API tools faq
paste
paladin316

Exes_571b766a2ae94980ab5fb1f99717bfbb_exe_2019-07-29_21_30.txt

paladin316
Jul 29th, 2019
2,210
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 31.52 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_571b766a2ae94980ab5fb1f99717bfbb.exe"
  7. * File Size: 1359166
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "7ec778125021b58e3c2eb02398e9e55adb373ff5d5c408e4183b8d2ae10f68e6"
  10. * MD5: "571b766a2ae94980ab5fb1f99717bfbb"
  11. * SHA1: "9b49f61f4d8a2e1251bd7e3ca4edcb082f98944a"
  12. * SHA512: "bb467b5f471223d868bafa89d0f27d9dd667ef8cc34f44c4a1baedc3e653f91fdd7c12e271593f125215e9d4c0ec32e7eb3a926238173456ddbf633e5e8a77ce"
  13. * CRC32: "BFD014C1"
  14. * SSDEEP: "24576:bNA3R5drXTLPdmKvSUTp0+qDa4F9lHSeDbeibsRfGZojnTIaXf:G5PlmSSUT2vDbF/HSUbsR0aP"
  15.  
  16. * Process Execution:
  17. "Exes_571b766a2ae94980ab5fb1f99717bfbb.exe",
  18. "wscript.exe",
  19. "doj.exe",
  20. "doj.exe",
  21. "RegSvcs.exe",
  22. "powershell.exe"
  23.  
  24.  
  25. * Executed Commands:
  26. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\fip.vbs\"",
  27. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\fip.vbs ",
  28. "\"C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\doj.exe\" wid=obr",
  29. "doj.exe wid=obr",
  30. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\doj.exe C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\WXUWP",
  31. "powershell Add-MpPreference -ExclusionPath C:\\"
  32.  
  33.  
  34. * Signatures Detected:
  35.  
  36. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  37. "Details":
  38.  
  39. "IP": "144.168.239.34:1609"
  40.  
  41.  
  42.  
  43.  
  44. "Description": "Possible date expiration check, exits too soon after checking local time",
  45. "Details":
  46.  
  47. "process": "doj.exe, PID 2248"
  48.  
  49.  
  50.  
  51.  
  52. "Description": "Creates RWX memory",
  53. "Details":
  54.  
  55.  
  56. "Description": "Detected script timer window indicative of sleep style evasion",
  57. "Details":
  58.  
  59. "Window": "WSH-Timer"
  60.  
  61.  
  62.  
  63.  
  64. "Description": "Reads data out of its own binary image",
  65. "Details":
  66.  
  67. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00000000, length: 0x00000007"
  68.  
  69.  
  70. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00000000, length: 0x00002000"
  71.  
  72.  
  73. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00000007, length: 0x0014bd37"
  74.  
  75.  
  76. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00001ff0, length: 0x00002000"
  77.  
  78.  
  79. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00003fe0, length: 0x00002000"
  80.  
  81.  
  82. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00005fd0, length: 0x00002000"
  83.  
  84.  
  85. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00007fc0, length: 0x00002000"
  86.  
  87.  
  88. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00009fb0, length: 0x00002000"
  89.  
  90.  
  91. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0000bfa0, length: 0x00002000"
  92.  
  93.  
  94. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0000df90, length: 0x00002000"
  95.  
  96.  
  97. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0000ff80, length: 0x00002000"
  98.  
  99.  
  100. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00011f70, length: 0x00002000"
  101.  
  102.  
  103. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00013f60, length: 0x00002000"
  104.  
  105.  
  106. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00015f50, length: 0x00002000"
  107.  
  108.  
  109. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00017f40, length: 0x00002000"
  110.  
  111.  
  112. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00019f30, length: 0x00002000"
  113.  
  114.  
  115. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0001bf20, length: 0x00002000"
  116.  
  117.  
  118. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0001df10, length: 0x00002000"
  119.  
  120.  
  121. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0001ff00, length: 0x00002000"
  122.  
  123.  
  124. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00021ef0, length: 0x00002000"
  125.  
  126.  
  127. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00023ee0, length: 0x00002000"
  128.  
  129.  
  130. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00025ed0, length: 0x00002000"
  131.  
  132.  
  133. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00027ec0, length: 0x00002000"
  134.  
  135.  
  136. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00029eb0, length: 0x00002000"
  137.  
  138.  
  139. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0002bea0, length: 0x00002000"
  140.  
  141.  
  142. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0002de90, length: 0x00002000"
  143.  
  144.  
  145. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0002fe80, length: 0x00002000"
  146.  
  147.  
  148. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00031e70, length: 0x00002000"
  149.  
  150.  
  151. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00033e60, length: 0x00002000"
  152.  
  153.  
  154. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00035e50, length: 0x00002000"
  155.  
  156.  
  157. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00037e40, length: 0x00002000"
  158.  
  159.  
  160. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00039e30, length: 0x00002000"
  161.  
  162.  
  163. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0003be20, length: 0x00002000"
  164.  
  165.  
  166. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0003de10, length: 0x00002000"
  167.  
  168.  
  169. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0003fe00, length: 0x00002000"
  170.  
  171.  
  172. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00041df0, length: 0x00002000"
  173.  
  174.  
  175. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00043de0, length: 0x00002000"
  176.  
  177.  
  178. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00045dd0, length: 0x00002000"
  179.  
  180.  
  181. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00047dc0, length: 0x00002000"
  182.  
  183.  
  184. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00049db0, length: 0x00002000"
  185.  
  186.  
  187. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0004bda0, length: 0x00002000"
  188.  
  189.  
  190. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0004dd90, length: 0x00002000"
  191.  
  192.  
  193. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0004fd80, length: 0x00002000"
  194.  
  195.  
  196. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00050a00, length: 0x00000034"
  197.  
  198.  
  199. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00050a1a, length: 0x000f765e"
  200.  
  201.  
  202. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00148262, length: 0x00000028"
  203.  
  204.  
  205. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00148431, length: 0x00000028"
  206.  
  207.  
  208. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00148612, length: 0x00000029"
  209.  
  210.  
  211. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x001487f3, length: 0x00000027"
  212.  
  213.  
  214. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x001489bd, length: 0x00000027"
  215.  
  216.  
  217. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00148b87, length: 0x00000027"
  218.  
  219.  
  220. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00148db4, length: 0x00000028"
  221.  
  222.  
  223. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00148faa, length: 0x00000028"
  224.  
  225.  
  226. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x001491ce, length: 0x00000028"
  227.  
  228.  
  229. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x001493d2, length: 0x00000029"
  230.  
  231.  
  232. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x001495d7, length: 0x00000028"
  233.  
  234.  
  235. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x001497b5, length: 0x00000027"
  236.  
  237.  
  238. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x001499b0, length: 0x00000028"
  239.  
  240.  
  241. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00149ba2, length: 0x00000028"
  242.  
  243.  
  244. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00149d90, length: 0x00000028"
  245.  
  246.  
  247. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x00149f79, length: 0x00000028"
  248.  
  249.  
  250. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0014a14e, length: 0x00000028"
  251.  
  252.  
  253. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0014a339, length: 0x00000028"
  254.  
  255.  
  256. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0014a522, length: 0x00000028"
  257.  
  258.  
  259. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0014a6f6, length: 0x00000028"
  260.  
  261.  
  262. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0014a907, length: 0x00000028"
  263.  
  264.  
  265. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0014aafe, length: 0x00000029"
  266.  
  267.  
  268. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0014ad08, length: 0x00000028"
  269.  
  270.  
  271. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0014af46, length: 0x00000028"
  272.  
  273.  
  274. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0014b114, length: 0x00000028"
  275.  
  276.  
  277. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0014b2ef, length: 0x00000028"
  278.  
  279.  
  280. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0014b4de, length: 0x00000028"
  281.  
  282.  
  283. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0014b6d7, length: 0x00000028"
  284.  
  285.  
  286. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0014b8ab, length: 0x00000028"
  287.  
  288.  
  289. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0014ba8b, length: 0x00000028"
  290.  
  291.  
  292. "self_read": "process: Exes_571b766a2ae94980ab5fb1f99717bfbb.exe, pid: 2936, offset: 0x0014bc81, length: 0x0000001b"
  293.  
  294.  
  295. "self_read": "process: wscript.exe, pid: 424, offset: 0x00000000, length: 0x00000040"
  296.  
  297.  
  298. "self_read": "process: wscript.exe, pid: 424, offset: 0x000000f0, length: 0x00000018"
  299.  
  300.  
  301. "self_read": "process: wscript.exe, pid: 424, offset: 0x000001e8, length: 0x00000078"
  302.  
  303.  
  304. "self_read": "process: wscript.exe, pid: 424, offset: 0x00018000, length: 0x00000020"
  305.  
  306.  
  307. "self_read": "process: wscript.exe, pid: 424, offset: 0x00018058, length: 0x00000018"
  308.  
  309.  
  310. "self_read": "process: wscript.exe, pid: 424, offset: 0x000181a8, length: 0x00000018"
  311.  
  312.  
  313. "self_read": "process: wscript.exe, pid: 424, offset: 0x00018470, length: 0x00000010"
  314.  
  315.  
  316. "self_read": "process: wscript.exe, pid: 424, offset: 0x00018640, length: 0x00000012"
  317.  
  318.  
  319.  
  320.  
  321. "Description": "Drops a binary and executes it",
  322. "Details":
  323.  
  324. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\doj.exe"
  325.  
  326.  
  327.  
  328.  
  329. "Description": "Executed a process and injected code into it, probably while unpacking",
  330. "Details":
  331.  
  332. "Injection": "doj.exe(2884) -> RegSvcs.exe(2568)"
  333.  
  334.  
  335.  
  336.  
  337. "Description": "Attempts to remove evidence of file being downloaded from the Internet",
  338. "Details":
  339.  
  340. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\:Zone.Identifier"
  341.  
  342.  
  343.  
  344.  
  345. "Description": "Installs itself for autorun at Windows startup",
  346. "Details":
  347.  
  348. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\qwertyuhgfdrtr.exe"
  349.  
  350.  
  351. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\doj.exe C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\WID_OB~1"
  352.  
  353.  
  354.  
  355.  
  356. "Description": "Creates a hidden or system file",
  357. "Details":
  358.  
  359. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\doj.exe"
  360.  
  361.  
  362. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\ans.ico"
  363.  
  364.  
  365. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\blw.ppt"
  366.  
  367.  
  368. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\das.xl"
  369.  
  370.  
  371. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\eed.bmp"
  372.  
  373.  
  374. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\fip.vbs"
  375.  
  376.  
  377. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\fmn.bmp"
  378.  
  379.  
  380. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\fpd.bmp"
  381.  
  382.  
  383. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\frk.xl"
  384.  
  385.  
  386. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\gvw.docx"
  387.  
  388.  
  389. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\heb.docx"
  390.  
  391.  
  392. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\hhj.mp3"
  393.  
  394.  
  395. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\iqf.ppt"
  396.  
  397.  
  398. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\ixi.txt"
  399.  
  400.  
  401. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\jif.txt"
  402.  
  403.  
  404. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\kct.xl"
  405.  
  406.  
  407. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\kfo.docx"
  408.  
  409.  
  410. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\kls.ppt"
  411.  
  412.  
  413. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\kru.bmp"
  414.  
  415.  
  416. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\led.ppt"
  417.  
  418.  
  419. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\lim.mp3"
  420.  
  421.  
  422. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\loh.pdf"
  423.  
  424.  
  425. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\lus.pdf"
  426.  
  427.  
  428. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\lxq.jpg"
  429.  
  430.  
  431. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\mch.mp4"
  432.  
  433.  
  434. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\ofu.ppt"
  435.  
  436.  
  437. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\okh.jpg"
  438.  
  439.  
  440. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\onx.jpg"
  441.  
  442.  
  443. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\pjv.jpg"
  444.  
  445.  
  446. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\pug.pdf"
  447.  
  448.  
  449. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\rba.ico"
  450.  
  451.  
  452. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\rhp.jpg"
  453.  
  454.  
  455. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\rpr.bmp"
  456.  
  457.  
  458. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\rqt.ico"
  459.  
  460.  
  461. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\rvc.xl"
  462.  
  463.  
  464. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\sfs.mp3"
  465.  
  466.  
  467. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\sgt.docx"
  468.  
  469.  
  470. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\shf.ico"
  471.  
  472.  
  473. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\stf.mp3"
  474.  
  475.  
  476. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\swt.icm"
  477.  
  478.  
  479. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\tbe.bmp"
  480.  
  481.  
  482. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\tdc.docx"
  483.  
  484.  
  485. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\tox.ico"
  486.  
  487.  
  488. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\ttn.icm"
  489.  
  490.  
  491. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\tuf.mp3"
  492.  
  493.  
  494. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\vbv.docx"
  495.  
  496.  
  497. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\vqe.jpg"
  498.  
  499.  
  500. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\wid=obr"
  501.  
  502.  
  503. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\wkn.mp3"
  504.  
  505.  
  506. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\wws.bmp"
  507.  
  508.  
  509. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\xbp.mp4"
  510.  
  511.  
  512. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\xmh.ppt"
  513.  
  514.  
  515. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\71414341"
  516.  
  517.  
  518.  
  519.  
  520. "Description": "File has been identified by 36 Antiviruses on VirusTotal as malicious",
  521. "Details":
  522.  
  523. "MicroWorld-eScan": "Trojan.GenericKD.41493139"
  524.  
  525.  
  526. "McAfee": "Artemis!571B766A2AE9"
  527.  
  528.  
  529. "BitDefender": "Trojan.GenericKD.41493139"
  530.  
  531.  
  532. "K7GW": "Riskware ( 0040eff71 )"
  533.  
  534.  
  535. "K7AntiVirus": "Riskware ( 0040eff71 )"
  536.  
  537.  
  538. "Symantec": "Trojan.Gen.2"
  539.  
  540.  
  541. "ESET-NOD32": "Win32/Injector.Autoit.EDS"
  542.  
  543.  
  544. "APEX": "Malicious"
  545.  
  546.  
  547. "Avast": "Win32:Trojan-gen"
  548.  
  549.  
  550. "GData": "Trojan.GenericKD.41493139"
  551.  
  552.  
  553. "Kaspersky": "Exploit.Win32.BypassUAC.xag"
  554.  
  555.  
  556. "Alibaba": "Trojan:Win32/Starter.ali2000005"
  557.  
  558.  
  559. "NANO-Antivirus": "Exploit.Win32.BypassUAC.ftussy"
  560.  
  561.  
  562. "AegisLab": "Trojan.Multi.Generic.4!c"
  563.  
  564.  
  565. "Tencent": "Win32.Exploit.Bypassuac.Stuh"
  566.  
  567.  
  568. "Endgame": "malicious (high confidence)"
  569.  
  570.  
  571. "Sophos": "Mal/Generic-S"
  572.  
  573.  
  574. "Comodo": "Malware@#3jmj9rqxy1xm7"
  575.  
  576.  
  577. "Invincea": "heuristic"
  578.  
  579.  
  580. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  581.  
  582.  
  583. "FireEye": "Generic.mg.571b766a2ae94980"
  584.  
  585.  
  586. "Emsisoft": "Trojan.GenericKD.41493139 (B)"
  587.  
  588.  
  589. "Paloalto": "generic.ml"
  590.  
  591.  
  592. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  593.  
  594.  
  595. "Arcabit": "Trojan.Generic.D2792293"
  596.  
  597.  
  598. "ZoneAlarm": "Exploit.Win32.BypassUAC.xag"
  599.  
  600.  
  601. "AhnLab-V3": "Trojan/Win32.RL_Agent.R273974"
  602.  
  603.  
  604. "ALYac": "Trojan.GenericKD.41493139"
  605.  
  606.  
  607. "MAX": "malware (ai score=100)"
  608.  
  609.  
  610. "Ad-Aware": "Trojan.GenericKD.41493139"
  611.  
  612.  
  613. "Zoner": "Probably RARAutorun"
  614.  
  615.  
  616. "Fortinet": "AutoIt/Injector.EDS!tr"
  617.  
  618.  
  619. "AVG": "Win32:Trojan-gen"
  620.  
  621.  
  622. "Cybereason": "malicious.f4d8a2"
  623.  
  624.  
  625. "CrowdStrike": "win/malicious_confidence_80% (W)"
  626.  
  627.  
  628. "Qihoo-360": "Win32/Trojan.Exploit.b71"
  629.  
  630.  
  631.  
  632.  
  633. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  634. "Details":
  635.  
  636. "target": "clamav:Win.Malware.Autoit-7082918-0, sha256:7ec778125021b58e3c2eb02398e9e55adb373ff5d5c408e4183b8d2ae10f68e6, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  637.  
  638.  
  639.  
  640.  
  641.  
  642. * Started Service:
  643.  
  644. * Mutexes:
  645. "DefaultTabtip-MainUI",
  646. "CicLoadWinStaWinSta0",
  647. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  648. "Local\\ZoneAttributeCacheCounterMutex",
  649. "Local\\ZonesCacheCounterMutex",
  650. "Local\\ZonesLockedCacheCounterMutex",
  651. "Global\\CLR_CASOFF_MUTEX"
  652.  
  653.  
  654. * Modified Files:
  655. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\__tmp_rar_sfx_access_check_23611906",
  656. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\swt.icm",
  657. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\wid=obr",
  658. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\fip.vbs",
  659. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\doj.exe",
  660. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\fmn.bmp",
  661. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\heb.docx",
  662. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\ixi.txt",
  663. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\ans.ico",
  664. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\kru.bmp",
  665. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\loh.pdf",
  666. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\ofu.ppt",
  667. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\vqe.jpg",
  668. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\okh.jpg",
  669. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\lus.pdf",
  670. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\ttn.icm",
  671. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\tbe.bmp",
  672. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\lxq.jpg",
  673. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\rpr.bmp",
  674. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\mch.mp4",
  675. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\gvw.docx",
  676. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\wkn.mp3",
  677. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\kfo.docx",
  678. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\fpd.bmp",
  679. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\jif.txt",
  680. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\sgt.docx",
  681. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\kct.xl",
  682. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\das.xl",
  683. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\rvc.xl",
  684. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\eed.bmp",
  685. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\tuf.mp3",
  686. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\blw.ppt",
  687. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\vbv.docx",
  688. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\kls.ppt",
  689. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\frk.xl",
  690. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\rba.ico",
  691. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\onx.jpg",
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\sfs.mp3",
  693. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\lim.mp3",
  694. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\rqt.ico",
  695. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\shf.ico",
  696. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\pug.pdf",
  697. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\iqf.ppt",
  698. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\stf.mp3",
  699. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\tdc.docx",
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\led.ppt",
  701. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\pjv.jpg",
  702. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\rhp.jpg",
  703. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\xbp.mp4",
  704. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\tox.ico",
  705. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\xmh.ppt",
  706. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\wws.bmp",
  707. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\hhj.mp3",
  708. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\WXUWP",
  709. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  710. "\\??\\PIPE\\srvsvc",
  711. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\V7OXTWKXHX8X8QNSUMFT.temp",
  712. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms"
  713.  
  714.  
  715. * Deleted Files:
  716. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\__tmp_rar_sfx_access_check_23611906",
  717. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\WXUWP",
  718. "C:\\Users\\user\\AppData\\Local\\Temp\\71414341\\:Zone.Identifier",
  719. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\V7OXTWKXHX8X8QNSUMFT.temp",
  720. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1212.23651468",
  721. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1212.23651468",
  722. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1212.23651468"
  723.  
  724.  
  725. * Modified Registry Keys:
  726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  728. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  729. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\qwertyuhgfdrtr.exe",
  730. "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MediaResources\\msvideo",
  731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPer1_0Server",
  732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerServer",
  733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\OH92QW7M7S"
  734.  
  735.  
  736. * Deleted Registry Keys:
  737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  738. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  740. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  741.  
  742.  
  743. * DNS Communications:
  744.  
  745. "type": "A",
  746. "request": "kartelicemoney.duckdns.org",
  747. "answers":
  748.  
  749. "data": "144.168.239.34",
  750. "type": "A"
  751.  
  752.  
  753.  
  754.  
  755.  
  756. * Domains:
  757.  
  758. "ip": "144.168.239.34",
  759. "domain": "kartelicemoney.duckdns.org"
  760.  
  761.  
  762.  
  763. * Network Communication - ICMP:
  764.  
  765. * Network Communication - HTTP:
  766.  
  767. * Network Communication - SMTP:
  768.  
  769. * Network Communication - Hosts:
  770.  
  771. * Network Communication - IRC:
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!