API tools faq
paste
paladin316

Exes_770b27ef5143408e5b6faa04cdbafc36_1_2019-07-15_21_30.txt

paladin316
Jul 15th, 2019
2,144
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 14.41 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Kazy"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_770b27ef5143408e5b6faa04cdbafc36.1"
  7. * File Size: 3379325
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive"
  9. * SHA256: "7de80327dbc62f345cd94166259646dc5216d295661a5dac34379b8d936cf02b"
  10. * MD5: "770b27ef5143408e5b6faa04cdbafc36"
  11. * SHA1: "f151f99146dd8648cedb2735ee3e71357c4bad92"
  12. * SHA512: "ccfba9098de436545b941812e344c80696e203dc23a79c9a24d829cc278526079e1b3d9ce13076a18643a3422f9f564b28361784dac4612898651074eb08151b"
  13. * CRC32: "33729CF8"
  14. * SSDEEP: "98304:Dp8CuVg3V+6srUDaKRQ2BwxAlew3K4VIpH24jb3GBwoUUWi:DK5L6soUx+ewKUi2w3o7D"
  15.  
  16. * Process Execution:
  17. "Exes_770b27ef5143408e5b6faa04cdbafc36.1",
  18. "cmd.exe",
  19. "TeamViewer 5.0.9104.exe",
  20. "full.exe",
  21. "msiexec.exe",
  22. "cmd.exe",
  23. "regedit.exe"
  24.  
  25.  
  26. * Executed Commands:
  27. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\install_full.cmd ",
  28. "\"TeamViewer 5.0.9104.exe\" -ai1",
  29. "full.exe ",
  30. "\"C:\\Windows\\System32\\cmd.exe\" /c If Exist \"C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\settings.reg\" (REGEDIT /S \"C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\settings.reg\") Else (REGEDIT /S settings.reg)",
  31. "cmd /c If Exist \"C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\settings.reg\" (REGEDIT /S \"C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\settings.reg\") Else (REGEDIT /S settings.reg)",
  32. "msiexec.exe /i TeamViewer.msi /qb /norestart",
  33. "C:\\Windows\\system32\\regedit.exe REGEDIT /S settings.reg"
  34.  
  35.  
  36. * Signatures Detected:
  37.  
  38. "Description": "Creates RWX memory",
  39. "Details":
  40.  
  41.  
  42. "Description": "Reads data out of its own binary image",
  43. "Details":
  44.  
  45. "self_read": "process: Exes_770b27ef5143408e5b6faa04cdbafc36.1, pid: 1756, offset: 0x00000000, length: 0x00000007"
  46.  
  47.  
  48. "self_read": "process: Exes_770b27ef5143408e5b6faa04cdbafc36.1, pid: 1756, offset: 0x00000000, length: 0x00002000"
  49.  
  50.  
  51. "self_read": "process: Exes_770b27ef5143408e5b6faa04cdbafc36.1, pid: 1756, offset: 0x00000007, length: 0x0007fff0"
  52.  
  53.  
  54. "self_read": "process: Exes_770b27ef5143408e5b6faa04cdbafc36.1, pid: 1756, offset: 0x00001ff0, length: 0x00002000"
  55.  
  56.  
  57. "self_read": "process: Exes_770b27ef5143408e5b6faa04cdbafc36.1, pid: 1756, offset: 0x00003fe0, length: 0x00002000"
  58.  
  59.  
  60. "self_read": "process: Exes_770b27ef5143408e5b6faa04cdbafc36.1, pid: 1756, offset: 0x00005fd0, length: 0x00002000"
  61.  
  62.  
  63. "self_read": "process: Exes_770b27ef5143408e5b6faa04cdbafc36.1, pid: 1756, offset: 0x00007fc0, length: 0x00002000"
  64.  
  65.  
  66. "self_read": "process: Exes_770b27ef5143408e5b6faa04cdbafc36.1, pid: 1756, offset: 0x00009fb0, length: 0x00002000"
  67.  
  68.  
  69. "self_read": "process: Exes_770b27ef5143408e5b6faa04cdbafc36.1, pid: 1756, offset: 0x0000bfa0, length: 0x00002000"
  70.  
  71.  
  72. "self_read": "process: Exes_770b27ef5143408e5b6faa04cdbafc36.1, pid: 1756, offset: 0x0000df90, length: 0x00002000"
  73.  
  74.  
  75. "self_read": "process: Exes_770b27ef5143408e5b6faa04cdbafc36.1, pid: 1756, offset: 0x0000ff80, length: 0x00002000"
  76.  
  77.  
  78. "self_read": "process: Exes_770b27ef5143408e5b6faa04cdbafc36.1, pid: 1756, offset: 0x00011f70, length: 0x00002000"
  79.  
  80.  
  81. "self_read": "process: Exes_770b27ef5143408e5b6faa04cdbafc36.1, pid: 1756, offset: 0x00013f60, length: 0x00002000"
  82.  
  83.  
  84. "self_read": "process: Exes_770b27ef5143408e5b6faa04cdbafc36.1, pid: 1756, offset: 0x00015f50, length: 0x00002000"
  85.  
  86.  
  87. "self_read": "process: Exes_770b27ef5143408e5b6faa04cdbafc36.1, pid: 1756, offset: 0x00017f40, length: 0x00002000"
  88.  
  89.  
  90. "self_read": "process: Exes_770b27ef5143408e5b6faa04cdbafc36.1, pid: 1756, offset: 0x00019200, length: 0x00000037"
  91.  
  92.  
  93. "self_read": "process: Exes_770b27ef5143408e5b6faa04cdbafc36.1, pid: 1756, offset: 0x00019214, length: 0x0031fe69"
  94.  
  95.  
  96. "self_read": "process: TeamViewer 5.0.9104.exe, pid: 1276, offset: 0x00000000, length: 0x0001de16"
  97.  
  98.  
  99. "self_read": "process: TeamViewer 5.0.9104.exe, pid: 1276, offset: 0x00000000, length: 0x0001ffe2"
  100.  
  101.  
  102. "self_read": "process: TeamViewer 5.0.9104.exe, pid: 1276, offset: 0x00000000, length: 0x001000e1"
  103.  
  104.  
  105. "self_read": "process: TeamViewer 5.0.9104.exe, pid: 1276, offset: 0x0001e15c, length: 0x0030e613"
  106.  
  107.  
  108. "self_read": "process: full.exe, pid: 2944, offset: 0x00000000, length: 0x00010000"
  109.  
  110.  
  111. "self_read": "process: full.exe, pid: 2944, offset: 0x0000ffec, length: 0x00010000"
  112.  
  113.  
  114. "self_read": "process: full.exe, pid: 2944, offset: 0x0001ffd8, length: 0x00010000"
  115.  
  116.  
  117. "self_read": "process: full.exe, pid: 2944, offset: 0x00032814, length: 0x000004d2"
  118.  
  119.  
  120. "self_read": "process: full.exe, pid: 2944, offset: 0x00032828, length: 0x00000200"
  121.  
  122.  
  123. "self_read": "process: full.exe, pid: 2944, offset: 0x0003287e, length: 0x00000468"
  124.  
  125.  
  126.  
  127.  
  128. "Description": "A process created a hidden window",
  129. "Details":
  130.  
  131. "Process": "TeamViewer 5.0.9104.exe -> cmd"
  132.  
  133.  
  134.  
  135.  
  136. "Description": "Drops a binary and executes it",
  137. "Details":
  138.  
  139. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\TeamViewer 5.0.9104.exe"
  140.  
  141.  
  142. "binary": "C:\\Windows\\Temp\\TV\\full.exe"
  143.  
  144.  
  145.  
  146.  
  147. "Description": "File has been identified by 23 Antiviruses on VirusTotal as malicious",
  148. "Details":
  149.  
  150. "MicroWorld-eScan": "Gen:Variant.Kazy.562022"
  151.  
  152.  
  153. "McAfee": "Artemis!770B27EF5143"
  154.  
  155.  
  156. "F-Prot": "W32/MalwareS.ACEQ"
  157.  
  158.  
  159. "Symantec": "Trojan.ADH.2"
  160.  
  161.  
  162. "Norman": "Suspicious_Gen.NBZN"
  163.  
  164.  
  165. "TrendMicro-HouseCall": "TROJ_GEN.R047C0EC715"
  166.  
  167.  
  168. "BitDefender": "Gen:Variant.Kazy.562022"
  169.  
  170.  
  171. "Ad-Aware": "Gen:Variant.Kazy.562022"
  172.  
  173.  
  174. "Emsisoft": "Gen:Variant.Kazy.562022 (B)"
  175.  
  176.  
  177. "Comodo": "UnclassifiedMalware"
  178.  
  179.  
  180. "F-Secure": "Gen:Variant.Kazy.562022"
  181.  
  182.  
  183. "VIPRE": "Trojan.Win32.Generic!BT"
  184.  
  185.  
  186. "TrendMicro": "TROJ_GEN.R047C0EC715"
  187.  
  188.  
  189. "Cyren": "W32/Risk.ANXE-4483"
  190.  
  191.  
  192. "Jiangmin": "TrojanDownloader.CodecPack.azy"
  193.  
  194.  
  195. "Antiy-AVL": "Trojan/Win32.Chifrax"
  196.  
  197.  
  198. "Kingsoft": "VIRUS_UNKNOWN"
  199.  
  200.  
  201. "GData": "Gen:Variant.Kazy.562022"
  202.  
  203.  
  204. "ALYac": "Gen:Variant.Kazy.562022"
  205.  
  206.  
  207. "AVware": "Trojan.Win32.Generic!BT"
  208.  
  209.  
  210. "Rising": "PE:Trojan.Win32.Generic.12436701!306407169"
  211.  
  212.  
  213. "Ikarus": "Trojan.SuspectCRC"
  214.  
  215.  
  216. "Qihoo-360": "Win32/Trojan.Spy.c74"
  217.  
  218.  
  219.  
  220.  
  221. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  222. "Details":
  223.  
  224. "dropped": "clamav:Win.Trojan.Dropper-5155, sha256:eb60a9f70e2f20a7e4b75fdf000ecbede22534c6ea981161b5977bf0d1890f48 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\TeamViewer 5.0.9104.exe, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  225.  
  226.  
  227.  
  228.  
  229.  
  230. * Started Service:
  231.  
  232. * Mutexes:
  233. "CicLoadWinStaWinSta0",
  234. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  235. "Global\\_MSIExecute",
  236. "DBWinMutex"
  237.  
  238.  
  239. * Modified Files:
  240. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\__tmp_rar_sfx_access_check_1423640",
  241. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\help.cmd",
  242. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\install_full.cmd",
  243. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\install_full_autorun.cmd",
  244. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\install_full_autorun_vpn.cmd",
  245. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\install_full_vpn.cmd",
  246. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\install_host.cmd",
  247. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\install_host_vpn.cmd",
  248. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\install_vpn.cmd",
  249. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\run_portable.cmd",
  250. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\run_portable_cid.cmd",
  251. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\TeamViewer 5.0.9104.exe",
  252. "C:\\Windows\\Temp\\TV\\TeamViewer.msi",
  253. "C:\\Windows\\Temp\\TV\\TeamViewerHost.msi",
  254. "C:\\Windows\\Temp\\TV\\FAQ.chm",
  255. "C:\\Windows\\Temp\\TV\\config.ini",
  256. "C:\\Windows\\Temp\\TV\\TeamViewer.ini",
  257. "C:\\Windows\\Temp\\TV\\x64\\teamviewervpn.cat",
  258. "C:\\Windows\\Temp\\TV\\x86\\teamviewervpn.cat",
  259. "C:\\Windows\\Temp\\TV\\w2k\\TeamViewerVPN.inf",
  260. "C:\\Windows\\Temp\\TV\\x86\\TeamViewerVPN.inf",
  261. "C:\\Windows\\Temp\\TV\\x64\\TeamViewerVPN.inf",
  262. "C:\\Windows\\Temp\\TV\\full.exe",
  263. "C:\\Windows\\Temp\\TV\\fulla.exe",
  264. "C:\\Windows\\Temp\\TV\\host.exe",
  265. "C:\\Windows\\Temp\\TV\\install.exe",
  266. "C:\\Windows\\Temp\\TV\\install64.exe",
  267. "C:\\Windows\\Temp\\TV\\rClientID.exe",
  268. "C:\\Windows\\Temp\\TV\\SAS.exe",
  269. "C:\\Windows\\Temp\\TV\\TeamViewer.exe",
  270. "C:\\Windows\\Temp\\TV\\host\\TeamViewer.exe",
  271. "C:\\Windows\\Temp\\TV\\TeamViewer_Service.exe",
  272. "C:\\Windows\\Temp\\TV\\TVShell.exe",
  273. "C:\\Windows\\Temp\\TV\\Teamviewer_Resource_en.dll",
  274. "C:\\Windows\\Temp\\TV\\Teamviewer_Resource_ru.dll",
  275. "C:\\Windows\\Temp\\TV\\TV.dll",
  276. "C:\\Windows\\Temp\\TV\\tvca.dll",
  277. "C:\\Windows\\Temp\\TV\\x86\\teamviewervpn.sys",
  278. "C:\\Windows\\Temp\\TV\\w2k\\teamviewervpn.sys",
  279. "C:\\Windows\\Temp\\TV\\x64\\teamviewervpn.sys",
  280. "C:\\Program Files (x86)\\Teamviewer\\Version5\\rClientID.exe",
  281. "C:\\Program Files (x86)\\Teamviewer\\Version5\\FAQ.chm",
  282. "C:\\Program Files (x86)\\Teamviewer\\Version5\\TVShell.exe",
  283. "C:\\Program Files (x86)\\Teamviewer\\Version5\\config.ini",
  284. "\\??\\PIPE\\srvsvc",
  285. "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\TeamViewer 5\\Reset ClientID.lnk",
  286. "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\TeamViewer 5\\FAQ.lnk",
  287. "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\TeamViewer 5\\TVShell.lnk"
  288.  
  289.  
  290. * Deleted Files:
  291. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\__tmp_rar_sfx_access_check_1423640",
  292. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0",
  293. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\help.cmd",
  294. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\install_full.cmd",
  295. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\install_full_autorun.cmd",
  296. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\install_full_autorun_vpn.cmd",
  297. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\install_full_vpn.cmd",
  298. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\install_host.cmd",
  299. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\install_host_vpn.cmd",
  300. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\install_vpn.cmd",
  301. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\run_portable.cmd",
  302. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\run_portable_cid.cmd",
  303. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\TeamViewer 5.0.9104.exe",
  304. "C:\\Windows\\Temp\\TV\\config.ini",
  305. "C:\\Windows\\Temp\\TV\\FAQ.chm",
  306. "C:\\Windows\\Temp\\TV\\full.exe",
  307. "C:\\Windows\\Temp\\TV\\fulla.exe",
  308. "C:\\Windows\\Temp\\TV\\host\\TeamViewer.exe",
  309. "C:\\Windows\\Temp\\TV\\host",
  310. "C:\\Windows\\Temp\\TV\\host.exe",
  311. "C:\\Windows\\Temp\\TV\\install.exe",
  312. "C:\\Windows\\Temp\\TV\\install64.exe",
  313. "C:\\Windows\\Temp\\TV\\rClientID.exe",
  314. "C:\\Windows\\Temp\\TV\\SAS.exe",
  315. "C:\\Windows\\Temp\\TV\\TeamViewer.exe",
  316. "C:\\Windows\\Temp\\TV\\TeamViewer.ini",
  317. "C:\\Windows\\Temp\\TV\\TeamViewer.msi",
  318. "C:\\Windows\\Temp\\TV\\TeamViewerHost.msi",
  319. "C:\\Windows\\Temp\\TV\\Teamviewer_Resource_en.dll",
  320. "C:\\Windows\\Temp\\TV\\Teamviewer_Resource_ru.dll",
  321. "C:\\Windows\\Temp\\TV\\TeamViewer_Service.exe",
  322. "C:\\Windows\\Temp\\TV\\TV.dll",
  323. "C:\\Windows\\Temp\\TV\\tvca.dll",
  324. "C:\\Windows\\Temp\\TV\\TVShell.exe",
  325. "C:\\Windows\\Temp\\TV\\w2k\\TeamViewerVPN.inf",
  326. "C:\\Windows\\Temp\\TV\\w2k\\teamviewervpn.sys",
  327. "C:\\Windows\\Temp\\TV\\w2k",
  328. "C:\\Windows\\Temp\\TV\\x64\\teamviewervpn.cat",
  329. "C:\\Windows\\Temp\\TV\\x64\\TeamViewerVPN.inf",
  330. "C:\\Windows\\Temp\\TV\\x64\\teamviewervpn.sys",
  331. "C:\\Windows\\Temp\\TV\\x64",
  332. "C:\\Windows\\Temp\\TV\\x86\\teamviewervpn.cat",
  333. "C:\\Windows\\Temp\\TV\\x86\\TeamViewerVPN.inf",
  334. "C:\\Windows\\Temp\\TV\\x86\\teamviewervpn.sys",
  335. "C:\\Windows\\Temp\\TV\\x86",
  336. "C:\\Windows\\Temp\\TV"
  337.  
  338.  
  339. * Modified Registry Keys:
  340. "HKEY_LOCAL_MACHINE\\SOFTWARE\\TeamViewer\\Version5",
  341. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\TeamViewer\\Version5\\HostInfoDialog",
  342. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\TeamViewer\\Version5\\ManualStop",
  343. "HKEY_CURRENT_USER\\Software\\TeamViewer\\Version5\\MsgBoxDontShow",
  344. "HKEY_CURRENT_USER\\Software\\TeamViewer\\Version5\\MsgBoxDontShow\\QuitWithAutostart",
  345. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\GlobalAssocChangedCounter"
  346.  
  347.  
  348. * Deleted Registry Keys:
  349.  
  350. * DNS Communications:
  351.  
  352. * Domains:
  353.  
  354. * Network Communication - ICMP:
  355.  
  356. * Network Communication - HTTP:
  357.  
  358. * Network Communication - SMTP:
  359.  
  360. * Network Communication - Hosts:
  361.  
  362. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!