Advertisement
paladin316

818Exes_94ac00a01ef6a0716db4f30b9542bd6c_exe_2019-09-03_13_30.txt

Sep 3rd, 2019
1,323
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 5.20 KB | None | 0 0
  1.  
  2. * ID: 818
  3. * MalFamily: "Propagate"
  4.  
  5. * MalScore: 10.0
  6.  
  7. * File Name: "Exes_94ac00a01ef6a0716db4f30b9542bd6c.exe"
  8. * File Size: 647168
  9. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  10. * SHA256: "345b04a52f037e746def32c492ed043cedf91a8bd2c024a4888874c94138e90f"
  11. * MD5: "94ac00a01ef6a0716db4f30b9542bd6c"
  12. * SHA1: "7060596ad106e8cdf81786ec69c5536b7aab4889"
  13. * SHA512: "1f907161c6348e452e56eda8926413a30fb607edb489b761aac6a80bf202ce974c69f75f3b58e285492aef10d4fb66cc54de11897fe12a09a117b5b86564bd27"
  14. * CRC32: "F24D799B"
  15. * SSDEEP: "12288:zewjVl/fprMU7UFpJX6eM/PY922ku1UVZN4VdQZZEa6PwWdWyOuuw80Q:qAlXpOp41DuKVygZEavWdFru70Q"
  16.  
  17. * Process Execution:
  18. "643fcKYtyfIi.exe"
  19.  
  20.  
  21. * Executed Commands:
  22.  
  23. * Signatures Detected:
  24.  
  25. "Description": "SetUnhandledExceptionFilter detected (possible anti-debug)",
  26. "Details":
  27.  
  28.  
  29. "Description": "Behavioural detection: Executable code extraction",
  30. "Details":
  31.  
  32.  
  33. "Description": "The binary likely contains encrypted or compressed data.",
  34. "Details":
  35.  
  36. "section": "name: .rsrc, entropy: 7.48, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x00023000, virtual_size: 0x00022f94"
  37.  
  38.  
  39.  
  40.  
  41. "Description": "Detects Sandboxie through the presence of a library",
  42. "Details":
  43.  
  44.  
  45. "Description": "File has been identified by 31 Antiviruses on VirusTotal as malicious",
  46. "Details":
  47.  
  48. "FireEye": "Generic.mg.94ac00a01ef6a071"
  49.  
  50.  
  51. "Qihoo-360": "Win32/Trojan.e5c"
  52.  
  53.  
  54. "McAfee": "Artemis!94AC00A01EF6"
  55.  
  56.  
  57. "Cybereason": "malicious.ad106e"
  58.  
  59.  
  60. "Invincea": "heuristic"
  61.  
  62.  
  63. "Symantec": "ML.Attribute.HighConfidence"
  64.  
  65.  
  66. "ESET-NOD32": "Win32/TrojanDownloader.Zurgop.DA"
  67.  
  68.  
  69. "APEX": "Malicious"
  70.  
  71.  
  72. "Paloalto": "generic.ml"
  73.  
  74.  
  75. "GData": "Win32.Trojan-Downloader.SmokeLoader.KYRDR6"
  76.  
  77.  
  78. "Kaspersky": "Trojan.Win32.Propagate.nfh"
  79.  
  80.  
  81. "ViRobot": "Trojan.Win32.Z.Remcos.647168"
  82.  
  83.  
  84. "Avast": "FileRepMalware"
  85.  
  86.  
  87. "Tencent": "Win32.Trojan.Propagate.Htvw"
  88.  
  89.  
  90. "F-Secure": "Trojan.TR/AD.Dofoil.hzauh"
  91.  
  92.  
  93. "TrendMicro": "Mal_HPGen-37b"
  94.  
  95.  
  96. "McAfee-GW-Edition": "BehavesLike.Win32.Dropper.jh"
  97.  
  98.  
  99. "Sophos": "Mal/Generic-S"
  100.  
  101.  
  102. "Webroot": "Trojan.Dropper.Gen"
  103.  
  104.  
  105. "Avira": "TR/AD.Dofoil.hzauh"
  106.  
  107.  
  108. "Microsoft": "Trojan:Win32/Tiggre!plock"
  109.  
  110.  
  111. "AegisLab": "Trojan.Multi.Generic.4!c"
  112.  
  113.  
  114. "ZoneAlarm": "Trojan.Win32.Propagate.nfh"
  115.  
  116.  
  117. "AhnLab-V3": "Trojan/Win32.Smokeldr.C3455604"
  118.  
  119.  
  120. "Acronis": "suspicious"
  121.  
  122.  
  123. "Cylance": "Unsafe"
  124.  
  125.  
  126. "TrendMicro-HouseCall": "Mal_HPGen-37b"
  127.  
  128.  
  129. "Rising": "Spyware.Zbot!8.16B (TFE:1:945xuP4HgU)"
  130.  
  131.  
  132. "Ikarus": "Trojan-Spy.Remcos"
  133.  
  134.  
  135. "AVG": "FileRepMalware"
  136.  
  137.  
  138. "CrowdStrike": "win/malicious_confidence_80% (W)"
  139.  
  140.  
  141.  
  142.  
  143. "Description": "Anomalous binary characteristics",
  144. "Details":
  145.  
  146. "anomaly": "Found duplicated section names"
  147.  
  148.  
  149.  
  150.  
  151.  
  152. * Started Service:
  153.  
  154. * Mutexes:
  155. "RasPbFile"
  156.  
  157.  
  158. * Modified Files:
  159. "\\Device\\KsecDD",
  160. "C:\\Users\\user\\AppData\\Local\\Temp\\D47F.tmp"
  161.  
  162.  
  163. * Deleted Files:
  164. "C:\\Users\\user\\AppData\\Local\\Temp\\D47F.tmp"
  165.  
  166.  
  167. * Modified Registry Keys:
  168. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\643fcKYtyfIi_RASDLG",
  169. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\643fcKYtyfIi_RASDLG\\EnableFileTracing",
  170. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\643fcKYtyfIi_RASDLG\\EnableConsoleTracing",
  171. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\643fcKYtyfIi_RASDLG\\FileTracingMask",
  172. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\643fcKYtyfIi_RASDLG\\ConsoleTracingMask",
  173. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\643fcKYtyfIi_RASDLG\\MaxFileSize",
  174. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\643fcKYtyfIi_RASDLG\\FileDirectory"
  175.  
  176.  
  177. * Deleted Registry Keys:
  178.  
  179. * DNS Communications:
  180.  
  181. * Domains:
  182.  
  183. * Network Communication - ICMP:
  184.  
  185. * Network Communication - HTTP:
  186.  
  187. * Network Communication - SMTP:
  188.  
  189. * Network Communication - Hosts:
  190.  
  191. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement