Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- * ID: 818
- * MalFamily: "Propagate"
- * MalScore: 10.0
- * File Name: "Exes_94ac00a01ef6a0716db4f30b9542bd6c.exe"
- * File Size: 647168
- * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
- * SHA256: "345b04a52f037e746def32c492ed043cedf91a8bd2c024a4888874c94138e90f"
- * MD5: "94ac00a01ef6a0716db4f30b9542bd6c"
- * SHA1: "7060596ad106e8cdf81786ec69c5536b7aab4889"
- * SHA512: "1f907161c6348e452e56eda8926413a30fb607edb489b761aac6a80bf202ce974c69f75f3b58e285492aef10d4fb66cc54de11897fe12a09a117b5b86564bd27"
- * CRC32: "F24D799B"
- * SSDEEP: "12288:zewjVl/fprMU7UFpJX6eM/PY922ku1UVZN4VdQZZEa6PwWdWyOuuw80Q:qAlXpOp41DuKVygZEavWdFru70Q"
- * Process Execution:
- "643fcKYtyfIi.exe"
- * Executed Commands:
- * Signatures Detected:
- "Description": "SetUnhandledExceptionFilter detected (possible anti-debug)",
- "Details":
- "Description": "Behavioural detection: Executable code extraction",
- "Details":
- "Description": "The binary likely contains encrypted or compressed data.",
- "Details":
- "section": "name: .rsrc, entropy: 7.48, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x00023000, virtual_size: 0x00022f94"
- "Description": "Detects Sandboxie through the presence of a library",
- "Details":
- "Description": "File has been identified by 31 Antiviruses on VirusTotal as malicious",
- "Details":
- "FireEye": "Generic.mg.94ac00a01ef6a071"
- "Qihoo-360": "Win32/Trojan.e5c"
- "McAfee": "Artemis!94AC00A01EF6"
- "Cybereason": "malicious.ad106e"
- "Invincea": "heuristic"
- "Symantec": "ML.Attribute.HighConfidence"
- "ESET-NOD32": "Win32/TrojanDownloader.Zurgop.DA"
- "APEX": "Malicious"
- "Paloalto": "generic.ml"
- "GData": "Win32.Trojan-Downloader.SmokeLoader.KYRDR6"
- "Kaspersky": "Trojan.Win32.Propagate.nfh"
- "ViRobot": "Trojan.Win32.Z.Remcos.647168"
- "Avast": "FileRepMalware"
- "Tencent": "Win32.Trojan.Propagate.Htvw"
- "F-Secure": "Trojan.TR/AD.Dofoil.hzauh"
- "TrendMicro": "Mal_HPGen-37b"
- "McAfee-GW-Edition": "BehavesLike.Win32.Dropper.jh"
- "Sophos": "Mal/Generic-S"
- "Webroot": "Trojan.Dropper.Gen"
- "Avira": "TR/AD.Dofoil.hzauh"
- "Microsoft": "Trojan:Win32/Tiggre!plock"
- "AegisLab": "Trojan.Multi.Generic.4!c"
- "ZoneAlarm": "Trojan.Win32.Propagate.nfh"
- "AhnLab-V3": "Trojan/Win32.Smokeldr.C3455604"
- "Acronis": "suspicious"
- "Cylance": "Unsafe"
- "TrendMicro-HouseCall": "Mal_HPGen-37b"
- "Rising": "Spyware.Zbot!8.16B (TFE:1:945xuP4HgU)"
- "Ikarus": "Trojan-Spy.Remcos"
- "AVG": "FileRepMalware"
- "CrowdStrike": "win/malicious_confidence_80% (W)"
- "Description": "Anomalous binary characteristics",
- "Details":
- "anomaly": "Found duplicated section names"
- * Started Service:
- * Mutexes:
- "RasPbFile"
- * Modified Files:
- "\\Device\\KsecDD",
- "C:\\Users\\user\\AppData\\Local\\Temp\\D47F.tmp"
- * Deleted Files:
- "C:\\Users\\user\\AppData\\Local\\Temp\\D47F.tmp"
- * Modified Registry Keys:
- "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\643fcKYtyfIi_RASDLG",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\643fcKYtyfIi_RASDLG\\EnableFileTracing",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\643fcKYtyfIi_RASDLG\\EnableConsoleTracing",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\643fcKYtyfIi_RASDLG\\FileTracingMask",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\643fcKYtyfIi_RASDLG\\ConsoleTracingMask",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\643fcKYtyfIi_RASDLG\\MaxFileSize",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\643fcKYtyfIi_RASDLG\\FileDirectory"
- * Deleted Registry Keys:
- * DNS Communications:
- * Domains:
- * Network Communication - ICMP:
- * Network Communication - HTTP:
- * Network Communication - SMTP:
- * Network Communication - Hosts:
- * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement