUZK-7259"


                "Microsoft": "Trojan:Win32/Fuery.C!cl"


                "ZoneAlarm": "Trojan-Spy.PowerShell.KeyLogger.c"


                "GData": "AIT:Trojan.Nymeria.1006 (2x)"


                "AhnLab-V3": "Trojan/Win32.AutoIt.C2019675"


                "VBA32": "Trojan-Downloader.Autoit.gen"


                "MAX": "malware (ai score=84)"


                "ESET-NOD32": "a variant of Win32/Autoit.DB"


                "Rising": "Attention.APT-Bait.ContainShellCode!1.9E28 (CLASSIC)"




        "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
        "Details":

                "target": "clamav:Win.Packed.LokiBot-6963314-0, sha256:2de9a4fce17e67c70ae3fd9312d975b513e863ceb809e51a7127c2fa3c57fd1b, type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 09:56:09 2012, Create Time/Date: Fri Sep 21 09:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: C35CF0AA-9B3F-4903-9F05-EBF606D58D3E Last Saved Time/Date: Tue May 21 11:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0"





* Started Service:

* Mutexes:
    "CicLoadWinStaWinSta0",
    "Local\\MSCTF.CtfMonitorInstMutexDefault1",
    "Global\\_MSIExecute"


* Modified Files:

* Deleted Files:

* Modified Registry Keys:

* Deleted Registry Keys:

* DNS Communications:

        "type": "A",
        "request": "ipapi.co",
        "answers":

                "data": "104.25.210.99",
                "type": "A"


                "data": "104.25.209.99",
                "type": "A"




        "type": "A",
        "request": "ocsp.comodoca4.com",
        "answers":

                "data": "t3j2g9x7.stackpathcdn.com",
                "type": "CNAME"


                "data": "151.139.128.14",
                "type": "A"




        "type": "A",
        "request": "vemvemserver.duckdns.org",
        "answers":

                "data": "205.185.125.42",
                "type": "A"





* Domains:

        "ip": "205.185.125.42",
        "domain": "vemvemserver.duckdns.org"


        "ip": "151.139.128.14",
        "domain": "ocsp.comodoca4.com"


        "ip": "104.25.209.99",
        "domain": "ipapi.co"



* Network Communication - ICMP:

* Network Communication - HTTP:

        "count": 1,
        "body": "",
        "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.usertrust.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
        "port": 80


        "count": 1,
        "body": "",
        "uri": "http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.comodoca4.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca4.com\r\n\r\n",
        "port": 80


        "count": 1,
        "body": "",
        "uri": "http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQAU7Bfe6xSRj1%2Bo83zCN%2BY2wTgIAQU1LD0%2FU%2BcQqRs3D0u7ltBGMmtA%2FYCEGbZBgaEG1afQkxO0Kqs%2FzU%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.comodoca4.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQAU7Bfe6xSRj1%2Bo83zCN%2BY2wTgIAQU1LD0%2FU%2BcQqRs3D0u7ltBGMmtA%2FYCEGbZBgaEG1afQkxO0Kqs%2FzU%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQAU7Bfe6xSRj1%2Bo83zCN%2BY2wTgIAQU1LD0%2FU%2BcQqRs3D0u7ltBGMmtA%2FYCEGbZBgaEG1afQkxO0Kqs%2FzU%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca4.com\r\n\r\n",
        "port": 80



* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: