Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

0XLuA614VK.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.182887764348203
Filename:	0XLuA614VK.exe
Filesize:	1296896
MD5:	562cb5dcba0e691bf01ab2c020c0837e
SHA1:	3ca5eb915edcce7da20a7b6046055cb11333647e
SHA256:	4399aa607bbc0faabced85f15b59b4d01a50d79da07f8d6bc825e358ad417e52
SHA512:	130e921e7bd869c6367a4fe664a5fe9df6432ff5ca3519d9fe4d378b52f4675b89ec9312a02ea8246868326d9c0c65703a45e289478afc7f26ce1ce6310077a9
SSDEEP:	24576:oqDEvCTbMWu7rQYlBQcBiT6rprG8awSX4F1d5Y/j20uMjwr4b:oTvC/MTQYxsWR7aw6yYpw4
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection	Disable or Modify Tools
Binary is likely a compiled AutoIt script file	System Summary
Found API chain indicative of sandbox detection	Malware Analysis System Evasion	Disable or Modify Tools Virtualization/Sandbox Evasion
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Switches to a custom stack to bypass stack traces	Malware Analysis System Evasion
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to block mouse and keyboard input (often used to hinder debugging)	Anti Debugging	Disable or Modify Tools
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to check if a window is minimized (may be used to check if an application is visible)	Hooking and other Techniques for Hiding and Protection	Application Window Discovery
Contains functionality to communicate with device drivers	System Summary
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to execute programs as a different user	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Contains functionality to launch a process as a different user	System Summary	Valid Accounts Native API Access Token Manipulation
Contains functionality to launch a program with higher privileges	HIPS / PFW / Operating System Protection Evasion	Exploitation for Privilege Escalation
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Process Discovery Clipboard Data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)	Remote Access Functionality
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection	Disable or Modify Tools
Contains functionality to read the PEB	Anti Debugging
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Disable or Modify Tools
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Contains functionality to shutdown / reboot the system	System Summary	System Shutdown/Reboot
Contains functionality to simulate keystroke presses	HIPS / PFW / Operating System Protection Evasion
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Detected potential crypto function	System Summary	Process Discovery Archive Collected Data Encrypted Channel
Found large amount of non-executed APIs	Malware Analysis System Evasion
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information	Disable or Modify Tools System Shutdown/Reboot
Potential key logger detected (key state polling based)	Key, Mouse, Clipboard, Microphone and Screen Capturing	Disable or Modify Tools
Sample file is different than original file name gathered from version info	System Summary	System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary	Disable or Modify Tools
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Contains functionality for error logging	System Summary	Disable or Modify Tools
Contains functionality to add an ACL to a security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary
Contains functionality to check free disk space	System Summary	System Information Discovery
Contains functionality to create a new security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to download additional files from the internet	Networking
Contains functionality to enum processes or threads	System Summary	Process Discovery
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to instantiate COM classes	System Summary
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to query local / system time	Language, Device and Operating System Detection	System Time Discovery
Contains functionality to query system information	Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection
Contains functionality to query windows version	Language, Device and Operating System Detection	System Information Discovery
Contains functionality to register its own exception handler	Anti Debugging
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection	Disable or Modify Tools
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary
Sample is known by Antivirus	System Summary	Disable or Modify Tools
Tries to load missing DLLs	System Summary	DLL Side-Loading Disable or Modify Tools
PE file contains a valid data directory to section mapping	System Summary	Security Software Discovery
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary	Disable or Modify Tools

C:\Users\user\AppData\Local\Temp\049zKJ78K

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\049zKJ78K
Category:	dropped
Dump:	049zKJ78K.4.dr
ID:	dr_4
Target ID:	4
Process:	C:\Windows\SysWOW64\msiexec.exe
Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Entropy:	1.121297215059106
Encrypted:	false
Ssdeep:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
Size:	196608
Whitelisted:	false
Reputation:	high

C:\Users\user\AppData\Local\Temp\Okeghem

ASCII text, with very long lines (65536), with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\Okeghem
Category:	dropped
Dump:	Okeghem.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Users\user\Desktop\0XLuA614VK.exe
Type:	ASCII text, with very long lines (65536), with no line terminators
Entropy:	4.178866841846399
Encrypted:	false
Ssdeep:	1536:IZdNJ184vEfdrTfoWX5eYZe6fjIzpEeAJlA:YdN0IWE0VIfAJG
Size:	86022
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\autC864.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\autC864.tmp
Category:	dropped
Dump:	autC864.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\0XLuA614VK.exe
Type:	data
Entropy:	7.9934090783519185
Encrypted:	true
Ssdeep:	6144:GliSizvPXmMpg5ehcQvgP0FcKgF4m93rgD6AlyxfR60Ix1/:GllcnXmMRbgnWs3cMgx1/
Size:	272384
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

C:\Users\user\AppData\Local\Temp\autC894.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\autC894.tmp
Category:	dropped
Dump:	autC894.tmp.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Users\user\Desktop\0XLuA614VK.exe
Type:	data
Entropy:	7.821532738392043
Encrypted:	false
Ssdeep:	768:Wf6Iuqd0f4ibxUJKNtFqya/QHtfwDTiP3qWimuAKNcsrWwyQcB:a6VqOf4ipNXVaYHJwHiPknNcMcB
Size:	43554
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\avenses

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\avenses
Category:	dropped
Dump:	avenses.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\0XLuA614VK.exe
Type:	data
Entropy:	7.9934090783519185
Encrypted:	true
Ssdeep:	6144:GliSizvPXmMpg5ehcQvgP0FcKgF4m93rgD6AlyxfR60Ix1/:GllcnXmMRbgnWs3cMgx1/
Size:	272384
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\0XLuA614VK.exe

"C:\Users\user\Desktop\0XLuA614VK.exe"

Details

Is windows:	false
Is dropped:	false
PID:	2956
Target ID:	0
Parent PID:	1028
Name:	0XLuA614VK.exe
Path:	C:\Users\user\Desktop\0XLuA614VK.exe
Commandline:	"C:\Users\user\Desktop\0XLuA614VK.exe"
Size:	1296896
MD5:	562CB5DCBA0E691BF01AB2C020C0837E
Time:	08:23:58
Date:	05/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xf20000
Modulesize:	1318912
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Binary is likely a compiled AutoIt script file	System Summary
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: Uncommon Svchost Parent Process	System Summary
Uses 32bit PE files	Compliance, System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sigma detected: Windows Processes Suspicious Parent Directory	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\SysWOW64\svchost.exe

"C:\Users\user\Desktop\0XLuA614VK.exe"

Details

Is windows:	true
Is dropped:	false
PID:	6400
Target ID:	2
Parent PID:	2956
Name:	svchost.exe
Path:	C:\Windows\SysWOW64\svchost.exe
Commandline:	"C:\Users\user\Desktop\0XLuA614VK.exe"
Size:	46504
MD5:	1ED18311E3DA35942DB37D15FA40CC5B
Time:	08:23:59
Date:	05/09/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x50000
Modulesize:	53248
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected FormBook	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Uncommon Svchost Parent Process	System Summary
Sigma detected: Windows Processes Suspicious Parent Directory	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

"C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe"

Details

Is windows:	true
Is dropped:	false
PID:	2672
Target ID:	3
Parent PID:	6400
Name:	sXmdPDASzrmzi.exe
Path:	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe
Commandline:	"C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe"
Size:	140800
MD5:	32B8AD6ECA9094891E792631BAEA9717
Time:	08:24:07
Date:	05/09/2024
Reason:	existingprocessinject
Reputation:	high
Is admin:	false
Is elevated:	false
Modulebase:	0x50000
Modulesize:	155648
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\SysWOW64\msiexec.exe"

Details

Is windows:	true
Is dropped:	false
PID:	5304
Target ID:	4
Parent PID:	2672
Name:	msiexec.exe
Class:	system-tools
Path:	C:\Windows\SysWOW64\msiexec.exe
Commandline:	"C:\Windows\SysWOW64\msiexec.exe"
Size:	59904
MD5:	9D09DC1EDA745A5F87553048E57620CF
Time:	08:24:09
Date:	05/09/2024
Reason:	newprocess
Reputation:	high
Is admin:	false
Is elevated:	false
Modulebase:	0x4b0000
Modulesize:	73728
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\Firefox.exe"

Details

Is windows:	true
Is dropped:	false
PID:	2300
Target ID:	6
Parent PID:	5304
Name:	firefox.exe
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Size:	676768
MD5:	C86B1BE9ED6496FE0E0CBE73F81D8045
Time:	08:24:34
Date:	05/09/2024
Reason:	newprocess
Reputation:	high
Is admin:	false
Is elevated:	false
Modulebase:	0x7ff79f9e0000
Modulesize:	708608
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

URLs

Name

Malicious

http://www.formytinyhome.com/lztc/?V6h=7O2Vi30c2oKUz/gZ0nmLwDIgwhZodI9AolnTqJiIqHlz4L2fxMx7xnfeqZW9vH+mS4f3qWyrmk5EaMabwLfk8B7yJXbJanTlK0OvtO++wyfSRGRbh4BKfAxEuo7imst0wg==&sH=nVVHdDTx2PSTVJ

34.149.87.45

http://www.thecivilwearsprada06.site/2hp8/

199.59.243.226

http://www.cacingnaga36.click/ssw0/

199.59.243.226

http://www.whiskeydecanterset.com/wuux/?sH=nVVHdDTx2PSTVJ&V6h=G8W1V2+ngxJ+E83/0IyfiXupIqoHasoRgPgAY3+/EHQIvd2Wul84Lo8VWixQDtg5AMG3Phy0eNTP33PkrrD0t0eGx0WSmGJ1HH0cwOwxD95TaQSaBMeTfZ443OH1gA0wDQ==

199.59.243.226

http://www.smokesandhoney.com/ld3u/?V6h=7cSyNGFy/S5quoM6udyikngV4L2ptvlq1/kf9BPZtTlwCENfjvle2IZfxcv5JQLEZFLmm1935WPn1s0g14qVusJPQGgEr6+5yVxfblixZgca2mD/C/dkht+8dQzCD1+Jew==&sH=nVVHdDTx2PSTVJ

34.149.87.45

http://www.cacingnaga36.click/ssw0/?V6h=EWS2YwJnJiunoUuFc/7D9RbaJ3v4wM/73ZiSCzwa3KkaAEYrAxr2MHaEXaA/BV5/vIbe5XGczNGh+M2iNsrtVcMRpqBE9VdECLv8jlI9PFfIoqokrAMGKtNOgnbIBrYWGQ==&sH=nVVHdDTx2PSTVJ

199.59.243.226

http://www.smokesandhoney.com/ld3u/

34.149.87.45

http://www.5a8yly.cfd/kfsd/

72.52.178.23

http://www.4odagiyn.click/f1qc/?V6h=hzwN5LvsQYGPXTyx42WRS7uCqzLBy6ud4OZoJGct5lGhQCi/JqvYfzOI1V2uJBuqGZjzCjoJ029vt64MfCw2DjbXOZQ5rAFnHlGKde1l7O/bIsy3YWShbixw9PLvmnDlNA==&sH=nVVHdDTx2PSTVJ

72.52.178.23

http://www.bnmlk.org/r6tm/?sH=nVVHdDTx2PSTVJ&V6h=03r06RSocIWRHlQMBHZ7/ZdxuKKmGlmlv7BltFVQgkYFIdRnDBF7O8WDu3tP30gBrpd5Hehkjcnr6TVmd9giBmXATSrzqLCUTktLP3Nid+3n62oF5w/Mdat6l5CFzOydDA==

13.248.151.237

http://www.marinamaquiagens.online/n4sv/?V6h=Rn8sYt8YDaYT7jFf5K1RN21751bCn2USuvRVR0XZr3jMl4ljVezIqMhPdYzWo0QynoEEVao5Nd7ZkOoeHk8KzYmVnd6lY3cEc8VkS42gD8QuE3e2/CTNStdnS6k5rMWW1Q==&sH=nVVHdDTx2PSTVJ

15.197.240.20

http://www.yi992.com/iuti/?V6h=hoHbkVcpbob4KKGwTSg4Qmxuxm4KO3ujR6NVpJZRiS90gufBWzA0W/yR6JGFw3H3NTWRULQgnx1gCbPTi357oLTiVxRhMsTUHJ+Wl6jWlVJ6tv3Z5Sqw5Cg13CqV209vow==&sH=nVVHdDTx2PSTVJ

199.59.243.226

http://www.wildenmann.shop/ccpi/

91.203.110.247

http://www.4odagiyn.click/f1qc/

72.52.178.23

http://www.bnmlk.org/r6tm/

13.248.151.237

http://www.marinamaquiagens.online/n4sv/

15.197.240.20

http://www.formytinyhome.com/lztc/

34.149.87.45

http://www.rigintech.info/ig9u/?V6h=DsbZHDl7ETyucOGSRMDREU0gLqon/JCM1qPnn3cy3RxLEFGk9lVuu2W6wSDxGu+YER8koFm75cmrGcIzTbmZQ3LhDYrene07E1oxIZlh9GtUu7RZMRKLFDCiJnSgV5dMHg==&sH=nVVHdDTx2PSTVJ

162.0.213.94

http://www.5a8yly.cfd/kfsd/?sH=nVVHdDTx2PSTVJ&V6h=xdt0ktZO0PUVE8ko/vYSpSqVpvi6VCO8XncayCS9euW1eL9fqbwTWogO+vBLUJXWpdaX6FBHI3PARBJ6BBwlCmNGVSn5FdlKflrneiv2THCpchPWcIBHiIkx6LHBCpUWbA==

72.52.178.23

http://www.yi992.com/iuti/

199.59.243.226

http://www.rigintech.info/ig9u/

162.0.213.94

http://www.wildenmann.shop/ccpi/?sH=nVVHdDTx2PSTVJ&V6h=96vdCLF6vzOjbBC3mbkrC4zzUz2rd8Vx/oWpiC2btghNh3zo1JohGtlH0OSuyloWV4aL4gulV88Z8WUGiHxG/5dbitedT3dwls/KnYRS+O7Xw5tFmWV2oMBDB9F7a8JBDA==

91.203.110.247

https://duckduckgo.com/chrome_newtab

unknown

https://duckduckgo.com/ac/?q=

unknown

http://www.bnmlk.org/?ts=fENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NmQ5YTM2NDExYzB

unknown

https://www.google.com/images/branding/product/ico/googleg_lodp.ico

unknown

https://www.namesilo.com/whois

unknown

https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=

unknown

https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=

unknown

https://d38psrni17bvxu.cloudfront.net/themes/registrar/images/namesilo.svg

unknown

https://www.namesilo.com

unknown

https://pcnatrk.net/track.

unknown

https://www.ecosia.org/newtab/

unknown

http://ww7.4odagiyn.click/f1qc/?V6h=hzwN5LvsQYGPXTyx42WRS7uCqzLBy6ud4OZoJGct5lGhQCi/JqvYfzOI1V2uJBuq

unknown

https://www.formytinyhome.com/lztc/?V6h=7O2Vi30c2oKUz/gZ0nmLwDIgwhZodI9AolnTqJiIqHlz4L2fxMx7xnfeqZW9

unknown

http://ww1.5a8yly.cfd/kfsd/?sH=nVVHdDTx2PSTVJ&V6h=xdt0ktZO0PUVE8ko/vYSpSqVpvi6VCO8XncayCS9euW1eL9fqb

unknown

https://www.smokesandhoney.com/ld3u/?V6h=7cSyNGFy/S5quoM6udyikngV4L2ptvlq1/kf9BPZtTlwCENfjvle2IZfxcv

unknown

https://ac.ecosia.org/autocomplete?q=

unknown

https://www.google.com

unknown

https://www.namesilo.com/domain/search-domains

unknown

http://c.parkingcrew.net/scripts/sale_form.js

unknown

http://www.4odagiyn.click

unknown

https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search

unknown

https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css

unknown

https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=

unknown

http://wildenmann.shop/ccpi/?sH=nVVHdDTx2PSTVJ&V6h=96vdCLF6vzOjbBC3mbkrC4zzUz2rd8Vx/oWpiC2btghNh3zo1

unknown

There are 36 hidden URLs, click here to show them.

Domains

Name

Malicious

www.rigintech.info

162.0.213.94

Details

Name:	www.rigintech.info
IP:	162.0.213.94
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

869710.parkingcrew.net

13.248.151.237

77980.bodis.com

199.59.243.226

www.wildenmann.shop

91.203.110.247

Details

Name:	www.wildenmann.shop
IP:	91.203.110.247
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

www.4odagiyn.click

72.52.178.23

Details

Name:	www.4odagiyn.click
IP:	72.52.178.23
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

www.5a8yly.cfd

72.52.178.23

Details

Name:	www.5a8yly.cfd
IP:	72.52.178.23
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

td-ccm-neg-87-45.wixdns.net

34.149.87.45

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
0XLuA614VK.exe

Files

Processes

URLs

Domains

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report0XLuA614VK.exe

Files

Processes

URLs

Domains

IOC Report
0XLuA614VK.exe