flash

f4IJf6g3b7.exe

Status: finished
Submission Time: 02.09.2020 14:23:34
Malicious
Trojan
Evader
Nanocore

Comments

Tags

  • exe
  • NanoCore
  • RAT

Details

  • Analysis ID:
    281103
  • API (Web) ID:
    457433
  • Analysis Started:
    02.09.2020 14:23:34
  • Analysis Finished:
    02.09.2020 14:38:06
  • MD5:
    6e3084b046715dd83bedaedfdcbdfd1a
  • SHA1:
    d0984cbf0ad371e718957daf30485f0ee0d60e57
  • SHA256:
    f9e386914a47b738dcfe89fadf3021be00c2dfe8824d8326ea79fcd79d3673cc
  • Technologies:
Full Report Engine Info Verdict Score Reports

System: w10x64 Windows 10 64 bit v1803 with Office Professional Plus 2016, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

malicious
32/69

malicious
11/38

malicious
16/29

IPs

IP Country Detection
79.134.225.111
Switzerland

Domains

Name IP Detection
stronggods.ddns.net
0.0.0.0

URLs

Name Detection
http://secure.globalsign.net/cacert/PrimObject.crt0
http://secure.globalsign.net/cacert/ObjectSign.crt09
http://www.globalsign.net/repository09
Click to see the 3 hidden entries
http://www.autoitscript.com/autoit3/0
http://www.globalsign.net/repository/0
http://www.globalsign.net/repository/03

Dropped files

Name File Type Hashes Detection
C:\85110179\xiklhd.pif
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\RegSvcs.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Local\Temp\tmp1C56.tmp
XML 1.0 document, ASCII text, with CRLF line terminators
#
Click to see the 35 hidden entries
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat
Non-ISO extended-ASCII text, with no line terminators
#
C:\85110179\Update.vbs
ASCII text, with no line terminators
#
C:\85110179\aciawlwa.bin
ASCII text, with CRLF line terminators
#
C:\85110179\arla.jpg
ASCII text, with CRLF line terminators
#
C:\85110179\ckbogvoetv.ico
ASCII text, with CRLF line terminators
#
C:\85110179\dfxqacbx.pdf
ASCII text, with CRLF line terminators
#
C:\85110179\eldjlpbkcr.xls
ASCII text, with CRLF line terminators
#
C:\85110179\eoajgbpopt.cpl
ASCII text, with CRLF line terminators
#
C:\85110179\gdhjrt.dat
ASCII text, with CRLF line terminators
#
C:\85110179\gfpkfmvwj.ico
ASCII text, with CRLF line terminators
#
C:\85110179\gmfxflw.dat
ASCII text, with CRLF line terminators
#
C:\85110179\hcogjnqu.bmp
ASCII text, with CRLF line terminators
#
C:\85110179\idjwssldss.jpg
ASCII text, with CRLF line terminators
#
C:\85110179\ieflc.pdf
ASCII text, with CRLF line terminators
#
C:\85110179\jagp.cpl
ASCII text, with CRLF line terminators
#
C:\85110179\kagrppmqlp.ppt
ASCII text, with CRLF line terminators
#
C:\85110179\mmkihcd.pdf
ASCII text, with CRLF line terminators
#
C:\85110179\mwsengeo.icm
ASCII text, with CRLF line terminators
#
C:\85110179\nltjfsla.bin
ASCII text, with CRLF line terminators
#
C:\85110179\odmoeb.xls
ASCII text, with CRLF line terminators
#
C:\85110179\ouigvfrsrm.docx
ASCII text, with CRLF line terminators
#
C:\85110179\owfjmlo.txt
ASCII text, with CRLF line terminators
#
C:\85110179\pbbkuh.docx
ASCII text, with CRLF line terminators
#
C:\85110179\qctgqrbl.dpn
data
#
C:\85110179\qfxuawvnbp.ico
ASCII text, with very long lines, with CRLF line terminators
#
C:\85110179\tninm.exe
ASCII text, with CRLF line terminators
#
C:\85110179\uvjccalos.xml
ASCII text, with CRLF line terminators
#
C:\85110179\wlonq.ini
ASCII text, with CRLF line terminators
#
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhcpmon.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\tmp2010.tmp
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat
ASCII text, with no line terminators
#
C:\Users\user\temp\qfxuawvnbp.ico
ASCII text, with CRLF line terminators
#
\Device\ConDrv
ASCII text, with CRLF line terminators
#