Analysis Report https://f000.backblazeb2.com/file/cybernews-bot-3ae031b2/index.html

Overview

General Information

Sample URL:	https://f000.backblazeb2.com/file/cybernews-bot-3ae031b2/index.html
Analysis ID:	363573
Infos:
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on shot template match)

Yara detected HtmlPhish_7

Yara signature match

Classification

Signatures

Phishing:

Phishing site detected (based on shot template match)

Source: https://f000.backblazeb2.com/file/cybernews-bot-3ae031b2/index.html

Matcher: Template: generic matched

Yara detected HtmlPhish_7

Source: Yara match

File source: 226546.pages.csv, type: HTML

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 172.67.206.183:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.183:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.183:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.183:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.183:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.183:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 146.59.152.166:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 146.59.152.166:443 -> 192.168.2.4:49742 version: TLS 1.2

Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x05c57b93,0x01d71137</date><accdate>0x05c57b93,0x01d71137</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x05c57b93,0x01d71137</date><accdate>0x05c57b93,0x01d71137</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x05ca403c,0x01d71137</date><accdate>0x05ca403c,0x01d71137</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x05ca403c,0x01d71137</date><accdate>0x05ca403c,0x01d71137</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x05ca403c,0x01d71137</date><accdate>0x05ca403c,0x01d71137</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x05ca403c,0x01d71137</date><accdate>0x05ca403c,0x01d71137</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: f000.backblazeb2.com

Source: bootstrap.min[1].css.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: msapplication.xml.1.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.1.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.1.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.1.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.1.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.1.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.1.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.1.dr	String found in binary or memory: http://www.youtube.com/
Source: ~DF7122CBD5AB624E6A.TMP.1.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
Source: {3677D61E-7D2A-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://f000.backRoot
Source: {3677D61E-7D2A-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://f000.backb2.com/file/cybernews-bot-3ae031b2/index.htmlRoot
Source: {3677D61E-7D2A-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://f000.backb2.com/file/cybernews-bot-3ae031b2/ndex.htmlRoot
Source: {3677D61E-7D2A-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://f000.backblaze
Source: ~DF7122CBD5AB624E6A.TMP.1.dr	String found in binary or memory: https://f000.backblazeb2.com/file/cybernews-bot-3ae031b2/index.html
Source: {3677D61E-7D2A-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://f000.backblazeb2.com/file/cybernews-bot-3ae031b2/index.htmlRoot
Source: ~DF7122CBD5AB624E6A.TMP.1.dr	String found in binary or memory: https://f000.backblazeb2.com/file/cybernews-bot-3ae031b2/ndex.html
Source: bootstrap.min[1].css.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: ~DF7122CBD5AB624E6A.TMP.1.dr	String found in binary or memory: https://i.ibb.co/TtTg9r7/icon.png
Source: imagestore.dat.2.dr	String found in binary or memory: https://i.ibb.co/TtTg9r7/icon.pngM
Source: ~DF7122CBD5AB624E6A.TMP.1.dr	String found in binary or memory: https://owy.mn/35MDuDz
Source: ~DF7122CBD5AB624E6A.TMP.1.dr	String found in binary or memory: https://plutosmto.com/email-list/dropox18/css/bootstrap.min.css
Source: ~DF7122CBD5AB624E6A.TMP.1.dr	String found in binary or memory: https://plutosmto.com/email-list/dropox18/css/style.css
Source: ~DF7122CBD5AB624E6A.TMP.1.dr	String found in binary or memory: https://plutosmto.com/email-list/dropox18/images/3.png
Source: ~DF7122CBD5AB624E6A.TMP.1.dr	String found in binary or memory: https://plutosmto.com/email-list/dropox18/images/4.png
Source: ~DF7122CBD5AB624E6A.TMP.1.dr	String found in binary or memory: https://plutosmto.com/email-list/dropox18/images/5.png
Source: ~DF7122CBD5AB624E6A.TMP.1.dr	String found in binary or memory: https://plutosmto.com/email-list/dropox18/images/6.png
Source: ~DF7122CBD5AB624E6A.TMP.1.dr	String found in binary or memory: https://plutosmto.com/email-list/dropox18/images/7.png
Source: ~DF7122CBD5AB624E6A.TMP.1.dr	String found in binary or memory: https://plutosmto.com/email-list/dropox18/images/8.png
Source: ~DF7122CBD5AB624E6A.TMP.1.dr	String found in binary or memory: https://plutosmto.com/email-list/dropox18/images/9.png

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: unknown	HTTPS traffic detected: 172.67.206.183:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.183:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.183:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.183:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.183:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.183:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 146.59.152.166:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 146.59.152.166:443 -> 192.168.2.4:49742 version: TLS 1.2

System Summary:

Yara signature match

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\index[1].htm, type: DROPPED

Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/

Source: classification engine

Classification label: mal56.phis.win@3/37@4/3

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3677D61C-7D2A-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFFFE7CB61E25586DB.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6792 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6792 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.206.183	plutosmto.com	United States	13335	CLOUDFLARENETUS	false
146.59.152.166	i.ibb.co	Norway	16276	OVHFR	false
104.153.233.177	f000.backblazeb2.com	United States	32354	UNWIREDUS	false

Contacted Domains

Name	IP	Active
f000.backblazeb2.com	104.153.233.177	true
plutosmto.com	172.67.206.183	true
i.ibb.co	146.59.152.166	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://f000.backblazeb2.com/file/cybernews-bot-3ae031b2/index.html	true		unknown
https://f000.backblazeb2.com/file/cybernews-bot-3ae031b2/	true		unknown

ID:	363573
Product:	CloudBasic
Start time:	21:42:22
Start date:	04.03.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3677D61C-7D2A-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	3DCD967DD4E0BAAA6CD4C1A9BC169340	FE15EEDDA57BB8C68127BCFA4B5DD42F6EDEEC27	4184AD46CFAA73F5091117E2CA007C5123AEAB0F9CC904ACC6750D88DAF525E6
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{3677D61E-7D2A-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	7E82B12D84539C2070DC21051AA1FCCF	0F9706939B2871A9C7CFC865C8BC7C6F4007D5F2	C556FA949098643F4C9B8CC253DE473A1410807BD3E887675ABD44EFEE783EE7
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{3677D61F-7D2A-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	E9AF407F312D2092DBAE3F5F47C0E0FB	B4338B3D53E6445856C7CAC494D9CE896AC58F2E	F6DE3DF8A6163A6DB023BC7CCD7BBAF33A9813D85040629B103732E52796C07A
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	103B6E9218A747360227F538E9954CA3	1876F5DF9289D4F79C03784CD3533F5E4EEAD1B3	D64D6EB87F44A0209EADB9898DA28987C101393B7F028D229447ABE4408CBCE8
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	088F001FB69AC43B26EFFB12B69D049E	4DA5ED24A27C519C69968B9B6C42FC717B40D020	680338FD44E1262F7959071DBB82C10AF175ACD7CB7E740D3C87EECBBF71B70C
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	78F7FE73EA996B0A9DA46B911192D2C3	D906FF1038F41C30E305347AF88499ABA740423C	5C8C87B4455D06AF70531E2D1D8B11E95FD50393F30894C778461B6DDE06BCF4
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	605193667DE93863671CC423DB19D494	B51BDE538072A151BAF627A0807803672BF26983	282DAFA477F725155BB4B72DBB40DCD04866FAB95B9E20CDE55F6377B207E3D6
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	F98AB6009886BA5CBD75A032A6C3A680	693DE13D5F35A07637E8ED7F3AECB74623440207	69313BEDA1EB0792DC98C1EE12FD1F166C65FBC9C2F3A6C7B444D0D354BD05C0
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	D88D76B3A51B5CBC3155589C49D78388	B5D7DF574947FA401D41F8F917AA128B3DAE19F6	B93F23096B38936969EADCF1388D9AA8B554E76BFE2846BF48C2C4695DF7996A
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	DCF0F2D38089B19AF6DC5B352A7579BE	69D8F821CFDA7659B9ECE8A4558C79406756B3F7	641B11E9D0488DD985536FDBBF7A3F4F45B55D5BE3314C8E49683A155281794C
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	AFB68A6A7D2754E596BE136B226D1381	6DC6EBE3DECB5049158D2467C492C74D65C4DF1B	1D8B4F44A4F68B8A0111B1F14A8DCBFD2E6EFAC2BE2234F9163860CDB132A2A3
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	F2CEC663441FDA2143F2D379856C21E6	7F744A99E31BF2A9E0470CCBBF68A2650E62D4F0	73D53E629D24EF62A99473653A9A8EAB6B7B49E5C86E22CD54C32DAC80803E1F
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\gee00pr\imagestore.dat	data	329319B356D1A15671F63EAB0849657C	A8AFBF58CEAC1A59D08D7B8EA3E81F49515413C4	BDAE56CED1BDD42287E1E3DC5B73193F37A12C11418717EEDC83011BC13B6007
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\4[1].png	PNG image data, 512 x 77, 8-bit/color RGBA, non-interlaced	493EA2AE31151AC4E04D2FA666FD84CA	D531856F0D3CC720240437B7616E34E88A0D3680	71F1650F5D522E8483138D1086AAAE8D17B89630923BD61EAB377C4077943954
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\ErrorPageTemplate[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	F4FE1CB77E758E1BA56B8A8EC20417C5	F4EDA06901EDB98633A686B11D02F4925F827BF0	8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\icon[1].png	PNG image data, 640 x 595, 8-bit/color RGBA, non-interlaced	CDC272020B586DE4F86BD86803E648F6	8D5BDA8F1D82EC7AFAC20639797AC919FBB69B86	9927959CE577685644016E46A7FDAB65D6E552F998BA5E3B72DDDB0AE38CC12D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\index[1].htm	HTML document, ASCII text, with very long lines, with no line terminators	650CC0149CA3C317677295AD6421AEAB	69AC256EE7293FF4552AF1653E54C85A66A57A1E	894131CF61F862C86F75E53BFC332F968077420A1963CEA6F7909E31CCEE751C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\info_48[1]	PNG image data, 47 x 48, 8-bit/color RGBA, non-interlaced	5565250FCC163AA3A79F0B746416CE69	B97CC66471FCDEE07D0EE36C7FB03F342C231F8F	51129C6C98A82EA491F89857C31146ECEC14C4AF184517450A7A20C699C84859
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\style[1].css	ASCII text	C8AC240D56F7E0DC9DA8E1C5A8CDF6A3	A31C29EFFFE39125AD251D6332A4DE9CA065B879	772B6AABBB701B20E6F96A5D68ACEABEC3F5648C70392407D10DD2DE3FD0DB2F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\1[1].png	PNG image data, 1921 x 1086, 8-bit/color RGBA, non-interlaced	82E43F9254C31B3C90D5C1652BAFB99D	3094E1E096569FB6705F7A2EE941D5F0AEECE8D1	0800BB03D442A8C7C9D93DFAA85A9F8CE947268565BE472E3E86013F5F5EB63E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\5[1].png	PNG image data, 512 x 92, 8-bit/color RGBA, non-interlaced	0C72A10D043E3373C199784EA1D94C87	BA7A8C1A0060FA69114C8AA79656CDF93B7943FF	21F54475B1F9A3D64AA6B488CE9ECDB61B1DEC95B43A15B484B4CA6C43E0EE83
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\9[1].png	PNG image data, 512 x 72, 8-bit/color RGBA, non-interlaced	46B388CC7DB4AB99D0E45534E9421C9F	52BEE4286D9FE47D1E48CFF4B11B2E236EA36E2B	89AEFC0D984E5D5395D065627FDD87CC435A7749D71BC9E665B5C49D4CF5616A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\down[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	C4F558C4C8B56858F15C09037CD6625A	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\httpErrorPagesScripts[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9234071287E637F85D721463C488704C	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\7[1].png	PNG image data, 512 x 82, 8-bit/color RGBA, non-interlaced	3B457955F90BC245DDB55371A61CD7C9	AD1B10A516C0D798551D54446603CF8EA39F1314	3B43E570605C2F6DA13819B28ABD440E336C73EB52B808463F7CEBF283B70137
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\8[1].png	PNG image data, 512 x 67, 8-bit/color RGBA, non-interlaced	1B45B115F6745CDBEA8BE8603F487F17	5E3AF38B50DB64ADA76A7E76E94276E75E2BE8F6	F25557BEE2901B8016FAB7613F082EAB60F505325B24A8F053002146A296DB65
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\background_gradient[1]	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1x800, frames 3	20F0110ED5E4E0D5384A496E4880139B	51F5FC61D8BF19100DF0F8AADAA57FCD9C086255	1471693BE91E53C2640FE7BAEECBC624530B088444222D93F2815DFCE1865D5B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\bootstrap.min[1].css	ASCII text, with very long lines	EC3BB52A00E176A7181D454DFFAEA219	6527D8BF3E1E9368BAB8C7B60F56BC01FA3AFD68	F75E846CC83BD11432F4B1E21A45F31BC85283D11D372F7B19ACCD1BF6A2635C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\jquery.min[1].js	ASCII text, with very long lines	A09E13EE94D51C524B7E2A728C7D4039	0DC32DB4AA9C5F03F3B38C47D883DBD4FED13AAE	160A426FF2894252CD7CEBBDD6D6B7DA8FCD319C65B70468F10B6690C45D02EF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\3[1].png	PNG image data, 630 x 167, 8-bit/color RGBA, non-interlaced	7DC3DF436344B378A17F24DA13F2EF80	2C2B5B29208744E7F5947BFB01FB212869BE5387	043AF73AFAD9C3CB08FD3508B8D80DD77502230D2157204E6C76B02FBEDAF70E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\6[1].png	PNG image data, 512 x 85, 8-bit/color RGBA, non-interlaced	FC5E0191FDB0D9D66904A2D5AFCAA425	638CC9593218E3AB29A22AA40629E5AFDAAF9977	835E090B62233F9D990C703CEFA880A957A4434CA980649BB6F4568576541A5A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\bullet[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	26F971D87CA00E23BD2D064524AEF838	7440BEFF2F4F8FABC9315608A13BF26CABAD27D9	1D8E5FD3C1FD384C0A7507E7283C7FE8F65015E521B84569132A7EABEDC9D41D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\errorPageStrings[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	D65EC06F21C379C87040B83CC1ABAC6B	208D0A0BB775661758394BE7E4AFB18357E46C8B	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\http_400[1]	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	1960097B221E608A79D278C7959B3C59	10C261310CA68C5624185C4F6FEF8AF44EA6FBAF	1BCAF35CA02140D731E6A3AE3D3D6A5EA49CE7E552728457F790919A540AEC78
C:\Users\user\AppData\Local\Temp\~DF7122CBD5AB624E6A.TMP	data	F1734AC20C4DD66CC09488253EC81880	5C5F4D6EF7369C4CD75B822868A5A0AE836D9D87	873E24C6F4344C9F6BBC5DC74590909B83643E2E2D707CCE40C837E6AFEE2815
C:\Users\user\AppData\Local\Temp\~DFEAB4620B4967CC1D.TMP	data	AB889A32AB9ACD33E816C2422337C69A	1190C6B34DED2D295827C2A88310D10A8B90B59B	4D6EC54B8D244E63B0F04FBE2B97402A3DF722560AD12F218665BA440F4CEFDA
C:\Users\user\AppData\Local\Temp\~DFFFE7CB61E25586DB.TMP	data	60A75E91FFFC488D3A86CC6DA5FD693A	219213814DF927251A78C7913275650A82480013	0800C60A44C382655921869EE9E383B98C18F927B8C4B7A99D6231827314C5AB

Analysis Report https://f000.backblazeb2.com/file/cybernews-bot-3ae031b2/index.html

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing:

Compliance:

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs