Edit tour

Windows Analysis Report
RIP_YOUR_PC_LOL.exe

Overview

General Information

Sample Name:	RIP_YOUR_PC_LOL.exe
Analysis ID:	585264
MD5:	52867174362410d63215d78e708103ea
SHA1:	7ae4e1048e4463a4201bdeaf224c5b6face681bf
SHA256:	37d8e1ce3b6e6488942717aa78cb54785edc985143bcc8d9ba9f42d73a3dbd7a
Tags:	exe
Infos:

Detection

HawkEye Nanocore njRat AsyncRAT Azorult DCRat Ficker Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Yara detected MailPassView

Yara detected HawkEye Keylogger

Sigma detected: NanoCore

Yara detected AntiVM3

Yara detected Azorult Info Stealer

Detected Nanocore Rat

Yara detected AsyncRAT

Antivirus detection for dropped file

Sigma detected: Suspect Svchost Activity

Yara detected Nanocore RAT

Yara detected DCRat

Yara detected Generic Dropper

Yara detected Azorult

Multi AV Scanner detection for submitted file

Detected njRat

Malicious sample detected (through community Yara rule)

Yara detected Njrat

Antivirus / Scanner detection for submitted sample

Yara detected Mimikatz

Detected HawkEye Rat

Multi AV Scanner detection for dropped file

Yara detected Ficker Stealer

Sigma detected: Suspicius Schtasks From Env Var Folder

Sigma detected: System File Execution Location Anomaly

Uses netsh to modify the Windows network and firewall settings

Drops PE files to the startup folder

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

May check the online IP address of the machine

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Sigma detected: Suspicious Svchost Process

Creates autostart registry keys with suspicious names

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses dynamic DNS services

Sample uses process hollowing technique

Sigma detected: File Created with System Process Name

Sigma detected: Suspicious Add Scheduled Task From User AppData Temp

Protects its processes via BreakOnTermination flag

.NET source code references suspicious native API functions

Contains functionality to log keystrokes (.Net Source)

Yara detected WebBrowserPassView password recovery tool

PE file has nameless sections

Machine Learning detection for dropped file

Modifies the windows firewall

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

Contains long sleeps (>= 3 min)

Modifies existing windows services

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Binary contains a suspicious time stamp

Creates a start menu entry (Start Menu\Programs\Startup)

Sigma detected: Netsh Port or Application Allowed

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Sigma detected: CurrentVersion Autorun Keys Modification

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Sigma detected: Suspicious Add Scheduled Task Parent

Creates files inside the system directory

May infect USB drives

PE file contains sections with non-standard names

Found potential string decryption / allocating functions

Found dropped PE file which has not been started or loaded

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

AV process strings found (often used to terminate AV products)

Found inlined nop instructions (likely shell or obfuscated code)

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

File is packed with WinRar

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates or modifies windows services

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Sigma detected: Autorun Keys Modification

Classification

Process Tree

System is w10x64

RIP_YOUR_PC_LOL.exe (PID: 6880 cmdline: "C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe" MD5: 52867174362410D63215D78E708103EA)

healastounding.exe (PID: 3572 cmdline: "C:\Users\user\AppData\Roaming\healastounding.exe" MD5: 6FB798F1090448CE26299C2B35ACF876)

test.exe (PID: 6236 cmdline: "C:\Users\user\AppData\Roaming\test.exe" MD5: 7E50B292982932190179245C60C0B59B)

gay.exe (PID: 1104 cmdline: "C:\Users\user\AppData\Roaming\gay.exe" MD5: 8EEDC01C11B251481DEC59E5308DCCC3)

mediaget.exe (PID: 4688 cmdline: "C:\Users\user\AppData\Roaming\mediaget.exe" MD5: 8EEDC01C11B251481DEC59E5308DCCC3)

netsh.exe (PID: 7092 cmdline: netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\mediaget.exe" "mediaget.exe" ENABLE MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 4104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Opus.exe (PID: 3244 cmdline: "C:\Users\user\AppData\Roaming\Opus.exe" MD5: 759185EE3724D7563B709C888C696959)

schtasks.exe (PID: 6420 cmdline: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp4896.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 3280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 7052 cmdline: schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp5D87.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 4564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

aaa.exe (PID: 3984 cmdline: "C:\Users\user\AppData\Roaming\aaa.exe" MD5: 860AA57FC3578F7037BB27FC79B2A62C)

aaa.exe (PID: 6256 cmdline: C:\Users\user\AppData\Roaming\aaa.exe MD5: 860AA57FC3578F7037BB27FC79B2A62C)

8f1c8b40c7be588389a8d382040b23bb.exe (PID: 5376 cmdline: "C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe" MD5: 8F1C8B40C7BE588389A8D382040B23BB)

FFDvbcrdfqs.exe (PID: 6920 cmdline: "C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe" MD5: 78D40B12FFC837843FBF4DE2164002F6)

Dcvxaamev.exe (PID: 6612 cmdline: "C:\Users\user\AppData\Local\Temp\Dcvxaamev.exe" MD5: 870D6E5AEF6DEA98CED388CCE87BFBD4)

4.exe (PID: 2824 cmdline: "C:\Users\user\AppData\Roaming\4.exe" MD5: E6DACE3F577AC7A6F9747B4A0956C8D7)

3.exe (PID: 3964 cmdline: "C:\Users\user\AppData\Roaming\3.exe" MD5: 748A4BEA8C0624A4C7A69F67263E0839)

a.exe (PID: 5152 cmdline: "C:\Users\user\AppData\Roaming\a.exe" MD5: 52CFD35F337CA837D31DF0A95CE2A55E)

Pluto Panel.exe (PID: 4236 cmdline: "C:\Users\user\AppData\Roaming\Pluto Panel.exe" MD5: ED666BF7F4A0766FCEC0E9C8074B089B)

0fd7de5367376231a788872005d7ed4f.exe (PID: 2024 cmdline: "C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe" MD5: 0FD7DE5367376231A788872005D7ED4F)

0fd7de5367376231a788872005d7ed4f.exe (PID: 5172 cmdline: "C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe" MD5: 0FD7DE5367376231A788872005D7ED4F)

22.exe (PID: 1272 cmdline: "C:\Users\user\AppData\Roaming\22.exe" MD5: DBF9DAA1707B1037E28A6E0694B33A4B)

netsh.exe (PID: 6500 cmdline: netsh ipsec static add policy name=Block MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 3252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 6596 cmdline: netsh ipsec static add filterlist name=Filter1 MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 7048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 5932 cmdline: netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 3288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 5940 cmdline: netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 1616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 5748 cmdline: netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 6212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 5504 cmdline: netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 5584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 6060 cmdline: netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 6252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

___11.19.exe (PID: 6732 cmdline: "C:\Users\user\AppData\Roaming\___11.19.exe" MD5: A071727B72A8374FF79A695ECDE32594)

svchost.exe (PID: 6552 cmdline: C:\Users\user\AppData\Local\Temp\\svchost.exe MD5: A4329177954D4104005BCE3020E5EF59)

cmd.exe (PID: 1852 cmdline: C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\user\AppData\Local\Temp\svchost.exe > nul MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 1364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchos.exe (PID: 1588 cmdline: C:\Users\user\AppData\Local\Temp\\svchos.exe MD5: 3B377AD877A942EC9F60EA285F7119A2)

HD____11.19.exe (PID: 2508 cmdline: C:\Users\user\AppData\Roaming\HD____11.19.exe MD5: B14120B6701D42147208EBF264AD9981)

Opus.exe (PID: 6580 cmdline: C:\Users\user\AppData\Roaming\Opus.exe 0 MD5: 759185EE3724D7563B709C888C696959)

dhcpmon.exe (PID: 6328 cmdline: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" MD5: 759185EE3724D7563B709C888C696959)

dhcpmon.exe (PID: 6308 cmdline: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" 0 MD5: 759185EE3724D7563B709C888C696959)

mediaget.exe (PID: 6036 cmdline: "C:\Users\user\AppData\Roaming\mediaget.exe" .. MD5: 8EEDC01C11B251481DEC59E5308DCCC3)

mediaget.exe (PID: 1080 cmdline: "C:\Users\user\AppData\Roaming\mediaget.exe" .. MD5: 8EEDC01C11B251481DEC59E5308DCCC3)

TXPlatforn.exe (PID: 5700 cmdline: C:\Windows\SysWOW64\TXPlatforn.exe -auto MD5: A4329177954D4104005BCE3020E5EF59)

TXPlatforn.exe (PID: 1480 cmdline: C:\Windows\SysWOW64\TXPlatforn.exe -acsi MD5: A4329177954D4104005BCE3020E5EF59)

svchost.exe (PID: 6268 cmdline: C:\Windows\SysWOW64\svchost.exe -k " " MD5: FA6C268A5B5BDA067A901764D203D433)

svchost.exe (PID: 6052 cmdline: C:\Windows\SysWOW64\svchost.exe -k " " MD5: FA6C268A5B5BDA067A901764D203D433)

mediaget.exe (PID: 5644 cmdline: "C:\Users\user\AppData\Roaming\mediaget.exe" .. MD5: 8EEDC01C11B251481DEC59E5308DCCC3)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
RIP_YOUR_PC_LOL.exe	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1308075:$x1: NanoCore.ClientPluginHost 0x13080b2:$x2: IClientNetworkHost 0x130bbe5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
RIP_YOUR_PC_LOL.exe	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7bdb7:$key: HawkEyeKeylogger 0x7dff3:$salt: 099u787978786 0x7c3f0:$string1: HawkEye_Keylogger 0x7d243:$string1: HawkEye_Keylogger 0x7df53:$string1: HawkEye_Keylogger 0x7c7d9:$string2: holdermail.txt 0x7c7f9:$string2: holdermail.txt 0x7c71b:$string3: wallet.dat 0x7c733:$string3: wallet.dat 0x7c749:$string3: wallet.dat 0x7db35:$string4: Keylog Records 0x7de4d:$string4: Keylog Records 0x7e04b:$string5: do not script --> 0x7bd9f:$string6: \pidloc.txt 0x7be05:$string7: BSPLIT 0x7be15:$string7: BSPLIT
RIP_YOUR_PC_LOL.exe	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7901:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
RIP_YOUR_PC_LOL.exe	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
RIP_YOUR_PC_LOL.exe	JoeSecurity_GenericDropper	Yara detected Generic Dropper	Joe Security
RIP_YOUR_PC_LOL.exe	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
RIP_YOUR_PC_LOL.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
RIP_YOUR_PC_LOL.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
RIP_YOUR_PC_LOL.exe	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
RIP_YOUR_PC_LOL.exe	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
RIP_YOUR_PC_LOL.exe	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
RIP_YOUR_PC_LOL.exe	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x28e00b:$s1: blackmoon 0x360dbc:$s1: blackmoon 0x28e04b:$s2: BlackMoon RunTime Error: 0x360dfc:$s2: BlackMoon RunTime Error:
RIP_YOUR_PC_LOL.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x1350eee:$s1: netsh firewall delete allowedprogram 0x1350de4:$s2: netsh firewall add allowedprogram 0x1350f4e:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x1350bd8:$s4: Execute ERROR 0x1350c38:$s4: Execute ERROR 0x1350bfc:$s5: Download ERROR 0x1350f94:$s6: [kl]
RIP_YOUR_PC_LOL.exe	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x1307ddd:$x1: NanoCore Client 0x1307ded:$x1: NanoCore Client 0x1308035:$x2: NanoCore.ClientPlugin 0x1308075:$x3: NanoCore.ClientPluginHost 0x130802a:$i1: IClientApp 0x130804b:$i2: IClientData 0x1308057:$i3: IClientNetwork 0x1308066:$i4: IClientAppHost 0x130808f:$i5: IClientDataHost 0x130809f:$i6: IClientLoggingHost 0x13080b2:$i7: IClientNetworkHost 0x13080c5:$i8: IClientUIHost 0x13080d3:$i9: IClientNameObjectCollection 0x13080ef:$i10: IClientReadOnlyNameObjectCollection 0x1307e3c:$s1: ClientPlugin 0x130803e:$s1: ClientPlugin 0x1308532:$s2: EndPoint 0x134f3f0:$s2: EndPoint 0x7a847:$s3: IPAddress 0x130853b:$s3: IPAddress 0x134f3ba:$s3: IPAddress
RIP_YOUR_PC_LOL.exe	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1307ddd:$a: NanoCore 0x1307ded:$a: NanoCore 0x1308021:$a: NanoCore 0x1308035:$a: NanoCore 0x1308075:$a: NanoCore 0x1307e3c:$b: ClientPlugin 0x130803e:$b: ClientPlugin 0x130807e:$b: ClientPlugin 0x791e9:$c: ProjectData 0x1307f63:$c: ProjectData 0x134efc5:$c: ProjectData 0x7a2a1:$d: DESCrypto 0x130896a:$d: DESCrypto 0x1310336:$e: KeepAlive 0x167ebf2:$e: KeepAlive 0x167f30c:$e: KeepAlive 0x167f31a:$e: KeepAlive 0x16801c3:$e: KeepAlive 0x130e324:$g: LogClientMessage 0x130a51f:$i: get_Connected 0x167eb75:$i: get_Connected
RIP_YOUR_PC_LOL.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x1350de4:$a1: netsh firewall add allowedprogram 0x1350fde:$b1: [TAP] 0x1350f84:$b2: & exit 0x16827fe:$b2: & exit 0x1350f50:$c1: md.exe /k ping 0 & del
RIP_YOUR_PC_LOL.exe	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7c448:$hawkstr1: HawkEye Keylogger 0x7d289:$hawkstr1: HawkEye Keylogger 0x7d5b8:$hawkstr1: HawkEye Keylogger 0x7d713:$hawkstr1: HawkEye Keylogger 0x7d876:$hawkstr1: HawkEye Keylogger 0x7db0d:$hawkstr1: HawkEye Keylogger 0x7bfd6:$hawkstr2: Dear HawkEye Customers! 0x7d60b:$hawkstr2: Dear HawkEye Customers! 0x7d762:$hawkstr2: Dear HawkEye Customers! 0x7d8c9:$hawkstr2: Dear HawkEye Customers! 0x7c0f7:$hawkstr3: HawkEye Logger Details:
Click to see the 12 entries

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\gay.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\gay.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
C:\Users\user\AppData\Roaming\gay.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
C:\Users\user\AppData\Roaming\Opus.exe	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
C:\Users\user\AppData\Roaming\Opus.exe	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
C:\Users\user\AppData\Roaming\Opus.exe	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
C:\Users\user\AppData\Roaming\Opus.exe	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
C:\Users\user\AppData\Roaming\Opus.exe	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a797c6ca3f5e7aff8fa1149c47fe9466.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a797c6ca3f5e7aff8fa1149c47fe9466.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a797c6ca3f5e7aff8fa1149c47fe9466.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
C:\Users\user\AppData\Roaming\mediaget.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\mediaget.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
C:\Users\user\AppData\Roaming\mediaget.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
C:\Users\user\AppData\Roaming\test.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\Users\user\AppData\Roaming\test.exe	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99f3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
C:\Windows\Help\active_desktop_render.dll	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xea800:$s1: blackmoon 0xea840:$s2: BlackMoon RunTime Error:
C:\Users\user\AppData\Roaming\Pluto Panel.exe	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8d9:$key: HawkEyeKeylogger 0x7db15:$salt: 099u787978786 0x7bf12:$string1: HawkEye_Keylogger 0x7cd65:$string1: HawkEye_Keylogger 0x7da75:$string1: HawkEye_Keylogger 0x7c2fb:$string2: holdermail.txt 0x7c31b:$string2: holdermail.txt 0x7c23d:$string3: wallet.dat 0x7c255:$string3: wallet.dat 0x7c26b:$string3: wallet.dat 0x7d657:$string4: Keylog Records 0x7d96f:$string4: Keylog Records 0x7db6d:$string5: do not script --> 0x7b8c1:$string6: \pidloc.txt 0x7b927:$string7: BSPLIT 0x7b937:$string7: BSPLIT
C:\Users\user\AppData\Roaming\Pluto Panel.exe	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
C:\Users\user\AppData\Roaming\Pluto Panel.exe	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
C:\Users\user\AppData\Roaming\Pluto Panel.exe	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
C:\Users\user\AppData\Roaming\Pluto Panel.exe	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
C:\Users\user\AppData\Roaming\Pluto Panel.exe	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf6a:$hawkstr1: HawkEye Keylogger 0x7cdab:$hawkstr1: HawkEye Keylogger 0x7d0da:$hawkstr1: HawkEye Keylogger 0x7d235:$hawkstr1: HawkEye Keylogger 0x7d398:$hawkstr1: HawkEye Keylogger 0x7d62f:$hawkstr1: HawkEye Keylogger 0x7baf8:$hawkstr2: Dear HawkEye Customers! 0x7d12d:$hawkstr2: Dear HawkEye Customers! 0x7d284:$hawkstr2: Dear HawkEye Customers! 0x7d3eb:$hawkstr2: Dear HawkEye Customers! 0x7bc19:$hawkstr3: HawkEye Logger Details:
C:\Users\user\AppData\Roaming\3.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Users\user\AppData\Roaming\3.exe	MALWARE_Win_DCRat	DCRat payload	ditekSHen	0x7de78:$x2: DCRat-Log# 0x4e9e2:$x3: DCRat.Code 0x4fe8b:$v1: Plugin couldn't process this action! 0x4fed5:$v2: Unknown command! 0x7ccbd:$v3: PLUGINCONFIGS 0x7ded6:$v4: Saving log... 0x7def2:$v5: ~Work.log 0x4e76a:$v6: MicrophoneNum 0x4e7d0:$v7: WebcamNum 0x7ce55:$v8: %SystemDrive% - Slow 0x7ce7f:$v9: %UsersFolder% - Fast 0x7cea9:$v10: %AppData% - Very Fast 0x7e816:$px1: [Browsers] Scanned elements: 0x7e852:$px2: [Browsers] Grabbing cookies 0x7e91e:$px3: [Browsers] Grabbing passwords 0x7e9fe:$px4: [Browsers] Grabbing forms 0x7eab6:$px5: [Browsers] Grabbing CC 0x7eb50:$px6: [Browsers] Grabbing history 0x7ec1c:$px7: [StealerPlugin] Invoke: 0x7ec4e:$px8: [Other] Grabbing steam 0x7ec9c:$px9: [Other] Grabbing telegram
C:\Users\user\AppData\Roaming\3.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8082e:$s8: Win32_ComputerSystem 0x80a86:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x80b23:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x80c38:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x4ebd4:$cnc4: POST / HTTP/1.1
C:\Users\user\AppData\Roaming\22.exe	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x12866f:$s1: blackmoon 0x1fb420:$s1: blackmoon 0x1286af:$s2: BlackMoon RunTime Error: 0x1fb460:$s2: BlackMoon RunTime Error:
C:\Users\user\AppData\Roaming\healastounding.exe	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x106b1:$x1: NanoCore.ClientPluginHost 0x106ee:$x2: IClientNetworkHost 0x14221:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
C:\Users\user\AppData\Roaming\healastounding.exe	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
C:\Users\user\AppData\Roaming\healastounding.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\Users\user\AppData\Roaming\healastounding.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\healastounding.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x5952a:$s1: netsh firewall delete allowedprogram 0x59420:$s2: netsh firewall add allowedprogram 0x5958a:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x59214:$s4: Execute ERROR 0x59274:$s4: Execute ERROR 0x59238:$s5: Download ERROR 0x595d0:$s6: [kl]
C:\Users\user\AppData\Roaming\healastounding.exe	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x10419:$x1: NanoCore Client 0x10429:$x1: NanoCore Client 0x10671:$x2: NanoCore.ClientPlugin 0x106b1:$x3: NanoCore.ClientPluginHost 0x10666:$i1: IClientApp 0x10687:$i2: IClientData 0x10693:$i3: IClientNetwork 0x106a2:$i4: IClientAppHost 0x106cb:$i5: IClientDataHost 0x106db:$i6: IClientLoggingHost 0x106ee:$i7: IClientNetworkHost 0x10701:$i8: IClientUIHost 0x1070f:$i9: IClientNameObjectCollection 0x1072b:$i10: IClientReadOnlyNameObjectCollection 0x10478:$s1: ClientPlugin 0x1067a:$s1: ClientPlugin 0x10b6e:$s2: EndPoint 0x57a2c:$s2: EndPoint 0x10b77:$s3: IPAddress 0x579f6:$s3: IPAddress 0x3886ca:$s3: IPAddress
C:\Users\user\AppData\Roaming\healastounding.exe	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10419:$a: NanoCore 0x10429:$a: NanoCore 0x1065d:$a: NanoCore 0x10671:$a: NanoCore 0x106b1:$a: NanoCore 0x10478:$b: ClientPlugin 0x1067a:$b: ClientPlugin 0x106ba:$b: ClientPlugin 0x1059f:$c: ProjectData 0x57601:$c: ProjectData 0x10fa6:$d: DESCrypto 0x18972:$e: KeepAlive 0x38722e:$e: KeepAlive 0x387948:$e: KeepAlive 0x387956:$e: KeepAlive 0x3887ff:$e: KeepAlive 0x16960:$g: LogClientMessage 0x12b5b:$i: get_Connected 0x3871b1:$i: get_Connected 0x112dc:$j: #=q 0x1130c:$j: #=q
C:\Users\user\AppData\Roaming\healastounding.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x59420:$a1: netsh firewall add allowedprogram 0x5961a:$b1: [TAP] 0x595c0:$b2: & exit 0x38ae3a:$b2: & exit 0x5958c:$c1: md.exe /k ping 0 & del
Click to see the 35 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000000.414257385.0000000000842000.00000002.00000001.01000000.0000000A.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000009.00000000.414257385.0000000000842000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000000.414257385.0000000000842000.00000002.00000001.01000000.0000000A.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000006.00000000.397644420.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000006.00000000.397644420.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x97f3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000009.00000002.707363158.0000000003ECB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000002.707363158.0000000003ECB000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfa75:$a: NanoCore 0xface:$a: NanoCore 0xfb0b:$a: NanoCore 0xfb84:$a: NanoCore 0x2322f:$a: NanoCore 0x23244:$a: NanoCore 0x23279:$a: NanoCore 0x3c20b:$a: NanoCore 0x3c220:$a: NanoCore 0x3c255:$a: NanoCore 0xfad7:$b: ClientPlugin 0xfb14:$b: ClientPlugin 0x10412:$b: ClientPlugin 0x1041f:$b: ClientPlugin 0x22feb:$b: ClientPlugin 0x23006:$b: ClientPlugin 0x23036:$b: ClientPlugin 0x2324d:$b: ClientPlugin 0x23282:$b: ClientPlugin 0x3bfc7:$b: ClientPlugin 0x3bfe2:$b: ClientPlugin
00000032.00000002.658863684.0000000010101000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Mimikatz_1	Yara detected Mimikatz	Joe Security
00000008.00000000.411478373.00000000000D2000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000008.00000000.411478373.00000000000D2000.00000002.00000001.01000000.00000009.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x7ef2:$a1: netsh firewall add allowedprogram 0x80ec:$b1: [TAP] 0x8092:$b2: & exit 0x805e:$c1: md.exe /k ping 0 & del
00000009.00000000.414807841.0000000000842000.00000002.00000001.01000000.0000000A.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000009.00000000.414807841.0000000000842000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000000.414807841.0000000000842000.00000002.00000001.01000000.0000000A.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000009.00000000.416456851.0000000000842000.00000002.00000001.01000000.0000000A.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000009.00000000.416456851.0000000000842000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000000.416456851.0000000000842000.00000002.00000001.01000000.0000000A.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000009.00000002.700831183.0000000000842000.00000002.00000001.01000000.0000000A.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000009.00000002.700831183.0000000000842000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000002.700831183.0000000000842000.00000002.00000001.01000000.0000000A.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000014.00000003.641078460.00000000035A0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000008.00000002.449565052.00000000000D2000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000008.00000002.449565052.00000000000D2000.00000002.00000001.01000000.00000009.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x7ef2:$a1: netsh firewall add allowedprogram 0x80ec:$b1: [TAP] 0x8092:$b2: & exit 0x805e:$c1: md.exe /k ping 0 & del
00000000.00000003.388952115.00000000059C7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000003.388952115.00000000059C7000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x980b4:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0000002A.00000000.507357595.0000000000FB2000.00000002.00000001.01000000.0000000F.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0000002A.00000000.507357595.0000000000FB2000.00000002.00000001.01000000.0000000F.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x7ef2:$a1: netsh firewall add allowedprogram 0x80ec:$b1: [TAP] 0x8092:$b2: & exit 0x805e:$c1: md.exe /k ping 0 & del
00000011.00000000.445953483.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000011.00000000.445953483.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x7ef2:$a1: netsh firewall add allowedprogram 0x80ec:$b1: [TAP] 0x8092:$b2: & exit 0x805e:$c1: md.exe /k ping 0 & del
00000011.00000002.701265514.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000011.00000002.701265514.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x7ef2:$a1: netsh firewall add allowedprogram 0x80ec:$b1: [TAP] 0x8092:$b2: & exit 0x805e:$c1: md.exe /k ping 0 & del
00000005.00000002.711210574.0000000004691000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000005.00000002.711210574.0000000004691000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000003B.00000000.627731740.00000000007A2000.00000002.00000001.01000000.0000000F.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0000003B.00000000.627731740.00000000007A2000.00000002.00000001.01000000.0000000F.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x7ef2:$a1: netsh firewall add allowedprogram 0x80ec:$b1: [TAP] 0x8092:$b2: & exit 0x805e:$c1: md.exe /k ping 0 & del
00000000.00000000.374606826.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp	LokiBot_Dropper_Packed_R11_Feb18	Auto-generated rule - file scan copy.pdf.r11	Florian Roth	0x55a2:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
00000000.00000000.374606826.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000000.374606826.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x109610:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000011.00000003.646152049.0000000001338000.00000004.00000020.00020000.00000000.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x562:$a1: netsh firewall add allowedprogram 0x75c:$b1: [TAP] 0x702:$b2: & exit 0x6ce:$c1: md.exe /k ping 0 & del
00000024.00000000.475797127.0000000000572000.00000002.00000001.01000000.00000015.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000024.00000000.475797127.0000000000572000.00000002.00000001.01000000.00000015.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000024.00000000.475797127.0000000000572000.00000002.00000001.01000000.00000015.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000006.00000002.701971433.0000000001354000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x2a7e3:$x1: AsyncRAT 0x2a821:$x1: AsyncRAT
00000035.00000002.705801059.0000000010101000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Mimikatz_1	Yara detected Mimikatz	Joe Security
0000001C.00000002.567040014.0000000003081000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001C.00000002.567040014.0000000003081000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x23abf:$a: NanoCore 0x23b18:$a: NanoCore 0x23b55:$a: NanoCore 0x23bce:$a: NanoCore 0x23b21:$b: ClientPlugin 0x23b5e:$b: ClientPlugin 0x2445c:$b: ClientPlugin 0x24469:$b: ClientPlugin 0x1b82c:$e: KeepAlive 0x23fa9:$g: LogClientMessage 0x23f29:$i: get_Connected 0x15af1:$j: #=q 0x15b21:$j: #=q 0x15b5d:$j: #=q 0x15b85:$j: #=q 0x15bb5:$j: #=q 0x15be5:$j: #=q 0x15c15:$j: #=q 0x15c45:$j: #=q 0x15c61:$j: #=q 0x15c91:$j: #=q
00000019.00000003.459495184.0000000000673000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
00000019.00000003.459495184.0000000000673000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000019.00000003.459495184.0000000000673000.00000004.00000020.00020000.00000000.sdmp	Azorult	detect Azorult in memory	JPCERT/CC Incident Response Group	0x20558:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x20bb8:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x222a0:$v2: http://ip-api.com/json 0x20f12:$v3: C6 07 1E C6 47 01 15 C6 47 02 34
0000002E.00000000.548907669.0000000000722000.00000002.00000001.01000000.0000000F.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0000002E.00000000.548907669.0000000000722000.00000002.00000001.01000000.0000000F.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x7ef2:$a1: netsh firewall add allowedprogram 0x80ec:$b1: [TAP] 0x8092:$b2: & exit 0x805e:$c1: md.exe /k ping 0 & del
00000011.00000000.445251023.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000011.00000000.445251023.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x7ef2:$a1: netsh firewall add allowedprogram 0x80ec:$b1: [TAP] 0x8092:$b2: & exit 0x805e:$c1: md.exe /k ping 0 & del
00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x104b1:$x1: NanoCore.ClientPluginHost 0x104ee:$x2: IClientNetworkHost 0x14021:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10219:$a: NanoCore 0x10229:$a: NanoCore 0x1045d:$a: NanoCore 0x10471:$a: NanoCore 0x104b1:$a: NanoCore 0x10278:$b: ClientPlugin 0x1047a:$b: ClientPlugin 0x104ba:$b: ClientPlugin 0x1039f:$c: ProjectData 0x57401:$c: ProjectData 0x10da6:$d: DESCrypto 0x18772:$e: KeepAlive 0x38702e:$e: KeepAlive 0x387748:$e: KeepAlive 0x387756:$e: KeepAlive 0x3885ff:$e: KeepAlive 0x16760:$g: LogClientMessage 0x1295b:$i: get_Connected 0x386fb1:$i: get_Connected 0x110dc:$j: #=q 0x1110c:$j: #=q
00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x59220:$a1: netsh firewall add allowedprogram 0x5941a:$b1: [TAP] 0x593c0:$b2: & exit 0x38ac3a:$b2: & exit 0x5938c:$c1: md.exe /k ping 0 & del
00000007.00000002.468272297.00000000024F0000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_ficker_stealer	Yara detected Ficker Stealer	Joe Security
0000002E.00000002.610238464.0000000000722000.00000002.00000001.01000000.0000000F.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0000002E.00000002.610238464.0000000000722000.00000002.00000001.01000000.0000000F.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x7ef2:$a1: netsh firewall add allowedprogram 0x80ec:$b1: [TAP] 0x8092:$b2: & exit 0x805e:$c1: md.exe /k ping 0 & del
00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6d9:$key: HawkEyeKeylogger 0x7d915:$salt: 099u787978786 0x7bd12:$string1: HawkEye_Keylogger 0x7cb65:$string1: HawkEye_Keylogger 0x7d875:$string1: HawkEye_Keylogger 0x7c0fb:$string2: holdermail.txt 0x7c11b:$string2: holdermail.txt 0x7c03d:$string3: wallet.dat 0x7c055:$string3: wallet.dat 0x7c06b:$string3: wallet.dat 0x7d457:$string4: Keylog Records 0x7d76f:$string4: Keylog Records 0x7d96d:$string5: do not script --> 0x7b6c1:$string6: \pidloc.txt 0x7b727:$string7: BSPLIT 0x7b737:$string7: BSPLIT
00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd6a:$hawkstr1: HawkEye Keylogger 0x7cbab:$hawkstr1: HawkEye Keylogger 0x7ceda:$hawkstr1: HawkEye Keylogger 0x7d035:$hawkstr1: HawkEye Keylogger 0x7d198:$hawkstr1: HawkEye Keylogger 0x7d42f:$hawkstr1: HawkEye Keylogger 0x7b8f8:$hawkstr2: Dear HawkEye Customers! 0x7cf2d:$hawkstr2: Dear HawkEye Customers! 0x7d084:$hawkstr2: Dear HawkEye Customers! 0x7d1eb:$hawkstr2: Dear HawkEye Customers! 0x7ba19:$hawkstr3: HawkEye Logger Details:
0000002A.00000002.552899490.0000000000FB2000.00000002.00000001.01000000.0000000F.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0000002A.00000002.552899490.0000000000FB2000.00000002.00000001.01000000.0000000F.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x7ef2:$a1: netsh firewall add allowedprogram 0x80ec:$b1: [TAP] 0x8092:$b2: & exit 0x805e:$c1: md.exe /k ping 0 & del
00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x12087:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x1d6ce:$a1: netsh firewall add allowedprogram 0x1d8c8:$b1: [TAP] 0x12075:$b2: & exit 0x1d86e:$b2: & exit 0x1d83a:$c1: md.exe /k ping 0 & del
00000005.00000002.706080641.00000000036DB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000005.00000002.706080641.00000000036DB000.00000004.00000800.00020000.00000000.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x5570:$hawkstr1: HawkEye Keylogger 0x6a10:$hawkstr1: HawkEye Keylogger 0x74dc:$hawkstr1: HawkEye Keylogger 0x4fe8:$hawkstr2: Dear HawkEye Customers! 0x6a74:$hawkstr2: Dear HawkEye Customers! 0x7540:$hawkstr2: Dear HawkEye Customers! 0x511a:$hawkstr3: HawkEye Logger Details:
00000000.00000002.693319449.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp	LokiBot_Dropper_Packed_R11_Feb18	Auto-generated rule - file scan copy.pdf.r11	Florian Roth	0x55a2:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
00000000.00000002.693319449.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.693319449.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x109610:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000006.00000000.405813841.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000006.00000000.405813841.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x97f3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000008.00000000.410285813.00000000000D2000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000008.00000000.410285813.00000000000D2000.00000002.00000001.01000000.00000009.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x7ef2:$a1: netsh firewall add allowedprogram 0x80ec:$b1: [TAP] 0x8092:$b2: & exit 0x805e:$c1: md.exe /k ping 0 & del
00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x104b1:$x1: NanoCore.ClientPluginHost 0x104ee:$x2: IClientNetworkHost 0x14021:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10219:$a: NanoCore 0x10229:$a: NanoCore 0x1045d:$a: NanoCore 0x10471:$a: NanoCore 0x104b1:$a: NanoCore 0x10278:$b: ClientPlugin 0x1047a:$b: ClientPlugin 0x104ba:$b: ClientPlugin 0x1039f:$c: ProjectData 0x57401:$c: ProjectData 0x10da6:$d: DESCrypto 0x18772:$e: KeepAlive 0x38702e:$e: KeepAlive 0x387748:$e: KeepAlive 0x387756:$e: KeepAlive 0x3885ff:$e: KeepAlive 0x16760:$g: LogClientMessage 0x1295b:$i: get_Connected 0x386fb1:$i: get_Connected 0x110dc:$j: #=q 0x1110c:$j: #=q
00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x59220:$a1: netsh firewall add allowedprogram 0x5941a:$b1: [TAP] 0x593c0:$b2: & exit 0x38ac3a:$b2: & exit 0x5938c:$c1: md.exe /k ping 0 & del
00000005.00000002.712472379.0000000007710000.00000004.00000001.00040000.00000000.sdmp	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
00000005.00000000.394040229.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6d9:$key: HawkEyeKeylogger 0x7d915:$salt: 099u787978786 0x7bd12:$string1: HawkEye_Keylogger 0x7cb65:$string1: HawkEye_Keylogger 0x7d875:$string1: HawkEye_Keylogger 0x7c0fb:$string2: holdermail.txt 0x7c11b:$string2: holdermail.txt 0x7c03d:$string3: wallet.dat 0x7c055:$string3: wallet.dat 0x7c06b:$string3: wallet.dat 0x7d457:$string4: Keylog Records 0x7d76f:$string4: Keylog Records 0x7d96d:$string5: do not script --> 0x7b6c1:$string6: \pidloc.txt 0x7b727:$string7: BSPLIT 0x7b737:$string7: BSPLIT
00000005.00000000.394040229.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000005.00000000.394040229.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000005.00000000.394040229.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000005.00000000.394040229.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd6a:$hawkstr1: HawkEye Keylogger 0x7cbab:$hawkstr1: HawkEye Keylogger 0x7ceda:$hawkstr1: HawkEye Keylogger 0x7d035:$hawkstr1: HawkEye Keylogger 0x7d198:$hawkstr1: HawkEye Keylogger 0x7d42f:$hawkstr1: HawkEye Keylogger 0x7b8f8:$hawkstr2: Dear HawkEye Customers! 0x7cf2d:$hawkstr2: Dear HawkEye Customers! 0x7d084:$hawkstr2: Dear HawkEye Customers! 0x7d1eb:$hawkstr2: Dear HawkEye Customers! 0x7ba19:$hawkstr3: HawkEye Logger Details:
00000008.00000000.408615715.00000000000D2000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000008.00000000.408615715.00000000000D2000.00000002.00000001.01000000.00000009.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x7ef2:$a1: netsh firewall add allowedprogram 0x80ec:$b1: [TAP] 0x8092:$b2: & exit 0x805e:$c1: md.exe /k ping 0 & del
00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7bbb7:$key: HawkEyeKeylogger 0x7ddf3:$salt: 099u787978786 0x7c1f0:$string1: HawkEye_Keylogger 0x7d043:$string1: HawkEye_Keylogger 0x7dd53:$string1: HawkEye_Keylogger 0x7c5d9:$string2: holdermail.txt 0x7c5f9:$string2: holdermail.txt 0x7c51b:$string3: wallet.dat 0x7c533:$string3: wallet.dat 0x7c549:$string3: wallet.dat 0x7d935:$string4: Keylog Records 0x7dc4d:$string4: Keylog Records 0x7de4b:$string5: do not script --> 0x7bb9f:$string6: \pidloc.txt 0x7bc05:$string7: BSPLIT 0x7bc15:$string7: BSPLIT
00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7c248:$hawkstr1: HawkEye Keylogger 0x7d089:$hawkstr1: HawkEye Keylogger 0x7d3b8:$hawkstr1: HawkEye Keylogger 0x7d513:$hawkstr1: HawkEye Keylogger 0x7d676:$hawkstr1: HawkEye Keylogger 0x7d90d:$hawkstr1: HawkEye Keylogger 0x7bdd6:$hawkstr2: Dear HawkEye Customers! 0x7d40b:$hawkstr2: Dear HawkEye Customers! 0x7d562:$hawkstr2: Dear HawkEye Customers! 0x7d6c9:$hawkstr2: Dear HawkEye Customers! 0x7bef7:$hawkstr3: HawkEye Logger Details:
00000011.00000000.447375879.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000011.00000000.447375879.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x7ef2:$a1: netsh firewall add allowedprogram 0x80ec:$b1: [TAP] 0x8092:$b2: & exit 0x805e:$c1: md.exe /k ping 0 & del
00000006.00000000.394727625.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000006.00000000.394727625.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x97f3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000005.00000000.394636472.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6d9:$key: HawkEyeKeylogger 0x7d915:$salt: 099u787978786 0x7bd12:$string1: HawkEye_Keylogger 0x7cb65:$string1: HawkEye_Keylogger 0x7d875:$string1: HawkEye_Keylogger 0x7c0fb:$string2: holdermail.txt 0x7c11b:$string2: holdermail.txt 0x7c03d:$string3: wallet.dat 0x7c055:$string3: wallet.dat 0x7c06b:$string3: wallet.dat 0x7d457:$string4: Keylog Records 0x7d76f:$string4: Keylog Records 0x7d96d:$string5: do not script --> 0x7b6c1:$string6: \pidloc.txt 0x7b727:$string7: BSPLIT 0x7b737:$string7: BSPLIT
00000005.00000000.394636472.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000005.00000000.394636472.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000005.00000000.394636472.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000005.00000000.394636472.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd6a:$hawkstr1: HawkEye Keylogger 0x7cbab:$hawkstr1: HawkEye Keylogger 0x7ceda:$hawkstr1: HawkEye Keylogger 0x7d035:$hawkstr1: HawkEye Keylogger 0x7d198:$hawkstr1: HawkEye Keylogger 0x7d42f:$hawkstr1: HawkEye Keylogger 0x7b8f8:$hawkstr2: Dear HawkEye Customers! 0x7cf2d:$hawkstr2: Dear HawkEye Customers! 0x7d084:$hawkstr2: Dear HawkEye Customers! 0x7d1eb:$hawkstr2: Dear HawkEye Customers! 0x7ba19:$hawkstr3: HawkEye Logger Details:
00000026.00000000.491059532.0000000000272000.00000002.00000001.01000000.00000015.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000026.00000000.491059532.0000000000272000.00000002.00000001.01000000.00000015.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000026.00000000.491059532.0000000000272000.00000002.00000001.01000000.00000015.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000029.00000002.598333947.0000000010101000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Mimikatz_1	Yara detected Mimikatz	Joe Security
00000006.00000000.399704980.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000006.00000000.399704980.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x97f3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000024.00000002.629223400.0000000000572000.00000002.00000001.01000000.00000015.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000024.00000002.629223400.0000000000572000.00000002.00000001.01000000.00000015.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000024.00000002.629223400.0000000000572000.00000002.00000001.01000000.00000015.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000006.00000002.703770994.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x14293:$x1: AsyncRAT 0x142d1:$x1: AsyncRAT
00000009.00000000.415266906.0000000000842000.00000002.00000001.01000000.0000000A.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000009.00000000.415266906.0000000000842000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000000.415266906.0000000000842000.00000002.00000001.01000000.0000000A.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000019.00000003.459275166.0000000000698000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
00000019.00000003.459275166.0000000000698000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000019.00000003.459275166.0000000000698000.00000004.00000020.00020000.00000000.sdmp	Azorult	detect Azorult in memory	JPCERT/CC Incident Response Group	0x1756c:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x17bcc:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x192b4:$v2: http://ip-api.com/json 0x17f26:$v3: C6 07 1E C6 47 01 15 C6 47 02 34
00000005.00000002.701277187.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6d9:$key: HawkEyeKeylogger 0x7d915:$salt: 099u787978786 0x7bd12:$string1: HawkEye_Keylogger 0x7cb65:$string1: HawkEye_Keylogger 0x7d875:$string1: HawkEye_Keylogger 0x7c0fb:$string2: holdermail.txt 0x7c11b:$string2: holdermail.txt 0x7c03d:$string3: wallet.dat 0x7c055:$string3: wallet.dat 0x7c06b:$string3: wallet.dat 0x7d457:$string4: Keylog Records 0x7d76f:$string4: Keylog Records 0x7d96d:$string5: do not script --> 0x7b6c1:$string6: \pidloc.txt 0x7b727:$string7: BSPLIT 0x7b737:$string7: BSPLIT
00000005.00000002.701277187.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000005.00000002.701277187.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000005.00000002.701277187.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000005.00000002.701277187.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd6a:$hawkstr1: HawkEye Keylogger 0x7cbab:$hawkstr1: HawkEye Keylogger 0x7ceda:$hawkstr1: HawkEye Keylogger 0x7d035:$hawkstr1: HawkEye Keylogger 0x7d198:$hawkstr1: HawkEye Keylogger 0x7d42f:$hawkstr1: HawkEye Keylogger 0x7b8f8:$hawkstr2: Dear HawkEye Customers! 0x7cf2d:$hawkstr2: Dear HawkEye Customers! 0x7d084:$hawkstr2: Dear HawkEye Customers! 0x7d1eb:$hawkstr2: Dear HawkEye Customers! 0x7ba19:$hawkstr3: HawkEye Logger Details:
00000019.00000003.458681148.000000000067C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
00000019.00000003.458681148.000000000067C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000019.00000003.458681148.000000000067C000.00000004.00000020.00020000.00000000.sdmp	Azorult	detect Azorult in memory	JPCERT/CC Incident Response Group	0x1755c:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x17bbc:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x3356c:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x33bcc:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x192a4:$v2: http://ip-api.com/json 0x352b4:$v2: http://ip-api.com/json 0x17f16:$v3: C6 07 1E C6 47 01 15 C6 47 02 34 0x33f26:$v3: C6 07 1E C6 47 01 15 C6 47 02 34
00000000.00000002.502131214.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7bbb7:$key: HawkEyeKeylogger 0x7ddf3:$salt: 099u787978786 0x7c1f0:$string1: HawkEye_Keylogger 0x7d043:$string1: HawkEye_Keylogger 0x7dd53:$string1: HawkEye_Keylogger 0x7c5d9:$string2: holdermail.txt 0x7c5f9:$string2: holdermail.txt 0x7c51b:$string3: wallet.dat 0x7c533:$string3: wallet.dat 0x7c549:$string3: wallet.dat 0x7d935:$string4: Keylog Records 0x7dc4d:$string4: Keylog Records 0x7de4b:$string5: do not script --> 0x7bb9f:$string6: \pidloc.txt 0x7bc05:$string7: BSPLIT 0x7bc15:$string7: BSPLIT
00000000.00000002.502131214.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000000.00000002.502131214.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000000.00000002.502131214.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000000.00000002.502131214.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7c248:$hawkstr1: HawkEye Keylogger 0x7d089:$hawkstr1: HawkEye Keylogger 0x7d3b8:$hawkstr1: HawkEye Keylogger 0x7d513:$hawkstr1: HawkEye Keylogger 0x7d676:$hawkstr1: HawkEye Keylogger 0x7d90d:$hawkstr1: HawkEye Keylogger 0x7bdd6:$hawkstr2: Dear HawkEye Customers! 0x7d40b:$hawkstr2: Dear HawkEye Customers! 0x7d562:$hawkstr2: Dear HawkEye Customers! 0x7d6c9:$hawkstr2: Dear HawkEye Customers! 0x7bef7:$hawkstr3: HawkEye Logger Details:
0000001C.00000002.579383399.0000000004081000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001C.00000002.579383399.0000000004081000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x49a75:$a: NanoCore 0x49ace:$a: NanoCore 0x49b0b:$a: NanoCore 0x49b84:$a: NanoCore 0x5d22f:$a: NanoCore 0x5d244:$a: NanoCore 0x5d279:$a: NanoCore 0x7620b:$a: NanoCore 0x76220:$a: NanoCore 0x76255:$a: NanoCore 0x49ad7:$b: ClientPlugin 0x49b14:$b: ClientPlugin 0x4a412:$b: ClientPlugin 0x4a41f:$b: ClientPlugin 0x5cfeb:$b: ClientPlugin 0x5d006:$b: ClientPlugin 0x5d036:$b: ClientPlugin 0x5d24d:$b: ClientPlugin 0x5d282:$b: ClientPlugin 0x75fc7:$b: ClientPlugin 0x75fe2:$b: ClientPlugin
00000000.00000003.386628983.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000003.386628983.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x38688:$a1: netsh firewall add allowedprogram 0x38882:$b1: [TAP] 0x38828:$b2: & exit 0x387f4:$c1: md.exe /k ping 0 & del
00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x466e75:$x1: NanoCore.ClientPluginHost 0x466eb2:$x2: IClientNetworkHost 0x46a9e5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x466bdd:$a: NanoCore 0x466bed:$a: NanoCore 0x466e21:$a: NanoCore 0x466e35:$a: NanoCore 0x466e75:$a: NanoCore 0x466c3c:$b: ClientPlugin 0x466e3e:$b: ClientPlugin 0x466e7e:$b: ClientPlugin 0x466d63:$c: ProjectData 0x4addc5:$c: ProjectData 0x46776a:$d: DESCrypto 0x46f136:$e: KeepAlive 0x46d124:$g: LogClientMessage 0x46931f:$i: get_Connected 0x467aa0:$j: #=q 0x467ad0:$j: #=q 0x467aec:$j: #=q 0x467b1c:$j: #=q 0x467b38:$j: #=q 0x467b54:$j: #=q 0x467b84:$j: #=q
00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4afbe4:$a1: netsh firewall add allowedprogram 0x4afdde:$b1: [TAP] 0x4afd84:$b2: & exit 0x4afd50:$c1: md.exe /k ping 0 & del
0000001C.00000002.514866763.0000000000922000.00000002.00000001.01000000.0000000A.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000001C.00000002.514866763.0000000000922000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001C.00000002.514866763.0000000000922000.00000002.00000001.01000000.0000000A.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x5ab31:$key: HawkEyeKeylogger 0x5cd6d:$salt: 099u787978786 0x5b16a:$string1: HawkEye_Keylogger 0x5bfbd:$string1: HawkEye_Keylogger 0x5cccd:$string1: HawkEye_Keylogger 0x5b553:$string2: holdermail.txt 0x5b573:$string2: holdermail.txt 0x5b495:$string3: wallet.dat 0x5b4ad:$string3: wallet.dat 0x5b4c3:$string3: wallet.dat 0x5c8af:$string4: Keylog Records 0x5cbc7:$string4: Keylog Records 0x5cdc5:$string5: do not script --> 0x5ab19:$string6: \pidloc.txt 0x5ab7f:$string7: BSPLIT 0x5ab8f:$string7: BSPLIT
00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x5b1c2:$hawkstr1: HawkEye Keylogger 0x5c003:$hawkstr1: HawkEye Keylogger 0x5c332:$hawkstr1: HawkEye Keylogger 0x5c48d:$hawkstr1: HawkEye Keylogger 0x5c5f0:$hawkstr1: HawkEye Keylogger 0x5c887:$hawkstr1: HawkEye Keylogger 0x5ad50:$hawkstr2: Dear HawkEye Customers! 0x5c385:$hawkstr2: Dear HawkEye Customers! 0x5c4dc:$hawkstr2: Dear HawkEye Customers! 0x5c643:$hawkstr2: Dear HawkEye Customers! 0x5ae71:$hawkstr3: HawkEye Logger Details:
00000000.00000001.375725825.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7bbb7:$key: HawkEyeKeylogger 0x7ddf3:$salt: 099u787978786 0x7c1f0:$string1: HawkEye_Keylogger 0x7d043:$string1: HawkEye_Keylogger 0x7dd53:$string1: HawkEye_Keylogger 0x7c5d9:$string2: holdermail.txt 0x7c5f9:$string2: holdermail.txt 0x7c51b:$string3: wallet.dat 0x7c533:$string3: wallet.dat 0x7c549:$string3: wallet.dat 0x7d935:$string4: Keylog Records 0x7dc4d:$string4: Keylog Records 0x7de4b:$string5: do not script --> 0x7bb9f:$string6: \pidloc.txt 0x7bc05:$string7: BSPLIT 0x7bc15:$string7: BSPLIT
00000000.00000001.375725825.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000000.00000001.375725825.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000000.00000001.375725825.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000000.00000001.375725825.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7c248:$hawkstr1: HawkEye Keylogger 0x7d089:$hawkstr1: HawkEye Keylogger 0x7d3b8:$hawkstr1: HawkEye Keylogger 0x7d513:$hawkstr1: HawkEye Keylogger 0x7d676:$hawkstr1: HawkEye Keylogger 0x7d90d:$hawkstr1: HawkEye Keylogger 0x7bdd6:$hawkstr2: Dear HawkEye Customers! 0x7d40b:$hawkstr2: Dear HawkEye Customers! 0x7d562:$hawkstr2: Dear HawkEye Customers! 0x7d6c9:$hawkstr2: Dear HawkEye Customers! 0x7bef7:$hawkstr3: HawkEye Logger Details:
00000004.00000002.546334194.0000000004474000.00000004.00000800.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x103f5:$x1: NanoCore.ClientPluginHost 0x10432:$x2: IClientNetworkHost 0x13f65:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000004.00000002.546334194.0000000004474000.00000004.00000800.00020000.00000000.sdmp	LokiBot_Dropper_Packed_R11_Feb18	Auto-generated rule - file scan copy.pdf.r11	Florian Roth	0x5511c:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB 0xcc03c:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
00000004.00000002.546334194.0000000004474000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000004.00000002.546334194.0000000004474000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1015d:$a: NanoCore 0x1016d:$a: NanoCore 0x103a1:$a: NanoCore 0x103b5:$a: NanoCore 0x103f5:$a: NanoCore 0x101bc:$b: ClientPlugin 0x103be:$b: ClientPlugin 0x103fe:$b: ClientPlugin 0x102e3:$c: ProjectData 0x10cea:$d: DESCrypto 0x186b6:$e: KeepAlive 0x166a4:$g: LogClientMessage 0x1289f:$i: get_Connected 0x11020:$j: #=q 0x11050:$j: #=q 0x1106c:$j: #=q 0x1109c:$j: #=q 0x110b8:$j: #=q 0x110d4:$j: #=q 0x11104:$j: #=q 0x11120:$j: #=q
00000011.00000000.446671445.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000011.00000000.446671445.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x7ef2:$a1: netsh firewall add allowedprogram 0x80ec:$b1: [TAP] 0x8092:$b2: & exit 0x805e:$c1: md.exe /k ping 0 & del
00000009.00000002.708577022.0000000005870000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
00000009.00000002.708577022.0000000005870000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
00000009.00000002.708577022.0000000005870000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
00000008.00000000.409570794.00000000000D2000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000008.00000000.409570794.00000000000D2000.00000002.00000001.01000000.00000009.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x7ef2:$a1: netsh firewall add allowedprogram 0x80ec:$b1: [TAP] 0x8092:$b2: & exit 0x805e:$c1: md.exe /k ping 0 & del
00000019.00000003.458183685.0000000000660000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
00000019.00000003.458183685.0000000000660000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000019.00000003.458183685.0000000000660000.00000004.00000020.00020000.00000000.sdmp	Azorult	detect Azorult in memory	JPCERT/CC Incident Response Group	0x3355c:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x33bbc:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x352a4:$v2: http://ip-api.com/json 0x33f16:$v3: C6 07 1E C6 47 01 15 C6 47 02 34
00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x104b1:$x1: NanoCore.ClientPluginHost 0x104ee:$x2: IClientNetworkHost 0x14021:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10219:$a: NanoCore 0x10229:$a: NanoCore 0x1045d:$a: NanoCore 0x10471:$a: NanoCore 0x104b1:$a: NanoCore 0x10278:$b: ClientPlugin 0x1047a:$b: ClientPlugin 0x104ba:$b: ClientPlugin 0x1039f:$c: ProjectData 0x57401:$c: ProjectData 0x10da6:$d: DESCrypto 0x18772:$e: KeepAlive 0x38702e:$e: KeepAlive 0x387748:$e: KeepAlive 0x387756:$e: KeepAlive 0x3885ff:$e: KeepAlive 0x16760:$g: LogClientMessage 0x1295b:$i: get_Connected 0x386fb1:$i: get_Connected 0x110dc:$j: #=q 0x1110c:$j: #=q
00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x59220:$a1: netsh firewall add allowedprogram 0x5941a:$b1: [TAP] 0x593c0:$b2: & exit 0x38ac3a:$b2: & exit 0x5938c:$c1: md.exe /k ping 0 & del
00000006.00000002.701012196.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000006.00000002.701012196.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x97f3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000025.00000000.491609227.00000000002A2000.00000002.00000001.01000000.00000016.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000025.00000000.491609227.00000000002A2000.00000002.00000001.01000000.00000016.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8062e:$s8: Win32_ComputerSystem 0x80886:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x80923:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x80a38:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x4e9d4:$cnc4: POST / HTTP/1.1
0000001C.00000000.461250332.0000000000922000.00000002.00000001.01000000.0000000A.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000001C.00000000.461250332.0000000000922000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001C.00000000.461250332.0000000000922000.00000002.00000001.01000000.0000000A.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000000.00000002.679442760.0000000001893000.00000002.00000001.01000000.00000003.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x466e75:$x1: NanoCore.ClientPluginHost 0x466eb2:$x2: IClientNetworkHost 0x46a9e5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.679442760.0000000001893000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.679442760.0000000001893000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000002.679442760.0000000001893000.00000002.00000001.01000000.00000003.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x466bdd:$a: NanoCore 0x466bed:$a: NanoCore 0x466e21:$a: NanoCore 0x466e35:$a: NanoCore 0x466e75:$a: NanoCore 0x466c3c:$b: ClientPlugin 0x466e3e:$b: ClientPlugin 0x466e7e:$b: ClientPlugin 0x466d63:$c: ProjectData 0x4addc5:$c: ProjectData 0x46776a:$d: DESCrypto 0x46f136:$e: KeepAlive 0x46d124:$g: LogClientMessage 0x46931f:$i: get_Connected 0x467aa0:$j: #=q 0x467ad0:$j: #=q 0x467aec:$j: #=q 0x467b1c:$j: #=q 0x467b38:$j: #=q 0x467b54:$j: #=q 0x467b84:$j: #=q
00000000.00000002.679442760.0000000001893000.00000002.00000001.01000000.00000003.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4afbe4:$a1: netsh firewall add allowedprogram 0x4afdde:$b1: [TAP] 0x4afd84:$b2: & exit 0x4afd50:$c1: md.exe /k ping 0 & del
00000009.00000002.708751563.0000000005B00000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
00000009.00000002.708751563.0000000005B00000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
00000009.00000002.708751563.0000000005B00000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000002.708751563.0000000005B00000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xf778:$x2: NanoCore.ClientPlugin 0xf7ad:$x3: NanoCore.ClientPluginHost 0xf76c:$i2: IClientData 0xf78e:$i3: IClientNetwork 0xf79d:$i5: IClientDataHost 0xf7c7:$i6: IClientLoggingHost 0xf7da:$i7: IClientNetworkHost 0xf7ed:$i8: IClientUIHost 0xf7fb:$i9: IClientNameObjectCollection 0xf817:$i10: IClientReadOnlyNameObjectCollection 0xf56a:$s1: ClientPlugin 0xf781:$s1: ClientPlugin 0x147a2:$s6: get_ClientSettings
00000005.00000002.712461562.0000000007700000.00000004.00000001.00040000.00000000.sdmp	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
00000024.00000002.674377761.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000024.00000002.674377761.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x49a75:$a: NanoCore 0x49ace:$a: NanoCore 0x49b0b:$a: NanoCore 0x49b84:$a: NanoCore 0x5d22f:$a: NanoCore 0x5d244:$a: NanoCore 0x5d279:$a: NanoCore 0x7620b:$a: NanoCore 0x76220:$a: NanoCore 0x76255:$a: NanoCore 0x49ad7:$b: ClientPlugin 0x49b14:$b: ClientPlugin 0x4a412:$b: ClientPlugin 0x4a41f:$b: ClientPlugin 0x5cfeb:$b: ClientPlugin 0x5d006:$b: ClientPlugin 0x5d036:$b: ClientPlugin 0x5d24d:$b: ClientPlugin 0x5d282:$b: ClientPlugin 0x75fc7:$b: ClientPlugin 0x75fe2:$b: ClientPlugin
00000024.00000002.673042782.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000024.00000002.673042782.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x23ba3:$a: NanoCore 0x23bfc:$a: NanoCore 0x23c39:$a: NanoCore 0x23cb2:$a: NanoCore 0x23c05:$b: ClientPlugin 0x23c42:$b: ClientPlugin 0x24540:$b: ClientPlugin 0x2454d:$b: ClientPlugin 0x1b910:$e: KeepAlive 0x2408d:$g: LogClientMessage 0x2400d:$i: get_Connected 0x15bd5:$j: #=q 0x15c05:$j: #=q 0x15c41:$j: #=q 0x15c69:$j: #=q 0x15c99:$j: #=q 0x15cc9:$j: #=q 0x15cf9:$j: #=q 0x15d29:$j: #=q 0x15d45:$j: #=q 0x15d75:$j: #=q
00000005.00000000.397247474.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6d9:$key: HawkEyeKeylogger 0x7d915:$salt: 099u787978786 0x7bd12:$string1: HawkEye_Keylogger 0x7cb65:$string1: HawkEye_Keylogger 0x7d875:$string1: HawkEye_Keylogger 0x7c0fb:$string2: holdermail.txt 0x7c11b:$string2: holdermail.txt 0x7c03d:$string3: wallet.dat 0x7c055:$string3: wallet.dat 0x7c06b:$string3: wallet.dat 0x7d457:$string4: Keylog Records 0x7d76f:$string4: Keylog Records 0x7d96d:$string5: do not script --> 0x7b6c1:$string6: \pidloc.txt 0x7b727:$string7: BSPLIT 0x7b737:$string7: BSPLIT
00000005.00000000.397247474.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000005.00000000.397247474.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000005.00000000.397247474.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000005.00000000.397247474.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd6a:$hawkstr1: HawkEye Keylogger 0x7cbab:$hawkstr1: HawkEye Keylogger 0x7ceda:$hawkstr1: HawkEye Keylogger 0x7d035:$hawkstr1: HawkEye Keylogger 0x7d198:$hawkstr1: HawkEye Keylogger 0x7d42f:$hawkstr1: HawkEye Keylogger 0x7b8f8:$hawkstr2: Dear HawkEye Customers! 0x7cf2d:$hawkstr2: Dear HawkEye Customers! 0x7d084:$hawkstr2: Dear HawkEye Customers! 0x7d1eb:$hawkstr2: Dear HawkEye Customers! 0x7ba19:$hawkstr3: HawkEye Logger Details:
00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x104b1:$x1: NanoCore.ClientPluginHost 0x104ee:$x2: IClientNetworkHost 0x14021:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10219:$a: NanoCore 0x10229:$a: NanoCore 0x1045d:$a: NanoCore 0x10471:$a: NanoCore 0x104b1:$a: NanoCore 0x10278:$b: ClientPlugin 0x1047a:$b: ClientPlugin 0x104ba:$b: ClientPlugin 0x1039f:$c: ProjectData 0x57401:$c: ProjectData 0x10da6:$d: DESCrypto 0x18772:$e: KeepAlive 0x38702e:$e: KeepAlive 0x387748:$e: KeepAlive 0x387756:$e: KeepAlive 0x3885ff:$e: KeepAlive 0x16760:$g: LogClientMessage 0x1295b:$i: get_Connected 0x386fb1:$i: get_Connected 0x110dc:$j: #=q 0x1110c:$j: #=q
00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x59220:$a1: netsh firewall add allowedprogram 0x5941a:$b1: [TAP] 0x593c0:$b2: & exit 0x38ac3a:$b2: & exit 0x5938c:$c1: md.exe /k ping 0 & del
00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x104b1:$x1: NanoCore.ClientPluginHost 0x104ee:$x2: IClientNetworkHost 0x14021:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10219:$a: NanoCore 0x10229:$a: NanoCore 0x1045d:$a: NanoCore 0x10471:$a: NanoCore 0x104b1:$a: NanoCore 0x10278:$b: ClientPlugin 0x1047a:$b: ClientPlugin 0x104ba:$b: ClientPlugin 0x1039f:$c: ProjectData 0x57401:$c: ProjectData 0x10da6:$d: DESCrypto 0x18772:$e: KeepAlive 0x38702e:$e: KeepAlive 0x387748:$e: KeepAlive 0x387756:$e: KeepAlive 0x3885ff:$e: KeepAlive 0x16760:$g: LogClientMessage 0x1295b:$i: get_Connected 0x386fb1:$i: get_Connected 0x110dc:$j: #=q 0x1110c:$j: #=q
00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x59220:$a1: netsh firewall add allowedprogram 0x5941a:$b1: [TAP] 0x593c0:$b2: & exit 0x38ac3a:$b2: & exit 0x5938c:$c1: md.exe /k ping 0 & del
Process Memory Space: RIP_YOUR_PC_LOL.exe PID: 6880	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RIP_YOUR_PC_LOL.exe PID: 6880	JoeSecurity_GenericDropper	Yara detected Generic Dropper	Joe Security
Process Memory Space: RIP_YOUR_PC_LOL.exe PID: 6880	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: RIP_YOUR_PC_LOL.exe PID: 6880	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: RIP_YOUR_PC_LOL.exe PID: 6880	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
Process Memory Space: RIP_YOUR_PC_LOL.exe PID: 6880	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: RIP_YOUR_PC_LOL.exe PID: 6880	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x270fc:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x3900d:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: healastounding.exe PID: 3572	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1344:$x1: NanoCore.ClientPluginHost 0x60461:$x1: NanoCore.ClientPluginHost 0x1381:$x2: IClientNetworkHost 0x6049e:$x2: IClientNetworkHost 0x4e72:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xfef8:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x63f8f:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x6f015:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: healastounding.exe PID: 3572	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: healastounding.exe PID: 3572	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: healastounding.exe PID: 3572	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: healastounding.exe PID: 3572	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x480c6:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x595f0:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: healastounding.exe PID: 3572	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1011:$a: NanoCore 0x1021:$a: NanoCore 0x10e0:$a: NanoCore 0x10ef:$a: NanoCore 0x12f0:$a: NanoCore 0x1304:$a: NanoCore 0x1344:$a: NanoCore 0xc562:$a: NanoCore 0xc574:$a: NanoCore 0xc5b0:$a: NanoCore 0x6012e:$a: NanoCore 0x6013e:$a: NanoCore 0x601fd:$a: NanoCore 0x6020c:$a: NanoCore 0x6040d:$a: NanoCore 0x60421:$a: NanoCore 0x60461:$a: NanoCore 0x6b67f:$a: NanoCore 0x6b691:$a: NanoCore 0x6b6cd:$a: NanoCore 0x1070:$b: ClientPlugin
Process Memory Space: Pluto Panel.exe PID: 4236	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: Pluto Panel.exe PID: 4236	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
Process Memory Space: Pluto Panel.exe PID: 4236	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: test.exe PID: 6236	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: test.exe PID: 6236	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x134c7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: test.exe PID: 6236	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1da3a:$x1: AsyncRAT 0x1da6c:$x1: AsyncRAT 0x1358d:$s6: VirtualBox 0x13540:$s8: Win32_ComputerSystem
Process Memory Space: gay.exe PID: 1104	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: Opus.exe PID: 3244	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x115a:$x1: NanoCore.ClientPluginHost 0x18095:$x1: NanoCore.ClientPluginHost 0x585b2:$x1: NanoCore.ClientPluginHost 0x73f33:$x1: NanoCore.ClientPluginHost 0x794cd:$x1: NanoCore.ClientPluginHost 0x1197:$x2: IClientNetworkHost 0x180af:$x2: IClientNetworkHost 0x585cc:$x2: IClientNetworkHost 0x73f4d:$x2: IClientNetworkHost 0x794fa:$x2: IClientNetworkHost 0x4c88:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xfd0e:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: Opus.exe PID: 3244	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: Opus.exe PID: 3244	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe27:$a: NanoCore 0xe37:$a: NanoCore 0xef6:$a: NanoCore 0xf05:$a: NanoCore 0x1106:$a: NanoCore 0x111a:$a: NanoCore 0x115a:$a: NanoCore 0xc378:$a: NanoCore 0xc38a:$a: NanoCore 0xc3c6:$a: NanoCore 0x17fff:$a: NanoCore 0x18058:$a: NanoCore 0x18095:$a: NanoCore 0x1810e:$a: NanoCore 0x189c7:$a: NanoCore 0x18a1a:$a: NanoCore 0x18a53:$a: NanoCore 0x18ac6:$a: NanoCore 0x20098:$a: NanoCore 0x200ab:$a: NanoCore 0x200dd:$a: NanoCore
Process Memory Space: mediaget.exe PID: 4688	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Click to see the 237 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.RIP_YOUR_PC_LOL.exe.206ac1d.13.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.206ac1d.13.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99f3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.RIP_YOUR_PC_LOL.exe.d4dd52.5.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x4e6a:$s1: blackmoon 0x4eaa:$s2: BlackMoon RunTime Error:
0.3.RIP_YOUR_PC_LOL.exe.5a556c1.5.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.3.RIP_YOUR_PC_LOL.exe.5a556c1.5.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x7bf3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
9.2.Opus.exe.840000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.2.Opus.exe.840000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
9.2.Opus.exe.840000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.2.Opus.exe.840000.0.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
9.2.Opus.exe.840000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
9.0.Opus.exe.840000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.0.Opus.exe.840000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
9.0.Opus.exe.840000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.0.Opus.exe.840000.0.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
9.0.Opus.exe.840000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.3.RIP_YOUR_PC_LOL.exe.5731eca.7.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
4.2.healastounding.exe.34865dc.7.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.2.healastounding.exe.34865dc.7.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x63fc:$s1: netsh firewall delete allowedprogram 0x62f2:$s2: netsh firewall add allowedprogram 0x645c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x60e6:$s4: Execute ERROR 0x6146:$s4: Execute ERROR 0x610a:$s5: Download ERROR 0x64a2:$s6: [kl]
4.2.healastounding.exe.34865dc.7.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x62f2:$a1: netsh firewall add allowedprogram 0x64ec:$b1: [TAP] 0x6492:$b2: & exit 0x645e:$c1: md.exe /k ping 0 & del
8.0.gay.exe.d0000.2.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
8.0.gay.exe.d0000.2.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
8.0.gay.exe.d0000.2.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
0.0.RIP_YOUR_PC_LOL.exe.c8867b.4.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xca541:$s1: blackmoon 0xca581:$s2: BlackMoon RunTime Error:
5.0.Pluto Panel.exe.f19c0d.11.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
11.0.22.exe.5f65b6.17.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x4e6a:$s1: blackmoon 0x4eaa:$s2: BlackMoon RunTime Error:
5.2.Pluto Panel.exe.36b9cb4.4.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe0f5:$x1: NanoCore Client 0xe105:$x1: NanoCore Client 0xe34d:$x2: NanoCore.ClientPlugin 0xe38d:$x3: NanoCore.ClientPluginHost 0xe342:$i1: IClientApp 0xe363:$i2: IClientData 0xe36f:$i3: IClientNetwork 0xe37e:$i4: IClientAppHost 0xe3a7:$i5: IClientDataHost 0xe3b7:$i6: IClientLoggingHost 0xe3ca:$i7: IClientNetworkHost 0xe3dd:$i8: IClientUIHost 0xe3eb:$i9: IClientNameObjectCollection 0xe407:$i10: IClientReadOnlyNameObjectCollection 0xe154:$s1: ClientPlugin 0xe356:$s1: ClientPlugin 0xe84a:$s2: EndPoint 0xe853:$s3: IPAddress 0xe85d:$s4: IPEndPoint 0x10293:$s6: get_ClientSettings 0x10837:$s7: get_Connected
0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
0.0.RIP_YOUR_PC_LOL.exe.9fa0eb.2.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.0.Pluto Panel.exe.f10000.8.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8d9:$key: HawkEyeKeylogger 0x7db15:$salt: 099u787978786 0x7bf12:$string1: HawkEye_Keylogger 0x7cd65:$string1: HawkEye_Keylogger 0x7da75:$string1: HawkEye_Keylogger 0x7c2fb:$string2: holdermail.txt 0x7c31b:$string2: holdermail.txt 0x7c23d:$string3: wallet.dat 0x7c255:$string3: wallet.dat 0x7c26b:$string3: wallet.dat 0x7d657:$string4: Keylog Records 0x7d96f:$string4: Keylog Records 0x7db6d:$string5: do not script --> 0x7b8c1:$string6: \pidloc.txt 0x7b927:$string7: BSPLIT 0x7b937:$string7: BSPLIT
5.0.Pluto Panel.exe.f10000.8.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
5.0.Pluto Panel.exe.f10000.8.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.0.Pluto Panel.exe.f10000.8.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.0.Pluto Panel.exe.f10000.8.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.0.Pluto Panel.exe.f10000.8.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf6a:$hawkstr1: HawkEye Keylogger 0x7cdab:$hawkstr1: HawkEye Keylogger 0x7d0da:$hawkstr1: HawkEye Keylogger 0x7d235:$hawkstr1: HawkEye Keylogger 0x7d398:$hawkstr1: HawkEye Keylogger 0x7d62f:$hawkstr1: HawkEye Keylogger 0x7baf8:$hawkstr2: Dear HawkEye Customers! 0x7d12d:$hawkstr2: Dear HawkEye Customers! 0x7d284:$hawkstr2: Dear HawkEye Customers! 0x7d3eb:$hawkstr2: Dear HawkEye Customers! 0x7bc19:$hawkstr3: HawkEye Logger Details:
0.1.RIP_YOUR_PC_LOL.exe.9fa0eb.2.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.2.Pluto Panel.exe.f6fa72.1.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x1dc67:$key: HawkEyeKeylogger 0x1fea3:$salt: 099u787978786 0x1e2a0:$string1: HawkEye_Keylogger 0x1f0f3:$string1: HawkEye_Keylogger 0x1fe03:$string1: HawkEye_Keylogger 0x1e689:$string2: holdermail.txt 0x1e6a9:$string2: holdermail.txt 0x1e5cb:$string3: wallet.dat 0x1e5e3:$string3: wallet.dat 0x1e5f9:$string3: wallet.dat 0x1f9e5:$string4: Keylog Records 0x1fcfd:$string4: Keylog Records 0x1fefb:$string5: do not script --> 0x1dc4f:$string6: \pidloc.txt 0x1dcb5:$string7: BSPLIT 0x1dcc5:$string7: BSPLIT
5.2.Pluto Panel.exe.f6fa72.1.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.2.Pluto Panel.exe.f6fa72.1.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.2.Pluto Panel.exe.f6fa72.1.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x1e2f8:$hawkstr1: HawkEye Keylogger 0x1f139:$hawkstr1: HawkEye Keylogger 0x1f468:$hawkstr1: HawkEye Keylogger 0x1f5c3:$hawkstr1: HawkEye Keylogger 0x1f726:$hawkstr1: HawkEye Keylogger 0x1f9bd:$hawkstr1: HawkEye Keylogger 0x1de86:$hawkstr2: Dear HawkEye Customers! 0x1f4bb:$hawkstr2: Dear HawkEye Customers! 0x1f612:$hawkstr2: Dear HawkEye Customers! 0x1f779:$hawkstr2: Dear HawkEye Customers! 0x1dfa7:$hawkstr3: HawkEye Logger Details:
5.2.Pluto Panel.exe.f10000.0.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8d9:$key: HawkEyeKeylogger 0x7db15:$salt: 099u787978786 0x7bf12:$string1: HawkEye_Keylogger 0x7cd65:$string1: HawkEye_Keylogger 0x7da75:$string1: HawkEye_Keylogger 0x7c2fb:$string2: holdermail.txt 0x7c31b:$string2: holdermail.txt 0x7c23d:$string3: wallet.dat 0x7c255:$string3: wallet.dat 0x7c26b:$string3: wallet.dat 0x7d657:$string4: Keylog Records 0x7d96f:$string4: Keylog Records 0x7db6d:$string5: do not script --> 0x7b8c1:$string6: \pidloc.txt 0x7b927:$string7: BSPLIT 0x7b937:$string7: BSPLIT
5.2.Pluto Panel.exe.f10000.0.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
5.2.Pluto Panel.exe.f10000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.2.Pluto Panel.exe.f10000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.2.Pluto Panel.exe.f10000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.2.Pluto Panel.exe.f10000.0.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf6a:$hawkstr1: HawkEye Keylogger 0x7cdab:$hawkstr1: HawkEye Keylogger 0x7d0da:$hawkstr1: HawkEye Keylogger 0x7d235:$hawkstr1: HawkEye Keylogger 0x7d398:$hawkstr1: HawkEye Keylogger 0x7d62f:$hawkstr1: HawkEye Keylogger 0x7baf8:$hawkstr2: Dear HawkEye Customers! 0x7d12d:$hawkstr2: Dear HawkEye Customers! 0x7d284:$hawkstr2: Dear HawkEye Customers! 0x7d3eb:$hawkstr2: Dear HawkEye Customers! 0x7bc19:$hawkstr3: HawkEye Logger Details:
9.2.Opus.exe.5b00000.7.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
9.2.Opus.exe.5b00000.7.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
9.2.Opus.exe.5b00000.7.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.2.Opus.exe.5b00000.7.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xf778:$x2: NanoCore.ClientPlugin 0xf7ad:$x3: NanoCore.ClientPluginHost 0xf76c:$i2: IClientData 0xf78e:$i3: IClientNetwork 0xf79d:$i5: IClientDataHost 0xf7c7:$i6: IClientLoggingHost 0xf7da:$i7: IClientNetworkHost 0xf7ed:$i8: IClientUIHost 0xf7fb:$i9: IClientNameObjectCollection 0xf817:$i10: IClientReadOnlyNameObjectCollection 0xf56a:$s1: ClientPlugin 0xf781:$s1: ClientPlugin 0x147a2:$s6: get_ClientSettings
5.2.Pluto Panel.exe.f18208.3.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x754d1:$key: HawkEyeKeylogger 0x7770d:$salt: 099u787978786 0x75b0a:$string1: HawkEye_Keylogger 0x7695d:$string1: HawkEye_Keylogger 0x7766d:$string1: HawkEye_Keylogger 0x75ef3:$string2: holdermail.txt 0x75f13:$string2: holdermail.txt 0x75e35:$string3: wallet.dat 0x75e4d:$string3: wallet.dat 0x75e63:$string3: wallet.dat 0x7724f:$string4: Keylog Records 0x77567:$string4: Keylog Records 0x77765:$string5: do not script --> 0x754b9:$string6: \pidloc.txt 0x7551f:$string7: BSPLIT 0x7552f:$string7: BSPLIT
5.2.Pluto Panel.exe.f18208.3.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
5.2.Pluto Panel.exe.f18208.3.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.2.Pluto Panel.exe.f18208.3.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.2.Pluto Panel.exe.f18208.3.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.2.Pluto Panel.exe.f18208.3.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b62:$hawkstr1: HawkEye Keylogger 0x769a3:$hawkstr1: HawkEye Keylogger 0x76cd2:$hawkstr1: HawkEye Keylogger 0x76e2d:$hawkstr1: HawkEye Keylogger 0x76f90:$hawkstr1: HawkEye Keylogger 0x77227:$hawkstr1: HawkEye Keylogger 0x756f0:$hawkstr2: Dear HawkEye Customers! 0x76d25:$hawkstr2: Dear HawkEye Customers! 0x76e7c:$hawkstr2: Dear HawkEye Customers! 0x76fe3:$hawkstr2: Dear HawkEye Customers! 0x75811:$hawkstr3: HawkEye Logger Details:
6.2.test.exe.da0000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
6.2.test.exe.da0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99f3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.4.unpack	JoeSecurity_ficker_stealer	Yara detected Ficker Stealer	Joe Security
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.4.unpack	MALWARE_Win_Ficker	Detects Ficker infostealer	ditekSHen	0x36fd5:$s1: JNOde\ 0x37abc:$s2: "SomeNone 0x37b00:$s3: kindmessage 0x37d37:$s5: ..\\?\.\UNC\Windows stdio in console mode does not support writing non-UTF-8 byte sequences 0x37f79:$s7: (os error other os erroroperation interruptedwrite zerotimed 0x3818c:$s9: _matherr(): %s in %s(%g, %g) (retval=%g)
8.2.gay.exe.d0000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
8.2.gay.exe.d0000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
8.2.gay.exe.d0000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
0.2.RIP_YOUR_PC_LOL.exe.9fa0eb.2.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.2.Pluto Panel.exe.f19c0d.2.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
7.2.0fd7de5367376231a788872005d7ed4f.exe.24f15a0.1.raw.unpack	JoeSecurity_ficker_stealer	Yara detected Ficker Stealer	Joe Security
7.2.0fd7de5367376231a788872005d7ed4f.exe.24f15a0.1.raw.unpack	MALWARE_Win_Ficker	Detects Ficker infostealer	ditekSHen	0x36fd5:$s1: JNOde\ 0x37abc:$s2: "SomeNone 0x37b00:$s3: kindmessage 0x37d37:$s5: ..\\?\.\UNC\Windows stdio in console mode does not support writing non-UTF-8 byte sequences 0x37f79:$s7: (os error other os erroroperation interruptedwrite zerotimed 0x3818c:$s9: _matherr(): %s in %s(%g, %g) (retval=%g)
0.2.RIP_YOUR_PC_LOL.exe.1f6c52e.15.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.1f6c52e.15.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x1080e2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
5.2.Pluto Panel.exe.f19c0d.2.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73acc:$key: HawkEyeKeylogger 0x75d08:$salt: 099u787978786 0x74105:$string1: HawkEye_Keylogger 0x74f58:$string1: HawkEye_Keylogger 0x75c68:$string1: HawkEye_Keylogger 0x744ee:$string2: holdermail.txt 0x7450e:$string2: holdermail.txt 0x74430:$string3: wallet.dat 0x74448:$string3: wallet.dat 0x7445e:$string3: wallet.dat 0x7584a:$string4: Keylog Records 0x75b62:$string4: Keylog Records 0x75d60:$string5: do not script --> 0x73ab4:$string6: \pidloc.txt 0x73b1a:$string7: BSPLIT 0x73b2a:$string7: BSPLIT
5.2.Pluto Panel.exe.f19c0d.2.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.2.Pluto Panel.exe.f19c0d.2.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.2.Pluto Panel.exe.f19c0d.2.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.2.Pluto Panel.exe.f19c0d.2.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7415d:$hawkstr1: HawkEye Keylogger 0x74f9e:$hawkstr1: HawkEye Keylogger 0x752cd:$hawkstr1: HawkEye Keylogger 0x75428:$hawkstr1: HawkEye Keylogger 0x7558b:$hawkstr1: HawkEye Keylogger 0x75822:$hawkstr1: HawkEye Keylogger 0x73ceb:$hawkstr2: Dear HawkEye Customers! 0x75320:$hawkstr2: Dear HawkEye Customers! 0x75477:$hawkstr2: Dear HawkEye Customers! 0x755de:$hawkstr2: Dear HawkEye Customers! 0x73e0c:$hawkstr3: HawkEye Logger Details:
4.2.healastounding.exe.4474268.10.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
4.2.healastounding.exe.4474268.10.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
4.2.healastounding.exe.4474268.10.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.2.healastounding.exe.4474268.10.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe0f5:$x1: NanoCore Client 0xe105:$x1: NanoCore Client 0xe34d:$x2: NanoCore.ClientPlugin 0xe38d:$x3: NanoCore.ClientPluginHost 0xe342:$i1: IClientApp 0xe363:$i2: IClientData 0xe36f:$i3: IClientNetwork 0xe37e:$i4: IClientAppHost 0xe3a7:$i5: IClientDataHost 0xe3b7:$i6: IClientLoggingHost 0xe3ca:$i7: IClientNetworkHost 0xe3dd:$i8: IClientUIHost 0xe3eb:$i9: IClientNameObjectCollection 0xe407:$i10: IClientReadOnlyNameObjectCollection 0xe154:$s1: ClientPlugin 0xe356:$s1: ClientPlugin 0xe84a:$s2: EndPoint 0xe853:$s3: IPAddress 0xe85d:$s4: IPEndPoint 0x10293:$s6: get_ClientSettings 0x10837:$s7: get_Connected
4.2.healastounding.exe.4474268.10.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
0.0.RIP_YOUR_PC_LOL.exe.1f6c52e.15.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.1f6c52e.15.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x1080e2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x79ad9:$key: HawkEyeKeylogger 0x7bd15:$salt: 099u787978786 0x7a112:$string1: HawkEye_Keylogger 0x7af65:$string1: HawkEye_Keylogger 0x7bc75:$string1: HawkEye_Keylogger 0x7a4fb:$string2: holdermail.txt 0x7a51b:$string2: holdermail.txt 0x7a43d:$string3: wallet.dat 0x7a455:$string3: wallet.dat 0x7a46b:$string3: wallet.dat 0x7b857:$string4: Keylog Records 0x7bb6f:$string4: Keylog Records 0x7bd6d:$string5: do not script --> 0x79ac1:$string6: \pidloc.txt 0x79b27:$string7: BSPLIT 0x79b37:$string7: BSPLIT
0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x5623:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7a16a:$hawkstr1: HawkEye Keylogger 0x7afab:$hawkstr1: HawkEye Keylogger 0x7b2da:$hawkstr1: HawkEye Keylogger 0x7b435:$hawkstr1: HawkEye Keylogger 0x7b598:$hawkstr1: HawkEye Keylogger 0x7b82f:$hawkstr1: HawkEye Keylogger 0x79cf8:$hawkstr2: Dear HawkEye Customers! 0x7b32d:$hawkstr2: Dear HawkEye Customers! 0x7b484:$hawkstr2: Dear HawkEye Customers! 0x7b5eb:$hawkstr2: Dear HawkEye Customers! 0x79e19:$hawkstr3: HawkEye Logger Details:
0.0.RIP_YOUR_PC_LOL.exe.1d1caed.10.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.1d1caed.10.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x26201:$s1: netsh firewall delete allowedprogram 0x260f7:$s2: netsh firewall add allowedprogram 0x26261:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x25eeb:$s4: Execute ERROR 0x25f4b:$s4: Execute ERROR 0x25f0f:$s5: Download ERROR 0x262a7:$s6: [kl]
0.0.RIP_YOUR_PC_LOL.exe.1d1caed.10.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x260f7:$a1: netsh firewall add allowedprogram 0x262f1:$b1: [TAP] 0x26297:$b2: & exit 0x26263:$c1: md.exe /k ping 0 & del
9.2.Opus.exe.5b00000.7.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
9.2.Opus.exe.5b00000.7.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
9.2.Opus.exe.5b00000.7.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.2.Opus.exe.5b00000.7.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xd978:$x2: NanoCore.ClientPlugin 0xd9ad:$x3: NanoCore.ClientPluginHost 0xd96c:$i2: IClientData 0xd98e:$i3: IClientNetwork 0xd99d:$i5: IClientDataHost 0xd9c7:$i6: IClientLoggingHost 0xd9da:$i7: IClientNetworkHost 0xd9ed:$i8: IClientUIHost 0xd9fb:$i9: IClientNameObjectCollection 0xda17:$i10: IClientReadOnlyNameObjectCollection 0xd76a:$s1: ClientPlugin 0xd981:$s1: ClientPlugin 0x129a2:$s6: get_ClientSettings
5.2.Pluto Panel.exe.3b3a1c4.6.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
4.2.healastounding.exe.3479694.5.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.healastounding.exe.3479694.5.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.2.healastounding.exe.3479694.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99f3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
4.2.healastounding.exe.3479694.5.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x15144:$s1: netsh firewall delete allowedprogram 0x1503a:$s2: netsh firewall add allowedprogram 0x151a4:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x14e2e:$s4: Execute ERROR 0x14e8e:$s4: Execute ERROR 0x14e52:$s5: Download ERROR 0x151ea:$s6: [kl]
4.2.healastounding.exe.3479694.5.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x1503a:$a1: netsh firewall add allowedprogram 0x15234:$b1: [TAP] 0x99e1:$b2: & exit 0x151da:$b2: & exit 0x151a6:$c1: md.exe /k ping 0 & del
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.5.unpack	JoeSecurity_ficker_stealer	Yara detected Ficker Stealer	Joe Security
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.5.unpack	MALWARE_Win_Ficker	Detects Ficker infostealer	ditekSHen	0x36fd5:$s1: JNOde\ 0x37abc:$s2: "SomeNone 0x37b00:$s3: kindmessage 0x37d37:$s5: ..\\?\.\UNC\Windows stdio in console mode does not support writing non-UTF-8 byte sequences 0x37f79:$s7: (os error other os erroroperation interruptedwrite zerotimed 0x3818c:$s9: _matherr(): %s in %s(%g, %g) (retval=%g)
5.2.Pluto Panel.exe.7700000.9.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
4.0.healastounding.exe.902324.11.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
4.0.healastounding.exe.902324.11.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
4.0.healastounding.exe.902324.11.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.0.healastounding.exe.902324.11.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe0f5:$x1: NanoCore Client 0xe105:$x1: NanoCore Client 0xe34d:$x2: NanoCore.ClientPlugin 0xe38d:$x3: NanoCore.ClientPluginHost 0xe342:$i1: IClientApp 0xe363:$i2: IClientData 0xe36f:$i3: IClientNetwork 0xe37e:$i4: IClientAppHost 0xe3a7:$i5: IClientDataHost 0xe3b7:$i6: IClientLoggingHost 0xe3ca:$i7: IClientNetworkHost 0xe3dd:$i8: IClientUIHost 0xe3eb:$i9: IClientNameObjectCollection 0xe407:$i10: IClientReadOnlyNameObjectCollection 0xe154:$s1: ClientPlugin 0xe356:$s1: ClientPlugin 0xe84a:$s2: EndPoint 0xe853:$s3: IPAddress 0xe85d:$s4: IPEndPoint 0x10293:$s6: get_ClientSettings 0x10837:$s7: get_Connected
4.0.healastounding.exe.902324.11.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
11.0.22.exe.5f65b6.23.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x4e6a:$s1: blackmoon 0x4eaa:$s2: BlackMoon RunTime Error:
11.0.22.exe.530edf.22.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xca541:$s1: blackmoon 0xca581:$s2: BlackMoon RunTime Error:
11.0.22.exe.400000.0.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x12866f:$s1: blackmoon 0x1fb420:$s1: blackmoon 0x1286af:$s2: BlackMoon RunTime Error: 0x1fb460:$s2: BlackMoon RunTime Error:
11.0.22.exe.400000.12.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x12866f:$s1: blackmoon 0x1fb420:$s1: blackmoon 0x1286af:$s2: BlackMoon RunTime Error: 0x1fb460:$s2: BlackMoon RunTime Error:
5.0.Pluto Panel.exe.f18208.5.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x754d1:$key: HawkEyeKeylogger 0x7770d:$salt: 099u787978786 0x75b0a:$string1: HawkEye_Keylogger 0x7695d:$string1: HawkEye_Keylogger 0x7766d:$string1: HawkEye_Keylogger 0x75ef3:$string2: holdermail.txt 0x75f13:$string2: holdermail.txt 0x75e35:$string3: wallet.dat 0x75e4d:$string3: wallet.dat 0x75e63:$string3: wallet.dat 0x7724f:$string4: Keylog Records 0x77567:$string4: Keylog Records 0x77765:$string5: do not script --> 0x754b9:$string6: \pidloc.txt 0x7551f:$string7: BSPLIT 0x7552f:$string7: BSPLIT
5.0.Pluto Panel.exe.f18208.5.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
5.0.Pluto Panel.exe.f18208.5.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.0.Pluto Panel.exe.f18208.5.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.0.Pluto Panel.exe.f18208.5.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.0.Pluto Panel.exe.f18208.5.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b62:$hawkstr1: HawkEye Keylogger 0x769a3:$hawkstr1: HawkEye Keylogger 0x76cd2:$hawkstr1: HawkEye Keylogger 0x76e2d:$hawkstr1: HawkEye Keylogger 0x76f90:$hawkstr1: HawkEye Keylogger 0x77227:$hawkstr1: HawkEye Keylogger 0x756f0:$hawkstr2: Dear HawkEye Customers! 0x76d25:$hawkstr2: Dear HawkEye Customers! 0x76e7c:$hawkstr2: Dear HawkEye Customers! 0x76fe3:$hawkstr2: Dear HawkEye Customers! 0x75811:$hawkstr3: HawkEye Logger Details:
4.2.healastounding.exe.95312e.2.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.healastounding.exe.95312e.2.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.2.healastounding.exe.95312e.2.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
4.2.healastounding.exe.95312e.2.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x339b0c:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.8.unpack	JoeSecurity_ficker_stealer	Yara detected Ficker Stealer	Joe Security
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.8.unpack	MALWARE_Win_Ficker	Detects Ficker infostealer	ditekSHen	0x36fd5:$s1: JNOde\ 0x37abc:$s2: "SomeNone 0x37b00:$s3: kindmessage 0x37d37:$s5: ..\\?\.\UNC\Windows stdio in console mode does not support writing non-UTF-8 byte sequences 0x37f79:$s7: (os error other os erroroperation interruptedwrite zerotimed 0x3818c:$s9: _matherr(): %s in %s(%g, %g) (retval=%g)
6.0.test.exe.da0000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
6.0.test.exe.da0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99f3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
17.0.mediaget.exe.ab0000.3.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
17.0.mediaget.exe.ab0000.3.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
17.0.mediaget.exe.ab0000.3.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x106b1:$x1: NanoCore.ClientPluginHost 0x106ee:$x2: IClientNetworkHost 0x14221:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x5952a:$s1: netsh firewall delete allowedprogram 0x59420:$s2: netsh firewall add allowedprogram 0x5958a:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x59214:$s4: Execute ERROR 0x59274:$s4: Execute ERROR 0x59238:$s5: Download ERROR 0x595d0:$s6: [kl]
0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x10419:$x1: NanoCore Client 0x10429:$x1: NanoCore Client 0x10671:$x2: NanoCore.ClientPlugin 0x106b1:$x3: NanoCore.ClientPluginHost 0x10666:$i1: IClientApp 0x10687:$i2: IClientData 0x10693:$i3: IClientNetwork 0x106a2:$i4: IClientAppHost 0x106cb:$i5: IClientDataHost 0x106db:$i6: IClientLoggingHost 0x106ee:$i7: IClientNetworkHost 0x10701:$i8: IClientUIHost 0x1070f:$i9: IClientNameObjectCollection 0x1072b:$i10: IClientReadOnlyNameObjectCollection 0x10478:$s1: ClientPlugin 0x1067a:$s1: ClientPlugin 0x10b6e:$s2: EndPoint 0x57a2c:$s2: EndPoint 0x10b77:$s3: IPAddress 0x579f6:$s3: IPAddress 0x10b81:$s4: IPEndPoint
0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10419:$a: NanoCore 0x10429:$a: NanoCore 0x1065d:$a: NanoCore 0x10671:$a: NanoCore 0x106b1:$a: NanoCore 0x10478:$b: ClientPlugin 0x1067a:$b: ClientPlugin 0x106ba:$b: ClientPlugin 0x1059f:$c: ProjectData 0x57601:$c: ProjectData 0x10fa6:$d: DESCrypto 0x18972:$e: KeepAlive 0x16960:$g: LogClientMessage 0x12b5b:$i: get_Connected 0x112dc:$j: #=q 0x1130c:$j: #=q 0x11328:$j: #=q 0x11358:$j: #=q 0x11374:$j: #=q 0x11390:$j: #=q 0x113c0:$j: #=q
0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x59420:$a1: netsh firewall add allowedprogram 0x5961a:$b1: [TAP] 0x595c0:$b2: & exit 0x5958c:$c1: md.exe /k ping 0 & del
4.0.healastounding.exe.95312e.10.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.0.healastounding.exe.95312e.10.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x63fc:$s1: netsh firewall delete allowedprogram 0x62f2:$s2: netsh firewall add allowedprogram 0x645c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x60e6:$s4: Execute ERROR 0x6146:$s4: Execute ERROR 0x610a:$s5: Download ERROR 0x64a2:$s6: [kl]
4.0.healastounding.exe.95312e.10.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x62f2:$a1: netsh firewall add allowedprogram 0x64ec:$b1: [TAP] 0x6492:$b2: & exit 0x645e:$c1: md.exe /k ping 0 & del
9.2.Opus.exe.2ea1844.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
9.2.Opus.exe.2ea1844.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
9.2.Opus.exe.2ea1844.1.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
4.0.healastounding.exe.95312e.10.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.0.healastounding.exe.95312e.10.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.0.healastounding.exe.95312e.10.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
4.0.healastounding.exe.95312e.10.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x339b0c:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
17.0.mediaget.exe.ab0000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
17.0.mediaget.exe.ab0000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
17.0.mediaget.exe.ab0000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
0.0.RIP_YOUR_PC_LOL.exe.1fdd5e1.14.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.1fdd5e1.14.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x9702f:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.17.unpack	JoeSecurity_ficker_stealer	Yara detected Ficker Stealer	Joe Security
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.17.unpack	MALWARE_Win_Ficker	Detects Ficker infostealer	ditekSHen	0x36fd5:$s1: JNOde\ 0x37abc:$s2: "SomeNone 0x37b00:$s3: kindmessage 0x37d37:$s5: ..\\?\.\UNC\Windows stdio in console mode does not support writing non-UTF-8 byte sequences 0x37f79:$s7: (os error other os erroroperation interruptedwrite zerotimed 0x3818c:$s9: _matherr(): %s in %s(%g, %g) (retval=%g)
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.6.unpack	JoeSecurity_ficker_stealer	Yara detected Ficker Stealer	Joe Security
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.6.unpack	MALWARE_Win_Ficker	Detects Ficker infostealer	ditekSHen	0x36fd5:$s1: JNOde\ 0x37abc:$s2: "SomeNone 0x37b00:$s3: kindmessage 0x37d37:$s5: ..\\?\.\UNC\Windows stdio in console mode does not support writing non-UTF-8 byte sequences 0x37f79:$s7: (os error other os erroroperation interruptedwrite zerotimed 0x3818c:$s9: _matherr(): %s in %s(%g, %g) (retval=%g)
0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8d9:$key: HawkEyeKeylogger 0x7db15:$salt: 099u787978786 0x7bf12:$string1: HawkEye_Keylogger 0x7cd65:$string1: HawkEye_Keylogger 0x7da75:$string1: HawkEye_Keylogger 0x7c2fb:$string2: holdermail.txt 0x7c31b:$string2: holdermail.txt 0x7c23d:$string3: wallet.dat 0x7c255:$string3: wallet.dat 0x7c26b:$string3: wallet.dat 0x7d657:$string4: Keylog Records 0x7d96f:$string4: Keylog Records 0x7db6d:$string5: do not script --> 0x7b8c1:$string6: \pidloc.txt 0x7b927:$string7: BSPLIT 0x7b937:$string7: BSPLIT
0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf6a:$hawkstr1: HawkEye Keylogger 0x7cdab:$hawkstr1: HawkEye Keylogger 0x7d0da:$hawkstr1: HawkEye Keylogger 0x7d235:$hawkstr1: HawkEye Keylogger 0x7d398:$hawkstr1: HawkEye Keylogger 0x7d62f:$hawkstr1: HawkEye Keylogger 0x7baf8:$hawkstr2: Dear HawkEye Customers! 0x7d12d:$hawkstr2: Dear HawkEye Customers! 0x7d284:$hawkstr2: Dear HawkEye Customers! 0x7d3eb:$hawkstr2: Dear HawkEye Customers! 0x7bc19:$hawkstr3: HawkEye Logger Details:
0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x59006:$s1: netsh firewall delete allowedprogram 0x58efc:$s2: netsh firewall add allowedprogram 0x59066:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x58cf0:$s4: Execute ERROR 0x58d50:$s4: Execute ERROR 0x58d14:$s5: Download ERROR 0x590ac:$s6: [kl]
0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x57508:$s2: EndPoint 0x10653:$s3: IPAddress 0x574d2:$s3: IPAddress 0x1065d:$s4: IPEndPoint
0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x570dd:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q
0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x58efc:$a1: netsh firewall add allowedprogram 0x590f6:$b1: [TAP] 0x5909c:$b2: & exit 0x59068:$c1: md.exe /k ping 0 & del
11.0.22.exe.5f65b6.10.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x4e6a:$s1: blackmoon 0x4eaa:$s2: BlackMoon RunTime Error:
0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8d9:$key: HawkEyeKeylogger 0x7db15:$salt: 099u787978786 0x7bf12:$string1: HawkEye_Keylogger 0x7cd65:$string1: HawkEye_Keylogger 0x7da75:$string1: HawkEye_Keylogger 0x7c2fb:$string2: holdermail.txt 0x7c31b:$string2: holdermail.txt 0x7c23d:$string3: wallet.dat 0x7c255:$string3: wallet.dat 0x7c26b:$string3: wallet.dat 0x7d657:$string4: Keylog Records 0x7d96f:$string4: Keylog Records 0x7db6d:$string5: do not script --> 0x7b8c1:$string6: \pidloc.txt 0x7b927:$string7: BSPLIT 0x7b937:$string7: BSPLIT
0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf6a:$hawkstr1: HawkEye Keylogger 0x7cdab:$hawkstr1: HawkEye Keylogger 0x7d0da:$hawkstr1: HawkEye Keylogger 0x7d235:$hawkstr1: HawkEye Keylogger 0x7d398:$hawkstr1: HawkEye Keylogger 0x7d62f:$hawkstr1: HawkEye Keylogger 0x7baf8:$hawkstr2: Dear HawkEye Customers! 0x7d12d:$hawkstr2: Dear HawkEye Customers! 0x7d284:$hawkstr2: Dear HawkEye Customers! 0x7d3eb:$hawkstr2: Dear HawkEye Customers! 0x7bc19:$hawkstr3: HawkEye Logger Details:
4.0.healastounding.exe.900000.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x106b1:$x1: NanoCore.ClientPluginHost 0x106ee:$x2: IClientNetworkHost 0x14221:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
4.0.healastounding.exe.900000.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.0.healastounding.exe.900000.4.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.0.healastounding.exe.900000.4.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.0.healastounding.exe.900000.4.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x5952a:$s1: netsh firewall delete allowedprogram 0x59420:$s2: netsh firewall add allowedprogram 0x5958a:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x59214:$s4: Execute ERROR 0x59274:$s4: Execute ERROR 0x59238:$s5: Download ERROR 0x595d0:$s6: [kl]
4.0.healastounding.exe.900000.4.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x10419:$x1: NanoCore Client 0x10429:$x1: NanoCore Client 0x10671:$x2: NanoCore.ClientPlugin 0x106b1:$x3: NanoCore.ClientPluginHost 0x10666:$i1: IClientApp 0x10687:$i2: IClientData 0x10693:$i3: IClientNetwork 0x106a2:$i4: IClientAppHost 0x106cb:$i5: IClientDataHost 0x106db:$i6: IClientLoggingHost 0x106ee:$i7: IClientNetworkHost 0x10701:$i8: IClientUIHost 0x1070f:$i9: IClientNameObjectCollection 0x1072b:$i10: IClientReadOnlyNameObjectCollection 0x10478:$s1: ClientPlugin 0x1067a:$s1: ClientPlugin 0x10b6e:$s2: EndPoint 0x57a2c:$s2: EndPoint 0x10b77:$s3: IPAddress 0x579f6:$s3: IPAddress 0x3886ca:$s3: IPAddress
4.0.healastounding.exe.900000.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10419:$a: NanoCore 0x10429:$a: NanoCore 0x1065d:$a: NanoCore 0x10671:$a: NanoCore 0x106b1:$a: NanoCore 0x10478:$b: ClientPlugin 0x1067a:$b: ClientPlugin 0x106ba:$b: ClientPlugin 0x1059f:$c: ProjectData 0x57601:$c: ProjectData 0x10fa6:$d: DESCrypto 0x18972:$e: KeepAlive 0x38722e:$e: KeepAlive 0x387948:$e: KeepAlive 0x387956:$e: KeepAlive 0x3887ff:$e: KeepAlive 0x16960:$g: LogClientMessage 0x12b5b:$i: get_Connected 0x3871b1:$i: get_Connected 0x112dc:$j: #=q 0x1130c:$j: #=q
4.0.healastounding.exe.900000.4.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x59420:$a1: netsh firewall add allowedprogram 0x5961a:$b1: [TAP] 0x595c0:$b2: & exit 0x38ae3a:$b2: & exit 0x5958c:$c1: md.exe /k ping 0 & del
4.2.healastounding.exe.4474268.10.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
4.2.healastounding.exe.4474268.10.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.2.healastounding.exe.4474268.10.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
4.2.healastounding.exe.4474268.10.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.3.RIP_YOUR_PC_LOL.exe.5a556c1.5.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.3.RIP_YOUR_PC_LOL.exe.5a556c1.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99f3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
9.0.Opus.exe.840000.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.0.Opus.exe.840000.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
9.0.Opus.exe.840000.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.0.Opus.exe.840000.3.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
9.0.Opus.exe.840000.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
5.0.Pluto Panel.exe.f19c0d.15.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73acc:$key: HawkEyeKeylogger 0x75d08:$salt: 099u787978786 0x74105:$string1: HawkEye_Keylogger 0x74f58:$string1: HawkEye_Keylogger 0x75c68:$string1: HawkEye_Keylogger 0x744ee:$string2: holdermail.txt 0x7450e:$string2: holdermail.txt 0x74430:$string3: wallet.dat 0x74448:$string3: wallet.dat 0x7445e:$string3: wallet.dat 0x7584a:$string4: Keylog Records 0x75b62:$string4: Keylog Records 0x75d60:$string5: do not script --> 0x73ab4:$string6: \pidloc.txt 0x73b1a:$string7: BSPLIT 0x73b2a:$string7: BSPLIT
5.0.Pluto Panel.exe.f19c0d.15.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.0.Pluto Panel.exe.f19c0d.15.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.0.Pluto Panel.exe.f19c0d.15.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.0.Pluto Panel.exe.f19c0d.15.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7415d:$hawkstr1: HawkEye Keylogger 0x74f9e:$hawkstr1: HawkEye Keylogger 0x752cd:$hawkstr1: HawkEye Keylogger 0x75428:$hawkstr1: HawkEye Keylogger 0x7558b:$hawkstr1: HawkEye Keylogger 0x75822:$hawkstr1: HawkEye Keylogger 0x73ceb:$hawkstr2: Dear HawkEye Customers! 0x75320:$hawkstr2: Dear HawkEye Customers! 0x75477:$hawkstr2: Dear HawkEye Customers! 0x755de:$hawkstr2: Dear HawkEye Customers! 0x73e0c:$hawkstr3: HawkEye Logger Details:
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.15.unpack	JoeSecurity_ficker_stealer	Yara detected Ficker Stealer	Joe Security
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.15.unpack	MALWARE_Win_Ficker	Detects Ficker infostealer	ditekSHen	0x36fd5:$s1: JNOde\ 0x37abc:$s2: "SomeNone 0x37b00:$s3: kindmessage 0x37d37:$s5: ..\\?\.\UNC\Windows stdio in console mode does not support writing non-UTF-8 byte sequences 0x37f79:$s7: (os error other os erroroperation interruptedwrite zerotimed 0x3818c:$s9: _matherr(): %s in %s(%g, %g) (retval=%g)
0.3.RIP_YOUR_PC_LOL.exe.596a627.9.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xca541:$s1: blackmoon 0xca581:$s2: BlackMoon RunTime Error:
11.0.22.exe.43de6f.19.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xea800:$s1: blackmoon 0xea840:$s2: BlackMoon RunTime Error:
11.0.22.exe.530edf.16.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xca541:$s1: blackmoon 0xca581:$s2: BlackMoon RunTime Error:
4.2.healastounding.exe.95312e.2.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.2.healastounding.exe.95312e.2.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x63fc:$s1: netsh firewall delete allowedprogram 0x62f2:$s2: netsh firewall add allowedprogram 0x645c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x60e6:$s4: Execute ERROR 0x6146:$s4: Execute ERROR 0x610a:$s5: Download ERROR 0x64a2:$s6: [kl]
4.2.healastounding.exe.95312e.2.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x62f2:$a1: netsh firewall add allowedprogram 0x64ec:$b1: [TAP] 0x6492:$b2: & exit 0x645e:$c1: md.exe /k ping 0 & del
11.0.22.exe.43de6f.2.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xea800:$s1: blackmoon 0xea840:$s2: BlackMoon RunTime Error:
5.2.Pluto Panel.exe.46b1030.7.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
4.2.healastounding.exe.3474284.6.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.healastounding.exe.3474284.6.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.2.healastounding.exe.3474284.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xee03:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
4.2.healastounding.exe.3474284.6.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x1a554:$s1: netsh firewall delete allowedprogram 0x1a44a:$s2: netsh firewall add allowedprogram 0x1a5b4:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x1a23e:$s4: Execute ERROR 0x1a29e:$s4: Execute ERROR 0x1a262:$s5: Download ERROR 0x1a5fa:$s6: [kl]
4.2.healastounding.exe.3474284.6.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x1a44a:$a1: netsh firewall add allowedprogram 0x1a644:$b1: [TAP] 0xedf1:$b2: & exit 0x1a5ea:$b2: & exit 0x1a5b6:$c1: md.exe /k ping 0 & del
4.0.healastounding.exe.902324.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
4.0.healastounding.exe.902324.14.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
4.0.healastounding.exe.902324.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.0.healastounding.exe.902324.6.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.0.healastounding.exe.902324.6.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.0.healastounding.exe.902324.6.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x59006:$s1: netsh firewall delete allowedprogram 0x58efc:$s2: netsh firewall add allowedprogram 0x59066:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x58cf0:$s4: Execute ERROR 0x58d50:$s4: Execute ERROR 0x58d14:$s5: Download ERROR 0x590ac:$s6: [kl]
4.0.healastounding.exe.902324.6.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x57508:$s2: EndPoint 0x10653:$s3: IPAddress 0x574d2:$s3: IPAddress 0x3881a6:$s3: IPAddress
4.0.healastounding.exe.902324.6.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x570dd:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x386d0a:$e: KeepAlive 0x387424:$e: KeepAlive 0x387432:$e: KeepAlive 0x3882db:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x386c8d:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q
4.0.healastounding.exe.902324.6.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x58efc:$a1: netsh firewall add allowedprogram 0x590f6:$b1: [TAP] 0x5909c:$b2: & exit 0x38a916:$b2: & exit 0x59068:$c1: md.exe /k ping 0 & del
4.0.healastounding.exe.902324.14.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.0.healastounding.exe.902324.14.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.0.healastounding.exe.902324.14.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.0.healastounding.exe.902324.14.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x59006:$s1: netsh firewall delete allowedprogram 0x58efc:$s2: netsh firewall add allowedprogram 0x59066:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x58cf0:$s4: Execute ERROR 0x58d50:$s4: Execute ERROR 0x58d14:$s5: Download ERROR 0x590ac:$s6: [kl]
4.0.healastounding.exe.902324.14.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x57508:$s2: EndPoint 0x10653:$s3: IPAddress 0x574d2:$s3: IPAddress 0x3881a6:$s3: IPAddress
4.0.healastounding.exe.902324.14.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x570dd:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x386d0a:$e: KeepAlive 0x387424:$e: KeepAlive 0x387432:$e: KeepAlive 0x3882db:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x386c8d:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q
4.0.healastounding.exe.902324.14.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x58efc:$a1: netsh firewall add allowedprogram 0x590f6:$b1: [TAP] 0x5909c:$b2: & exit 0x38a916:$b2: & exit 0x59068:$c1: md.exe /k ping 0 & del
17.2.mediaget.exe.ab0000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
17.2.mediaget.exe.ab0000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
17.2.mediaget.exe.ab0000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
11.0.22.exe.400000.6.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x12866f:$s1: blackmoon 0x1fb420:$s1: blackmoon 0x1286af:$s2: BlackMoon RunTime Error: 0x1fb460:$s2: BlackMoon RunTime Error:
0.0.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73acc:$key: HawkEyeKeylogger 0x75d08:$salt: 099u787978786 0x74105:$string1: HawkEye_Keylogger 0x74f58:$string1: HawkEye_Keylogger 0x75c68:$string1: HawkEye_Keylogger 0x744ee:$string2: holdermail.txt 0x7450e:$string2: holdermail.txt 0x74430:$string3: wallet.dat 0x74448:$string3: wallet.dat 0x7445e:$string3: wallet.dat 0x7584a:$string4: Keylog Records 0x75b62:$string4: Keylog Records 0x75d60:$string5: do not script --> 0x73ab4:$string6: \pidloc.txt 0x73b1a:$string7: BSPLIT 0x73b2a:$string7: BSPLIT
0.0.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7415d:$hawkstr1: HawkEye Keylogger 0x74f9e:$hawkstr1: HawkEye Keylogger 0x752cd:$hawkstr1: HawkEye Keylogger 0x75428:$hawkstr1: HawkEye Keylogger 0x7558b:$hawkstr1: HawkEye Keylogger 0x75822:$hawkstr1: HawkEye Keylogger 0x73ceb:$hawkstr2: Dear HawkEye Customers! 0x75320:$hawkstr2: Dear HawkEye Customers! 0x75477:$hawkstr2: Dear HawkEye Customers! 0x755de:$hawkstr2: Dear HawkEye Customers! 0x73e0c:$hawkstr3: HawkEye Logger Details:
5.0.Pluto Panel.exe.f19c0d.3.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
9.2.Opus.exe.3edeacc.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x28789:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287b6:$x2: IClientNetworkHost
9.2.Opus.exe.3edeacc.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x28789:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x29864:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287a3:$s5: IClientLoggingHost
9.2.Opus.exe.3edeacc.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.2.Opus.exe.3edeacc.3.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xf778:$x2: NanoCore.ClientPlugin 0x28754:$x2: NanoCore.ClientPlugin 0xf7ad:$x3: NanoCore.ClientPluginHost 0x28789:$x3: NanoCore.ClientPluginHost 0xf76c:$i2: IClientData 0x28748:$i2: IClientData 0xf78e:$i3: IClientNetwork 0x2876a:$i3: IClientNetwork 0xf79d:$i5: IClientDataHost 0x28779:$i5: IClientDataHost 0xf7c7:$i6: IClientLoggingHost 0x287a3:$i6: IClientLoggingHost 0xf7da:$i7: IClientNetworkHost 0x287b6:$i7: IClientNetworkHost 0xf7ed:$i8: IClientUIHost 0x287c9:$i8: IClientUIHost 0xf7fb:$i9: IClientNameObjectCollection 0x287d7:$i9: IClientNameObjectCollection 0xf817:$i10: IClientReadOnlyNameObjectCollection 0x287f3:$i10: IClientReadOnlyNameObjectCollection 0xf56a:$s1: ClientPlugin
0.2.RIP_YOUR_PC_LOL.exe.c8867b.4.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xca541:$s1: blackmoon 0xca581:$s2: BlackMoon RunTime Error:
4.0.healastounding.exe.935129.15.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.0.healastounding.exe.935129.15.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.0.healastounding.exe.935129.15.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x26201:$s1: netsh firewall delete allowedprogram 0x260f7:$s2: netsh firewall add allowedprogram 0x26261:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x25eeb:$s4: Execute ERROR 0x25f4b:$s4: Execute ERROR 0x25f0f:$s5: Download ERROR 0x262a7:$s6: [kl]
4.0.healastounding.exe.935129.15.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x260f7:$a1: netsh firewall add allowedprogram 0x262f1:$b1: [TAP] 0x26297:$b2: & exit 0x357b11:$b2: & exit 0x26263:$c1: md.exe /k ping 0 & del
0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x79ad9:$key: HawkEyeKeylogger 0x7bd15:$salt: 099u787978786 0x7a112:$string1: HawkEye_Keylogger 0x7af65:$string1: HawkEye_Keylogger 0x7bc75:$string1: HawkEye_Keylogger 0x7a4fb:$string2: holdermail.txt 0x7a51b:$string2: holdermail.txt 0x7a43d:$string3: wallet.dat 0x7a455:$string3: wallet.dat 0x7a46b:$string3: wallet.dat 0x7b857:$string4: Keylog Records 0x7bb6f:$string4: Keylog Records 0x7bd6d:$string5: do not script --> 0x79ac1:$string6: \pidloc.txt 0x79b27:$string7: BSPLIT 0x79b37:$string7: BSPLIT
0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x5623:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7a16a:$hawkstr1: HawkEye Keylogger 0x7afab:$hawkstr1: HawkEye Keylogger 0x7b2da:$hawkstr1: HawkEye Keylogger 0x7b435:$hawkstr1: HawkEye Keylogger 0x7b598:$hawkstr1: HawkEye Keylogger 0x7b82f:$hawkstr1: HawkEye Keylogger 0x79cf8:$hawkstr2: Dear HawkEye Customers! 0x7b32d:$hawkstr2: Dear HawkEye Customers! 0x7b484:$hawkstr2: Dear HawkEye Customers! 0x7b5eb:$hawkstr2: Dear HawkEye Customers! 0x79e19:$hawkstr3: HawkEye Logger Details:
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.9.unpack	JoeSecurity_ficker_stealer	Yara detected Ficker Stealer	Joe Security
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.9.unpack	MALWARE_Win_Ficker	Detects Ficker infostealer	ditekSHen	0x36fd5:$s1: JNOde\ 0x37abc:$s2: "SomeNone 0x37b00:$s3: kindmessage 0x37d37:$s5: ..\\?\.\UNC\Windows stdio in console mode does not support writing non-UTF-8 byte sequences 0x37f79:$s7: (os error other os erroroperation interruptedwrite zerotimed 0x3818c:$s9: _matherr(): %s in %s(%g, %g) (retval=%g)
11.0.22.exe.43de6f.13.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xea800:$s1: blackmoon 0xea840:$s2: BlackMoon RunTime Error:
4.0.healastounding.exe.902324.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
4.0.healastounding.exe.902324.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
4.0.healastounding.exe.902324.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.0.healastounding.exe.902324.3.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe0f5:$x1: NanoCore Client 0xe105:$x1: NanoCore Client 0xe34d:$x2: NanoCore.ClientPlugin 0xe38d:$x3: NanoCore.ClientPluginHost 0xe342:$i1: IClientApp 0xe363:$i2: IClientData 0xe36f:$i3: IClientNetwork 0xe37e:$i4: IClientAppHost 0xe3a7:$i5: IClientDataHost 0xe3b7:$i6: IClientLoggingHost 0xe3ca:$i7: IClientNetworkHost 0xe3dd:$i8: IClientUIHost 0xe3eb:$i9: IClientNameObjectCollection 0xe407:$i10: IClientReadOnlyNameObjectCollection 0xe154:$s1: ClientPlugin 0xe356:$s1: ClientPlugin 0xe84a:$s2: EndPoint 0xe853:$s3: IPAddress 0xe85d:$s4: IPEndPoint 0x10293:$s6: get_ClientSettings 0x10837:$s7: get_Connected
4.0.healastounding.exe.902324.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
8.0.gay.exe.d0000.1.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
8.0.gay.exe.d0000.1.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
8.0.gay.exe.d0000.1.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
8.0.gay.exe.d0000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
8.0.gay.exe.d0000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
8.0.gay.exe.d0000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
9.0.Opus.exe.840000.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.0.Opus.exe.840000.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
9.0.Opus.exe.840000.1.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.0.Opus.exe.840000.1.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
9.0.Opus.exe.840000.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
11.0.22.exe.530edf.11.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xca541:$s1: blackmoon 0xca581:$s2: BlackMoon RunTime Error:
5.0.Pluto Panel.exe.f19c0d.11.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73acc:$key: HawkEyeKeylogger 0x75d08:$salt: 099u787978786 0x74105:$string1: HawkEye_Keylogger 0x74f58:$string1: HawkEye_Keylogger 0x75c68:$string1: HawkEye_Keylogger 0x744ee:$string2: holdermail.txt 0x7450e:$string2: holdermail.txt 0x74430:$string3: wallet.dat 0x74448:$string3: wallet.dat 0x7445e:$string3: wallet.dat 0x7584a:$string4: Keylog Records 0x75b62:$string4: Keylog Records 0x75d60:$string5: do not script --> 0x73ab4:$string6: \pidloc.txt 0x73b1a:$string7: BSPLIT 0x73b2a:$string7: BSPLIT
5.0.Pluto Panel.exe.f19c0d.11.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.0.Pluto Panel.exe.f19c0d.11.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.0.Pluto Panel.exe.f19c0d.11.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.0.Pluto Panel.exe.f19c0d.11.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7415d:$hawkstr1: HawkEye Keylogger 0x74f9e:$hawkstr1: HawkEye Keylogger 0x752cd:$hawkstr1: HawkEye Keylogger 0x75428:$hawkstr1: HawkEye Keylogger 0x7558b:$hawkstr1: HawkEye Keylogger 0x75822:$hawkstr1: HawkEye Keylogger 0x73ceb:$hawkstr2: Dear HawkEye Customers! 0x75320:$hawkstr2: Dear HawkEye Customers! 0x75477:$hawkstr2: Dear HawkEye Customers! 0x755de:$hawkstr2: Dear HawkEye Customers! 0x73e0c:$hawkstr3: HawkEye Logger Details:
5.0.Pluto Panel.exe.f6fa72.9.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
4.2.healastounding.exe.935129.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.healastounding.exe.935129.1.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.2.healastounding.exe.935129.1.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x26201:$s1: netsh firewall delete allowedprogram 0x260f7:$s2: netsh firewall add allowedprogram 0x26261:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x25eeb:$s4: Execute ERROR 0x25f4b:$s4: Execute ERROR 0x25f0f:$s5: Download ERROR 0x262a7:$s6: [kl]
4.2.healastounding.exe.935129.1.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x260f7:$a1: netsh firewall add allowedprogram 0x262f1:$b1: [TAP] 0x26297:$b2: & exit 0x357b11:$b2: & exit 0x26263:$c1: md.exe /k ping 0 & del
4.2.healastounding.exe.34865dc.7.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.2.healastounding.exe.34865dc.7.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
4.2.healastounding.exe.34865dc.7.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
9.2.Opus.exe.5870000.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
9.2.Opus.exe.5870000.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
9.2.Opus.exe.5870000.5.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
4.2.healastounding.exe.900000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x106b1:$x1: NanoCore.ClientPluginHost 0x106ee:$x2: IClientNetworkHost 0x14221:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
4.2.healastounding.exe.900000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.2.healastounding.exe.900000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.healastounding.exe.900000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.2.healastounding.exe.900000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x5952a:$s1: netsh firewall delete allowedprogram 0x59420:$s2: netsh firewall add allowedprogram 0x5958a:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x59214:$s4: Execute ERROR 0x59274:$s4: Execute ERROR 0x59238:$s5: Download ERROR 0x595d0:$s6: [kl]
4.2.healastounding.exe.900000.0.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x10419:$x1: NanoCore Client 0x10429:$x1: NanoCore Client 0x10671:$x2: NanoCore.ClientPlugin 0x106b1:$x3: NanoCore.ClientPluginHost 0x10666:$i1: IClientApp 0x10687:$i2: IClientData 0x10693:$i3: IClientNetwork 0x106a2:$i4: IClientAppHost 0x106cb:$i5: IClientDataHost 0x106db:$i6: IClientLoggingHost 0x106ee:$i7: IClientNetworkHost 0x10701:$i8: IClientUIHost 0x1070f:$i9: IClientNameObjectCollection 0x1072b:$i10: IClientReadOnlyNameObjectCollection 0x10478:$s1: ClientPlugin 0x1067a:$s1: ClientPlugin 0x10b6e:$s2: EndPoint 0x57a2c:$s2: EndPoint 0x10b77:$s3: IPAddress 0x579f6:$s3: IPAddress 0x3886ca:$s3: IPAddress
4.2.healastounding.exe.900000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10419:$a: NanoCore 0x10429:$a: NanoCore 0x1065d:$a: NanoCore 0x10671:$a: NanoCore 0x106b1:$a: NanoCore 0x10478:$b: ClientPlugin 0x1067a:$b: ClientPlugin 0x106ba:$b: ClientPlugin 0x1059f:$c: ProjectData 0x57601:$c: ProjectData 0x10fa6:$d: DESCrypto 0x18972:$e: KeepAlive 0x38722e:$e: KeepAlive 0x387948:$e: KeepAlive 0x387956:$e: KeepAlive 0x3887ff:$e: KeepAlive 0x16960:$g: LogClientMessage 0x12b5b:$i: get_Connected 0x3871b1:$i: get_Connected 0x112dc:$j: #=q 0x1130c:$j: #=q
4.2.healastounding.exe.900000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x59420:$a1: netsh firewall add allowedprogram 0x5961a:$b1: [TAP] 0x595c0:$b2: & exit 0x38ae3a:$b2: & exit 0x5958c:$c1: md.exe /k ping 0 & del
5.0.Pluto Panel.exe.f6fa72.13.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x1dc67:$key: HawkEyeKeylogger 0x1fea3:$salt: 099u787978786 0x1e2a0:$string1: HawkEye_Keylogger 0x1f0f3:$string1: HawkEye_Keylogger 0x1fe03:$string1: HawkEye_Keylogger 0x1e689:$string2: holdermail.txt 0x1e6a9:$string2: holdermail.txt 0x1e5cb:$string3: wallet.dat 0x1e5e3:$string3: wallet.dat 0x1e5f9:$string3: wallet.dat 0x1f9e5:$string4: Keylog Records 0x1fcfd:$string4: Keylog Records 0x1fefb:$string5: do not script --> 0x1dc4f:$string6: \pidloc.txt 0x1dcb5:$string7: BSPLIT 0x1dcc5:$string7: BSPLIT
5.0.Pluto Panel.exe.f6fa72.13.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.0.Pluto Panel.exe.f6fa72.13.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.0.Pluto Panel.exe.f6fa72.13.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x1e2f8:$hawkstr1: HawkEye Keylogger 0x1f139:$hawkstr1: HawkEye Keylogger 0x1f468:$hawkstr1: HawkEye Keylogger 0x1f5c3:$hawkstr1: HawkEye Keylogger 0x1f726:$hawkstr1: HawkEye Keylogger 0x1f9bd:$hawkstr1: HawkEye Keylogger 0x1de86:$hawkstr2: Dear HawkEye Customers! 0x1f4bb:$hawkstr2: Dear HawkEye Customers! 0x1f612:$hawkstr2: Dear HawkEye Customers! 0x1f779:$hawkstr2: Dear HawkEye Customers! 0x1dfa7:$hawkstr3: HawkEye Logger Details:
5.0.Pluto Panel.exe.f18208.10.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x754d1:$key: HawkEyeKeylogger 0x7770d:$salt: 099u787978786 0x75b0a:$string1: HawkEye_Keylogger 0x7695d:$string1: HawkEye_Keylogger 0x7766d:$string1: HawkEye_Keylogger 0x75ef3:$string2: holdermail.txt 0x75f13:$string2: holdermail.txt 0x75e35:$string3: wallet.dat 0x75e4d:$string3: wallet.dat 0x75e63:$string3: wallet.dat 0x7724f:$string4: Keylog Records 0x77567:$string4: Keylog Records 0x77765:$string5: do not script --> 0x754b9:$string6: \pidloc.txt 0x7551f:$string7: BSPLIT 0x7552f:$string7: BSPLIT
5.0.Pluto Panel.exe.f18208.10.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
5.0.Pluto Panel.exe.f18208.10.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.0.Pluto Panel.exe.f18208.10.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.0.Pluto Panel.exe.f18208.10.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.0.Pluto Panel.exe.f18208.10.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b62:$hawkstr1: HawkEye Keylogger 0x769a3:$hawkstr1: HawkEye Keylogger 0x76cd2:$hawkstr1: HawkEye Keylogger 0x76e2d:$hawkstr1: HawkEye Keylogger 0x76f90:$hawkstr1: HawkEye Keylogger 0x77227:$hawkstr1: HawkEye Keylogger 0x756f0:$hawkstr2: Dear HawkEye Customers! 0x76d25:$hawkstr2: Dear HawkEye Customers! 0x76e7c:$hawkstr2: Dear HawkEye Customers! 0x76fe3:$hawkstr2: Dear HawkEye Customers! 0x75811:$hawkstr3: HawkEye Logger Details:
0.2.RIP_YOUR_PC_LOL.exe.1d1caed.10.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.1d1caed.10.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x26201:$s1: netsh firewall delete allowedprogram 0x260f7:$s2: netsh firewall add allowedprogram 0x26261:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x25eeb:$s4: Execute ERROR 0x25f4b:$s4: Execute ERROR 0x25f0f:$s5: Download ERROR 0x262a7:$s6: [kl]
0.2.RIP_YOUR_PC_LOL.exe.1d1caed.10.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x260f7:$a1: netsh firewall add allowedprogram 0x262f1:$b1: [TAP] 0x26297:$b2: & exit 0x26263:$c1: md.exe /k ping 0 & del
0.3.RIP_YOUR_PC_LOL.exe.5707591.1.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
4.0.healastounding.exe.902324.11.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
4.0.healastounding.exe.902324.11.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.0.healastounding.exe.902324.11.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.0.healastounding.exe.902324.11.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.0.healastounding.exe.902324.11.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x59006:$s1: netsh firewall delete allowedprogram 0x58efc:$s2: netsh firewall add allowedprogram 0x59066:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x58cf0:$s4: Execute ERROR 0x58d50:$s4: Execute ERROR 0x58d14:$s5: Download ERROR 0x590ac:$s6: [kl]
4.0.healastounding.exe.902324.11.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x57508:$s2: EndPoint 0x10653:$s3: IPAddress 0x574d2:$s3: IPAddress 0x3881a6:$s3: IPAddress
4.0.healastounding.exe.902324.11.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x570dd:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x386d0a:$e: KeepAlive 0x387424:$e: KeepAlive 0x387432:$e: KeepAlive 0x3882db:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x386c8d:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q
4.0.healastounding.exe.902324.11.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x58efc:$a1: netsh firewall add allowedprogram 0x590f6:$b1: [TAP] 0x5909c:$b2: & exit 0x38a916:$b2: & exit 0x59068:$c1: md.exe /k ping 0 & del
11.0.22.exe.5f65b6.5.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x4e6a:$s1: blackmoon 0x4eaa:$s2: BlackMoon RunTime Error:
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.7.unpack	JoeSecurity_ficker_stealer	Yara detected Ficker Stealer	Joe Security
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.7.unpack	MALWARE_Win_Ficker	Detects Ficker infostealer	ditekSHen	0x36fd5:$s1: JNOde\ 0x37abc:$s2: "SomeNone 0x37b00:$s3: kindmessage 0x37d37:$s5: ..\\?\.\UNC\Windows stdio in console mode does not support writing non-UTF-8 byte sequences 0x37f79:$s7: (os error other os erroroperation interruptedwrite zerotimed 0x3818c:$s9: _matherr(): %s in %s(%g, %g) (retval=%g)
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.16.unpack	JoeSecurity_ficker_stealer	Yara detected Ficker Stealer	Joe Security
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.16.unpack	MALWARE_Win_Ficker	Detects Ficker infostealer	ditekSHen	0x36fd5:$s1: JNOde\ 0x37abc:$s2: "SomeNone 0x37b00:$s3: kindmessage 0x37d37:$s5: ..\\?\.\UNC\Windows stdio in console mode does not support writing non-UTF-8 byte sequences 0x37f79:$s7: (os error other os erroroperation interruptedwrite zerotimed 0x3818c:$s9: _matherr(): %s in %s(%g, %g) (retval=%g)
0.1.RIP_YOUR_PC_LOL.exe.d4dd52.4.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x4e6a:$s1: blackmoon 0x4eaa:$s2: BlackMoon RunTime Error:
4.0.healastounding.exe.900000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x106b1:$x1: NanoCore.ClientPluginHost 0x106ee:$x2: IClientNetworkHost 0x14221:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
4.0.healastounding.exe.900000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.0.healastounding.exe.900000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.0.healastounding.exe.900000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.0.healastounding.exe.900000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x5952a:$s1: netsh firewall delete allowedprogram 0x59420:$s2: netsh firewall add allowedprogram 0x5958a:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x59214:$s4: Execute ERROR 0x59274:$s4: Execute ERROR 0x59238:$s5: Download ERROR 0x595d0:$s6: [kl]
4.0.healastounding.exe.900000.0.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x10419:$x1: NanoCore Client 0x10429:$x1: NanoCore Client 0x10671:$x2: NanoCore.ClientPlugin 0x106b1:$x3: NanoCore.ClientPluginHost 0x10666:$i1: IClientApp 0x10687:$i2: IClientData 0x10693:$i3: IClientNetwork 0x106a2:$i4: IClientAppHost 0x106cb:$i5: IClientDataHost 0x106db:$i6: IClientLoggingHost 0x106ee:$i7: IClientNetworkHost 0x10701:$i8: IClientUIHost 0x1070f:$i9: IClientNameObjectCollection 0x1072b:$i10: IClientReadOnlyNameObjectCollection 0x10478:$s1: ClientPlugin 0x1067a:$s1: ClientPlugin 0x10b6e:$s2: EndPoint 0x57a2c:$s2: EndPoint 0x10b77:$s3: IPAddress 0x579f6:$s3: IPAddress 0x3886ca:$s3: IPAddress
4.0.healastounding.exe.900000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10419:$a: NanoCore 0x10429:$a: NanoCore 0x1065d:$a: NanoCore 0x10671:$a: NanoCore 0x106b1:$a: NanoCore 0x10478:$b: ClientPlugin 0x1067a:$b: ClientPlugin 0x106ba:$b: ClientPlugin 0x1059f:$c: ProjectData 0x57601:$c: ProjectData 0x10fa6:$d: DESCrypto 0x18972:$e: KeepAlive 0x38722e:$e: KeepAlive 0x387948:$e: KeepAlive 0x387956:$e: KeepAlive 0x3887ff:$e: KeepAlive 0x16960:$g: LogClientMessage 0x12b5b:$i: get_Connected 0x3871b1:$i: get_Connected 0x112dc:$j: #=q 0x1130c:$j: #=q
4.0.healastounding.exe.900000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x59420:$a1: netsh firewall add allowedprogram 0x5961a:$b1: [TAP] 0x595c0:$b2: & exit 0x38ae3a:$b2: & exit 0x5958c:$c1: md.exe /k ping 0 & del
5.2.Pluto Panel.exe.4698e10.8.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
4.0.healastounding.exe.95312e.7.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.0.healastounding.exe.95312e.7.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.0.healastounding.exe.95312e.7.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
4.0.healastounding.exe.95312e.7.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x339b0c:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.11.unpack	JoeSecurity_ficker_stealer	Yara detected Ficker Stealer	Joe Security
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.11.unpack	MALWARE_Win_Ficker	Detects Ficker infostealer	ditekSHen	0x36fd5:$s1: JNOde\ 0x37abc:$s2: "SomeNone 0x37b00:$s3: kindmessage 0x37d37:$s5: ..\\?\.\UNC\Windows stdio in console mode does not support writing non-UTF-8 byte sequences 0x37f79:$s7: (os error other os erroroperation interruptedwrite zerotimed 0x3818c:$s9: _matherr(): %s in %s(%g, %g) (retval=%g)
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.12.unpack	JoeSecurity_ficker_stealer	Yara detected Ficker Stealer	Joe Security
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.12.unpack	MALWARE_Win_Ficker	Detects Ficker infostealer	ditekSHen	0x36fd5:$s1: JNOde\ 0x37abc:$s2: "SomeNone 0x37b00:$s3: kindmessage 0x37d37:$s5: ..\\?\.\UNC\Windows stdio in console mode does not support writing non-UTF-8 byte sequences 0x37f79:$s7: (os error other os erroroperation interruptedwrite zerotimed 0x3818c:$s9: _matherr(): %s in %s(%g, %g) (retval=%g)
9.2.Opus.exe.3ed9c96.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5bf:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d5ec:$x2: IClientNetworkHost
9.2.Opus.exe.3ed9c96.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5bf:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e69a:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d5d9:$s5: IClientLoggingHost
9.2.Opus.exe.3ed9c96.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.2.Opus.exe.3ed9c96.2.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0x145ae:$x2: NanoCore.ClientPlugin 0x2d58a:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0x145e3:$x3: NanoCore.ClientPluginHost 0x2d5bf:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0x145a2:$i2: IClientData 0x2d57e:$i2: IClientData 0xe29:$i3: IClientNetwork 0x145c4:$i3: IClientNetwork 0x2d5a0:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0x145d3:$i5: IClientDataHost 0x2d5af:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0x145fd:$i6: IClientLoggingHost 0x2d5d9:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost
9.2.Opus.exe.3ed9c96.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d575:$a: NanoCore 0x2d58a:$a: NanoCore 0x2d5bf:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d331:$b: ClientPlugin 0x2d34c:$b: ClientPlugin
0.0.RIP_YOUR_PC_LOL.exe.c8867b.4.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xca541:$s1: blackmoon 0xca581:$s2: BlackMoon RunTime Error:
5.0.Pluto Panel.exe.f19c0d.15.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.2.Pluto Panel.exe.7710000.10.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
0.1.RIP_YOUR_PC_LOL.exe.c8867b.3.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xca541:$s1: blackmoon 0xca581:$s2: BlackMoon RunTime Error:
0.1.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73acc:$key: HawkEyeKeylogger 0x75d08:$salt: 099u787978786 0x74105:$string1: HawkEye_Keylogger 0x74f58:$string1: HawkEye_Keylogger 0x75c68:$string1: HawkEye_Keylogger 0x744ee:$string2: holdermail.txt 0x7450e:$string2: holdermail.txt 0x74430:$string3: wallet.dat 0x74448:$string3: wallet.dat 0x7445e:$string3: wallet.dat 0x7584a:$string4: Keylog Records 0x75b62:$string4: Keylog Records 0x75d60:$string5: do not script --> 0x73ab4:$string6: \pidloc.txt 0x73b1a:$string7: BSPLIT 0x73b2a:$string7: BSPLIT
0.1.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.1.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0.1.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0.1.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7415d:$hawkstr1: HawkEye Keylogger 0x74f9e:$hawkstr1: HawkEye Keylogger 0x752cd:$hawkstr1: HawkEye Keylogger 0x75428:$hawkstr1: HawkEye Keylogger 0x7558b:$hawkstr1: HawkEye Keylogger 0x75822:$hawkstr1: HawkEye Keylogger 0x73ceb:$hawkstr2: Dear HawkEye Customers! 0x75320:$hawkstr2: Dear HawkEye Customers! 0x75477:$hawkstr2: Dear HawkEye Customers! 0x755de:$hawkstr2: Dear HawkEye Customers! 0x73e0c:$hawkstr3: HawkEye Logger Details:
4.0.healastounding.exe.95312e.2.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.0.healastounding.exe.95312e.2.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x63fc:$s1: netsh firewall delete allowedprogram 0x62f2:$s2: netsh firewall add allowedprogram 0x645c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x60e6:$s4: Execute ERROR 0x6146:$s4: Execute ERROR 0x610a:$s5: Download ERROR 0x64a2:$s6: [kl]
4.0.healastounding.exe.95312e.2.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x62f2:$a1: netsh firewall add allowedprogram 0x64ec:$b1: [TAP] 0x6492:$b2: & exit 0x645e:$c1: md.exe /k ping 0 & del
9.2.Opus.exe.3edeacc.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
9.2.Opus.exe.3edeacc.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
9.2.Opus.exe.3edeacc.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.2.Opus.exe.3edeacc.3.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xd978:$x2: NanoCore.ClientPlugin 0xd9ad:$x3: NanoCore.ClientPluginHost 0xd96c:$i2: IClientData 0xd98e:$i3: IClientNetwork 0xd99d:$i5: IClientDataHost 0xd9c7:$i6: IClientLoggingHost 0xd9da:$i7: IClientNetworkHost 0xd9ed:$i8: IClientUIHost 0xd9fb:$i9: IClientNameObjectCollection 0xda17:$i10: IClientReadOnlyNameObjectCollection 0xd76a:$s1: ClientPlugin 0xd981:$s1: ClientPlugin 0x129a2:$s6: get_ClientSettings
9.2.Opus.exe.3ee30f5.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x24160:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x2418d:$x2: IClientNetworkHost
9.2.Opus.exe.3ee30f5.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x24160:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x2523b:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x2417a:$s5: IClientLoggingHost
9.2.Opus.exe.3ee30f5.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.2.Opus.exe.3ee30f5.4.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xb14f:$x2: NanoCore.ClientPlugin 0x2412b:$x2: NanoCore.ClientPlugin 0xb184:$x3: NanoCore.ClientPluginHost 0x24160:$x3: NanoCore.ClientPluginHost 0xb143:$i2: IClientData 0x2411f:$i2: IClientData 0xb165:$i3: IClientNetwork 0x24141:$i3: IClientNetwork 0xb174:$i5: IClientDataHost 0x24150:$i5: IClientDataHost 0xb19e:$i6: IClientLoggingHost 0x2417a:$i6: IClientLoggingHost 0xb1b1:$i7: IClientNetworkHost 0x2418d:$i7: IClientNetworkHost 0xb1c4:$i8: IClientUIHost 0x241a0:$i8: IClientUIHost 0xb1d2:$i9: IClientNameObjectCollection 0x241ae:$i9: IClientNameObjectCollection 0xb1ee:$i10: IClientReadOnlyNameObjectCollection 0x241ca:$i10: IClientReadOnlyNameObjectCollection 0xaf41:$s1: ClientPlugin
4.0.healastounding.exe.95312e.7.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.0.healastounding.exe.95312e.7.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x63fc:$s1: netsh firewall delete allowedprogram 0x62f2:$s2: netsh firewall add allowedprogram 0x645c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x60e6:$s4: Execute ERROR 0x6146:$s4: Execute ERROR 0x610a:$s5: Download ERROR 0x64a2:$s6: [kl]
4.0.healastounding.exe.95312e.7.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x62f2:$a1: netsh firewall add allowedprogram 0x64ec:$b1: [TAP] 0x6492:$b2: & exit 0x645e:$c1: md.exe /k ping 0 & del
0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe0f5:$x1: NanoCore Client 0xe105:$x1: NanoCore Client 0xe34d:$x2: NanoCore.ClientPlugin 0xe38d:$x3: NanoCore.ClientPluginHost 0xe342:$i1: IClientApp 0xe363:$i2: IClientData 0xe36f:$i3: IClientNetwork 0xe37e:$i4: IClientAppHost 0xe3a7:$i5: IClientDataHost 0xe3b7:$i6: IClientLoggingHost 0xe3ca:$i7: IClientNetworkHost 0xe3dd:$i8: IClientUIHost 0xe3eb:$i9: IClientNameObjectCollection 0xe407:$i10: IClientReadOnlyNameObjectCollection 0xe154:$s1: ClientPlugin 0xe356:$s1: ClientPlugin 0xe84a:$s2: EndPoint 0xe853:$s3: IPAddress 0xe85d:$s4: IPEndPoint 0x10293:$s6: get_ClientSettings 0x10837:$s7: get_Connected
0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
4.2.healastounding.exe.902324.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
4.2.healastounding.exe.902324.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.2.healastounding.exe.902324.3.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.healastounding.exe.902324.3.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.2.healastounding.exe.902324.3.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x59006:$s1: netsh firewall delete allowedprogram 0x58efc:$s2: netsh firewall add allowedprogram 0x59066:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x58cf0:$s4: Execute ERROR 0x58d50:$s4: Execute ERROR 0x58d14:$s5: Download ERROR 0x590ac:$s6: [kl]
4.2.healastounding.exe.902324.3.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x57508:$s2: EndPoint 0x10653:$s3: IPAddress 0x574d2:$s3: IPAddress 0x3881a6:$s3: IPAddress
4.2.healastounding.exe.902324.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x570dd:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x386d0a:$e: KeepAlive 0x387424:$e: KeepAlive 0x387432:$e: KeepAlive 0x3882db:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x386c8d:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q
4.2.healastounding.exe.902324.3.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x58efc:$a1: netsh firewall add allowedprogram 0x590f6:$b1: [TAP] 0x5909c:$b2: & exit 0x38a916:$b2: & exit 0x59068:$c1: md.exe /k ping 0 & del
5.0.Pluto Panel.exe.f18208.2.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x754d1:$key: HawkEyeKeylogger 0x7770d:$salt: 099u787978786 0x75b0a:$string1: HawkEye_Keylogger 0x7695d:$string1: HawkEye_Keylogger 0x7766d:$string1: HawkEye_Keylogger 0x75ef3:$string2: holdermail.txt 0x75f13:$string2: holdermail.txt 0x75e35:$string3: wallet.dat 0x75e4d:$string3: wallet.dat 0x75e63:$string3: wallet.dat 0x7724f:$string4: Keylog Records 0x77567:$string4: Keylog Records 0x77765:$string5: do not script --> 0x754b9:$string6: \pidloc.txt 0x7551f:$string7: BSPLIT 0x7552f:$string7: BSPLIT
5.0.Pluto Panel.exe.f18208.2.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
5.0.Pluto Panel.exe.f18208.2.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.0.Pluto Panel.exe.f18208.2.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.0.Pluto Panel.exe.f18208.2.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.0.Pluto Panel.exe.f18208.2.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b62:$hawkstr1: HawkEye Keylogger 0x769a3:$hawkstr1: HawkEye Keylogger 0x76cd2:$hawkstr1: HawkEye Keylogger 0x76e2d:$hawkstr1: HawkEye Keylogger 0x76f90:$hawkstr1: HawkEye Keylogger 0x77227:$hawkstr1: HawkEye Keylogger 0x756f0:$hawkstr2: Dear HawkEye Customers! 0x76d25:$hawkstr2: Dear HawkEye Customers! 0x76e7c:$hawkstr2: Dear HawkEye Customers! 0x76fe3:$hawkstr2: Dear HawkEye Customers! 0x75811:$hawkstr3: HawkEye Logger Details:
5.0.Pluto Panel.exe.f6fa72.1.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x1dc67:$key: HawkEyeKeylogger 0x1fea3:$salt: 099u787978786 0x1e2a0:$string1: HawkEye_Keylogger 0x1f0f3:$string1: HawkEye_Keylogger 0x1fe03:$string1: HawkEye_Keylogger 0x1e689:$string2: holdermail.txt 0x1e6a9:$string2: holdermail.txt 0x1e5cb:$string3: wallet.dat 0x1e5e3:$string3: wallet.dat 0x1e5f9:$string3: wallet.dat 0x1f9e5:$string4: Keylog Records 0x1fcfd:$string4: Keylog Records 0x1fefb:$string5: do not script --> 0x1dc4f:$string6: \pidloc.txt 0x1dcb5:$string7: BSPLIT 0x1dcc5:$string7: BSPLIT
5.0.Pluto Panel.exe.f6fa72.1.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.0.Pluto Panel.exe.f6fa72.1.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.0.Pluto Panel.exe.f6fa72.1.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x1e2f8:$hawkstr1: HawkEye Keylogger 0x1f139:$hawkstr1: HawkEye Keylogger 0x1f468:$hawkstr1: HawkEye Keylogger 0x1f5c3:$hawkstr1: HawkEye Keylogger 0x1f726:$hawkstr1: HawkEye Keylogger 0x1f9bd:$hawkstr1: HawkEye Keylogger 0x1de86:$hawkstr2: Dear HawkEye Customers! 0x1f4bb:$hawkstr2: Dear HawkEye Customers! 0x1f612:$hawkstr2: Dear HawkEye Customers! 0x1f779:$hawkstr2: Dear HawkEye Customers! 0x1dfa7:$hawkstr3: HawkEye Logger Details:
5.0.Pluto Panel.exe.f6fa72.13.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.0.Pluto Panel.exe.f6fa72.9.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x1dc67:$key: HawkEyeKeylogger 0x1fea3:$salt: 099u787978786 0x1e2a0:$string1: HawkEye_Keylogger 0x1f0f3:$string1: HawkEye_Keylogger 0x1fe03:$string1: HawkEye_Keylogger 0x1e689:$string2: holdermail.txt 0x1e6a9:$string2: holdermail.txt 0x1e5cb:$string3: wallet.dat 0x1e5e3:$string3: wallet.dat 0x1e5f9:$string3: wallet.dat 0x1f9e5:$string4: Keylog Records 0x1fcfd:$string4: Keylog Records 0x1fefb:$string5: do not script --> 0x1dc4f:$string6: \pidloc.txt 0x1dcb5:$string7: BSPLIT 0x1dcc5:$string7: BSPLIT
5.0.Pluto Panel.exe.f6fa72.9.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.0.Pluto Panel.exe.f6fa72.9.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.0.Pluto Panel.exe.f6fa72.9.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x1e2f8:$hawkstr1: HawkEye Keylogger 0x1f139:$hawkstr1: HawkEye Keylogger 0x1f468:$hawkstr1: HawkEye Keylogger 0x1f5c3:$hawkstr1: HawkEye Keylogger 0x1f726:$hawkstr1: HawkEye Keylogger 0x1f9bd:$hawkstr1: HawkEye Keylogger 0x1de86:$hawkstr2: Dear HawkEye Customers! 0x1f4bb:$hawkstr2: Dear HawkEye Customers! 0x1f612:$hawkstr2: Dear HawkEye Customers! 0x1f779:$hawkstr2: Dear HawkEye Customers! 0x1dfa7:$hawkstr3: HawkEye Logger Details:
17.0.mediaget.exe.ab0000.1.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
17.0.mediaget.exe.ab0000.1.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
17.0.mediaget.exe.ab0000.1.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
5.0.Pluto Panel.exe.f6fa72.1.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
11.0.22.exe.43de6f.7.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xea800:$s1: blackmoon 0xea840:$s2: BlackMoon RunTime Error:
4.0.healastounding.exe.95312e.13.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.0.healastounding.exe.95312e.13.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x63fc:$s1: netsh firewall delete allowedprogram 0x62f2:$s2: netsh firewall add allowedprogram 0x645c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x60e6:$s4: Execute ERROR 0x6146:$s4: Execute ERROR 0x610a:$s5: Download ERROR 0x64a2:$s6: [kl]
4.0.healastounding.exe.95312e.13.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x62f2:$a1: netsh firewall add allowedprogram 0x64ec:$b1: [TAP] 0x6492:$b2: & exit 0x645e:$c1: md.exe /k ping 0 & del
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.18.unpack	JoeSecurity_ficker_stealer	Yara detected Ficker Stealer	Joe Security
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.18.unpack	MALWARE_Win_Ficker	Detects Ficker infostealer	ditekSHen	0x36fd5:$s1: JNOde\ 0x37abc:$s2: "SomeNone 0x37b00:$s3: kindmessage 0x37d37:$s5: ..\\?\.\UNC\Windows stdio in console mode does not support writing non-UTF-8 byte sequences 0x37f79:$s7: (os error other os erroroperation interruptedwrite zerotimed 0x3818c:$s9: _matherr(): %s in %s(%g, %g) (retval=%g)
5.0.Pluto Panel.exe.f6fa72.7.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
11.0.22.exe.400000.18.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x12866f:$s1: blackmoon 0x1fb420:$s1: blackmoon 0x1286af:$s2: BlackMoon RunTime Error: 0x1fb460:$s2: BlackMoon RunTime Error:
0.2.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73acc:$key: HawkEyeKeylogger 0x75d08:$salt: 099u787978786 0x74105:$string1: HawkEye_Keylogger 0x74f58:$string1: HawkEye_Keylogger 0x75c68:$string1: HawkEye_Keylogger 0x744ee:$string2: holdermail.txt 0x7450e:$string2: holdermail.txt 0x74430:$string3: wallet.dat 0x74448:$string3: wallet.dat 0x7445e:$string3: wallet.dat 0x7584a:$string4: Keylog Records 0x75b62:$string4: Keylog Records 0x75d60:$string5: do not script --> 0x73ab4:$string6: \pidloc.txt 0x73b1a:$string7: BSPLIT 0x73b2a:$string7: BSPLIT
0.2.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7415d:$hawkstr1: HawkEye Keylogger 0x74f9e:$hawkstr1: HawkEye Keylogger 0x752cd:$hawkstr1: HawkEye Keylogger 0x75428:$hawkstr1: HawkEye Keylogger 0x7558b:$hawkstr1: HawkEye Keylogger 0x75822:$hawkstr1: HawkEye Keylogger 0x73ceb:$hawkstr2: Dear HawkEye Customers! 0x75320:$hawkstr2: Dear HawkEye Customers! 0x75477:$hawkstr2: Dear HawkEye Customers! 0x755de:$hawkstr2: Dear HawkEye Customers! 0x73e0c:$hawkstr3: HawkEye Logger Details:
5.0.Pluto Panel.exe.f6fa72.7.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x1dc67:$key: HawkEyeKeylogger 0x1fea3:$salt: 099u787978786 0x1e2a0:$string1: HawkEye_Keylogger 0x1f0f3:$string1: HawkEye_Keylogger 0x1fe03:$string1: HawkEye_Keylogger 0x1e689:$string2: holdermail.txt 0x1e6a9:$string2: holdermail.txt 0x1e5cb:$string3: wallet.dat 0x1e5e3:$string3: wallet.dat 0x1e5f9:$string3: wallet.dat 0x1f9e5:$string4: Keylog Records 0x1fcfd:$string4: Keylog Records 0x1fefb:$string5: do not script --> 0x1dc4f:$string6: \pidloc.txt 0x1dcb5:$string7: BSPLIT 0x1dcc5:$string7: BSPLIT
5.0.Pluto Panel.exe.f6fa72.7.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.0.Pluto Panel.exe.f6fa72.7.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.0.Pluto Panel.exe.f6fa72.7.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x1e2f8:$hawkstr1: HawkEye Keylogger 0x1f139:$hawkstr1: HawkEye Keylogger 0x1f468:$hawkstr1: HawkEye Keylogger 0x1f5c3:$hawkstr1: HawkEye Keylogger 0x1f726:$hawkstr1: HawkEye Keylogger 0x1f9bd:$hawkstr1: HawkEye Keylogger 0x1de86:$hawkstr2: Dear HawkEye Customers! 0x1f4bb:$hawkstr2: Dear HawkEye Customers! 0x1f612:$hawkstr2: Dear HawkEye Customers! 0x1f779:$hawkstr2: Dear HawkEye Customers! 0x1dfa7:$hawkstr3: HawkEye Logger Details:
11.0.22.exe.530edf.4.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xca541:$s1: blackmoon 0xca581:$s2: BlackMoon RunTime Error:
0.3.RIP_YOUR_PC_LOL.exe.5839748.8.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x1fb420:$s1: blackmoon 0x1fb460:$s2: BlackMoon RunTime Error:
6.0.test.exe.da0000.2.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
6.0.test.exe.da0000.2.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99f3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.RIP_YOUR_PC_LOL.exe.206ac1d.13.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.206ac1d.13.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99f3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
11.0.22.exe.530edf.22.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xca541:$s1: blackmoon 0xca581:$s2: BlackMoon RunTime Error:
5.0.Pluto Panel.exe.f19c0d.6.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.1fdd5e1.14.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.1fdd5e1.14.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x9702f:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
4.2.healastounding.exe.902324.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
4.2.healastounding.exe.902324.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
4.2.healastounding.exe.902324.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.2.healastounding.exe.902324.3.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe0f5:$x1: NanoCore Client 0xe105:$x1: NanoCore Client 0xe34d:$x2: NanoCore.ClientPlugin 0xe38d:$x3: NanoCore.ClientPluginHost 0xe342:$i1: IClientApp 0xe363:$i2: IClientData 0xe36f:$i3: IClientNetwork 0xe37e:$i4: IClientAppHost 0xe3a7:$i5: IClientDataHost 0xe3b7:$i6: IClientLoggingHost 0xe3ca:$i7: IClientNetworkHost 0xe3dd:$i8: IClientUIHost 0xe3eb:$i9: IClientNameObjectCollection 0xe407:$i10: IClientReadOnlyNameObjectCollection 0xe154:$s1: ClientPlugin 0xe356:$s1: ClientPlugin 0xe84a:$s2: EndPoint 0xe853:$s3: IPAddress 0xe85d:$s4: IPEndPoint 0x10293:$s6: get_ClientSettings 0x10837:$s7: get_Connected
4.2.healastounding.exe.902324.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
0.0.RIP_YOUR_PC_LOL.exe.d4dd52.5.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x4e6a:$s1: blackmoon 0x4eaa:$s2: BlackMoon RunTime Error:
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.13.unpack	JoeSecurity_ficker_stealer	Yara detected Ficker Stealer	Joe Security
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.13.unpack	MALWARE_Win_Ficker	Detects Ficker infostealer	ditekSHen	0x36fd5:$s1: JNOde\ 0x37abc:$s2: "SomeNone 0x37b00:$s3: kindmessage 0x37d37:$s5: ..\\?\.\UNC\Windows stdio in console mode does not support writing non-UTF-8 byte sequences 0x37f79:$s7: (os error other os erroroperation interruptedwrite zerotimed 0x3818c:$s9: _matherr(): %s in %s(%g, %g) (retval=%g)
0.2.RIP_YOUR_PC_LOL.exe.c8867b.4.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xca541:$s1: blackmoon 0xca581:$s2: BlackMoon RunTime Error:
5.2.Pluto Panel.exe.4698e10.8.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.2.Pluto Panel.exe.4698e10.8.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
11.0.22.exe.530edf.16.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xca541:$s1: blackmoon 0xca581:$s2: BlackMoon RunTime Error:
5.0.Pluto Panel.exe.f10000.4.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8d9:$key: HawkEyeKeylogger 0x7db15:$salt: 099u787978786 0x7bf12:$string1: HawkEye_Keylogger 0x7cd65:$string1: HawkEye_Keylogger 0x7da75:$string1: HawkEye_Keylogger 0x7c2fb:$string2: holdermail.txt 0x7c31b:$string2: holdermail.txt 0x7c23d:$string3: wallet.dat 0x7c255:$string3: wallet.dat 0x7c26b:$string3: wallet.dat 0x7d657:$string4: Keylog Records 0x7d96f:$string4: Keylog Records 0x7db6d:$string5: do not script --> 0x7b8c1:$string6: \pidloc.txt 0x7b927:$string7: BSPLIT 0x7b937:$string7: BSPLIT
5.0.Pluto Panel.exe.f10000.4.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
5.0.Pluto Panel.exe.f10000.4.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.0.Pluto Panel.exe.f10000.4.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.0.Pluto Panel.exe.f10000.4.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.0.Pluto Panel.exe.f10000.4.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf6a:$hawkstr1: HawkEye Keylogger 0x7cdab:$hawkstr1: HawkEye Keylogger 0x7d0da:$hawkstr1: HawkEye Keylogger 0x7d235:$hawkstr1: HawkEye Keylogger 0x7d398:$hawkstr1: HawkEye Keylogger 0x7d62f:$hawkstr1: HawkEye Keylogger 0x7baf8:$hawkstr2: Dear HawkEye Customers! 0x7d12d:$hawkstr2: Dear HawkEye Customers! 0x7d284:$hawkstr2: Dear HawkEye Customers! 0x7d3eb:$hawkstr2: Dear HawkEye Customers! 0x7bc19:$hawkstr3: HawkEye Logger Details:
6.0.test.exe.da0000.3.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
6.0.test.exe.da0000.3.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99f3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.3.RIP_YOUR_PC_LOL.exe.5731eca.7.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x1dc67:$key: HawkEyeKeylogger 0x1fea3:$salt: 099u787978786 0x1e2a0:$string1: HawkEye_Keylogger 0x1f0f3:$string1: HawkEye_Keylogger 0x1fe03:$string1: HawkEye_Keylogger 0x1e689:$string2: holdermail.txt 0x1e6a9:$string2: holdermail.txt 0x1e5cb:$string3: wallet.dat 0x1e5e3:$string3: wallet.dat 0x1e5f9:$string3: wallet.dat 0x1f9e5:$string4: Keylog Records 0x1fcfd:$string4: Keylog Records 0x1fefb:$string5: do not script --> 0x1dc4f:$string6: \pidloc.txt 0x1dcb5:$string7: BSPLIT 0x1dcc5:$string7: BSPLIT
0.3.RIP_YOUR_PC_LOL.exe.5731eca.7.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.3.RIP_YOUR_PC_LOL.exe.5731eca.7.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0.3.RIP_YOUR_PC_LOL.exe.5731eca.7.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x1e2f8:$hawkstr1: HawkEye Keylogger 0x1f139:$hawkstr1: HawkEye Keylogger 0x1f468:$hawkstr1: HawkEye Keylogger 0x1f5c3:$hawkstr1: HawkEye Keylogger 0x1f726:$hawkstr1: HawkEye Keylogger 0x1f9bd:$hawkstr1: HawkEye Keylogger 0x1de86:$hawkstr2: Dear HawkEye Customers! 0x1f4bb:$hawkstr2: Dear HawkEye Customers! 0x1f612:$hawkstr2: Dear HawkEye Customers! 0x1f779:$hawkstr2: Dear HawkEye Customers! 0x1dfa7:$hawkstr3: HawkEye Logger Details:
0.3.RIP_YOUR_PC_LOL.exe.5707591.1.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.3.RIP_YOUR_PC_LOL.exe.5707591.1.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x26201:$s1: netsh firewall delete allowedprogram 0x260f7:$s2: netsh firewall add allowedprogram 0x26261:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x25eeb:$s4: Execute ERROR 0x25f4b:$s4: Execute ERROR 0x25f0f:$s5: Download ERROR 0x262a7:$s6: [kl]
0.3.RIP_YOUR_PC_LOL.exe.5707591.1.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x260f7:$a1: netsh firewall add allowedprogram 0x262f1:$b1: [TAP] 0x26297:$b2: & exit 0x26263:$c1: md.exe /k ping 0 & del
4.0.healastounding.exe.935129.5.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.0.healastounding.exe.935129.5.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.0.healastounding.exe.935129.5.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x26201:$s1: netsh firewall delete allowedprogram 0x260f7:$s2: netsh firewall add allowedprogram 0x26261:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x25eeb:$s4: Execute ERROR 0x25f4b:$s4: Execute ERROR 0x25f0f:$s5: Download ERROR 0x262a7:$s6: [kl]
4.0.healastounding.exe.935129.5.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x260f7:$a1: netsh firewall add allowedprogram 0x262f1:$b1: [TAP] 0x26297:$b2: & exit 0x357b11:$b2: & exit 0x26263:$c1: md.exe /k ping 0 & del
0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x59006:$s1: netsh firewall delete allowedprogram 0x58efc:$s2: netsh firewall add allowedprogram 0x59066:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x58cf0:$s4: Execute ERROR 0x58d50:$s4: Execute ERROR 0x58d14:$s5: Download ERROR 0x590ac:$s6: [kl]
0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x57508:$s2: EndPoint 0x10653:$s3: IPAddress 0x574d2:$s3: IPAddress 0x1065d:$s4: IPEndPoint
0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x570dd:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q
0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x58efc:$a1: netsh firewall add allowedprogram 0x590f6:$b1: [TAP] 0x5909c:$b2: & exit 0x59068:$c1: md.exe /k ping 0 & del
5.0.Pluto Panel.exe.f10000.12.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8d9:$key: HawkEyeKeylogger 0x7db15:$salt: 099u787978786 0x7bf12:$string1: HawkEye_Keylogger 0x7cd65:$string1: HawkEye_Keylogger 0x7da75:$string1: HawkEye_Keylogger 0x7c2fb:$string2: holdermail.txt 0x7c31b:$string2: holdermail.txt 0x7c23d:$string3: wallet.dat 0x7c255:$string3: wallet.dat 0x7c26b:$string3: wallet.dat 0x7d657:$string4: Keylog Records 0x7d96f:$string4: Keylog Records 0x7db6d:$string5: do not script --> 0x7b8c1:$string6: \pidloc.txt 0x7b927:$string7: BSPLIT 0x7b937:$string7: BSPLIT
5.0.Pluto Panel.exe.f10000.12.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
5.0.Pluto Panel.exe.f10000.12.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.0.Pluto Panel.exe.f10000.12.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.0.Pluto Panel.exe.f10000.12.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.0.Pluto Panel.exe.f10000.12.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf6a:$hawkstr1: HawkEye Keylogger 0x7cdab:$hawkstr1: HawkEye Keylogger 0x7d0da:$hawkstr1: HawkEye Keylogger 0x7d235:$hawkstr1: HawkEye Keylogger 0x7d398:$hawkstr1: HawkEye Keylogger 0x7d62f:$hawkstr1: HawkEye Keylogger 0x7baf8:$hawkstr2: Dear HawkEye Customers! 0x7d12d:$hawkstr2: Dear HawkEye Customers! 0x7d284:$hawkstr2: Dear HawkEye Customers! 0x7d3eb:$hawkstr2: Dear HawkEye Customers! 0x7bc19:$hawkstr3: HawkEye Logger Details:
0.2.RIP_YOUR_PC_LOL.exe.206ac1d.13.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.206ac1d.13.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x7bf3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.10.unpack	JoeSecurity_ficker_stealer	Yara detected Ficker Stealer	Joe Security
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.10.unpack	MALWARE_Win_Ficker	Detects Ficker infostealer	ditekSHen	0x36fd5:$s1: JNOde\ 0x37abc:$s2: "SomeNone 0x37b00:$s3: kindmessage 0x37d37:$s5: ..\\?\.\UNC\Windows stdio in console mode does not support writing non-UTF-8 byte sequences 0x37f79:$s7: (os error other os erroroperation interruptedwrite zerotimed 0x3818c:$s9: _matherr(): %s in %s(%g, %g) (retval=%g)
5.0.Pluto Panel.exe.f19c0d.6.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73acc:$key: HawkEyeKeylogger 0x75d08:$salt: 099u787978786 0x74105:$string1: HawkEye_Keylogger 0x74f58:$string1: HawkEye_Keylogger 0x75c68:$string1: HawkEye_Keylogger 0x744ee:$string2: holdermail.txt 0x7450e:$string2: holdermail.txt 0x74430:$string3: wallet.dat 0x74448:$string3: wallet.dat 0x7445e:$string3: wallet.dat 0x7584a:$string4: Keylog Records 0x75b62:$string4: Keylog Records 0x75d60:$string5: do not script --> 0x73ab4:$string6: \pidloc.txt 0x73b1a:$string7: BSPLIT 0x73b2a:$string7: BSPLIT
5.0.Pluto Panel.exe.f19c0d.6.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.0.Pluto Panel.exe.f19c0d.6.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.0.Pluto Panel.exe.f19c0d.6.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.0.Pluto Panel.exe.f19c0d.6.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7415d:$hawkstr1: HawkEye Keylogger 0x74f9e:$hawkstr1: HawkEye Keylogger 0x752cd:$hawkstr1: HawkEye Keylogger 0x75428:$hawkstr1: HawkEye Keylogger 0x7558b:$hawkstr1: HawkEye Keylogger 0x75822:$hawkstr1: HawkEye Keylogger 0x73ceb:$hawkstr2: Dear HawkEye Customers! 0x75320:$hawkstr2: Dear HawkEye Customers! 0x75477:$hawkstr2: Dear HawkEye Customers! 0x755de:$hawkstr2: Dear HawkEye Customers! 0x73e0c:$hawkstr3: HawkEye Logger Details:
0.3.RIP_YOUR_PC_LOL.exe.5a2fcfe.10.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x4e6a:$s1: blackmoon 0x4eaa:$s2: BlackMoon RunTime Error:
0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8d9:$key: HawkEyeKeylogger 0x7db15:$salt: 099u787978786 0x7bf12:$string1: HawkEye_Keylogger 0x7cd65:$string1: HawkEye_Keylogger 0x7da75:$string1: HawkEye_Keylogger 0x7c2fb:$string2: holdermail.txt 0x7c31b:$string2: holdermail.txt 0x7c23d:$string3: wallet.dat 0x7c255:$string3: wallet.dat 0x7c26b:$string3: wallet.dat 0x7d657:$string4: Keylog Records 0x7d96f:$string4: Keylog Records 0x7db6d:$string5: do not script --> 0x7b8c1:$string6: \pidloc.txt 0x7b927:$string7: BSPLIT 0x7b937:$string7: BSPLIT
0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf6a:$hawkstr1: HawkEye Keylogger 0x7cdab:$hawkstr1: HawkEye Keylogger 0x7d0da:$hawkstr1: HawkEye Keylogger 0x7d235:$hawkstr1: HawkEye Keylogger 0x7d398:$hawkstr1: HawkEye Keylogger 0x7d62f:$hawkstr1: HawkEye Keylogger 0x7baf8:$hawkstr2: Dear HawkEye Customers! 0x7d12d:$hawkstr2: Dear HawkEye Customers! 0x7d284:$hawkstr2: Dear HawkEye Customers! 0x7d3eb:$hawkstr2: Dear HawkEye Customers! 0x7bc19:$hawkstr3: HawkEye Logger Details:
5.0.Pluto Panel.exe.f10000.0.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8d9:$key: HawkEyeKeylogger 0x7db15:$salt: 099u787978786 0x7bf12:$string1: HawkEye_Keylogger 0x7cd65:$string1: HawkEye_Keylogger 0x7da75:$string1: HawkEye_Keylogger 0x7c2fb:$string2: holdermail.txt 0x7c31b:$string2: holdermail.txt 0x7c23d:$string3: wallet.dat 0x7c255:$string3: wallet.dat 0x7c26b:$string3: wallet.dat 0x7d657:$string4: Keylog Records 0x7d96f:$string4: Keylog Records 0x7db6d:$string5: do not script --> 0x7b8c1:$string6: \pidloc.txt 0x7b927:$string7: BSPLIT 0x7b937:$string7: BSPLIT
5.0.Pluto Panel.exe.f10000.0.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
5.0.Pluto Panel.exe.f10000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.0.Pluto Panel.exe.f10000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.0.Pluto Panel.exe.f10000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.0.Pluto Panel.exe.f10000.0.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf6a:$hawkstr1: HawkEye Keylogger 0x7cdab:$hawkstr1: HawkEye Keylogger 0x7d0da:$hawkstr1: HawkEye Keylogger 0x7d235:$hawkstr1: HawkEye Keylogger 0x7d398:$hawkstr1: HawkEye Keylogger 0x7d62f:$hawkstr1: HawkEye Keylogger 0x7baf8:$hawkstr2: Dear HawkEye Customers! 0x7d12d:$hawkstr2: Dear HawkEye Customers! 0x7d284:$hawkstr2: Dear HawkEye Customers! 0x7d3eb:$hawkstr2: Dear HawkEye Customers! 0x7bc19:$hawkstr3: HawkEye Logger Details:
4.0.healastounding.exe.935129.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.0.healastounding.exe.935129.1.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.0.healastounding.exe.935129.1.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x26201:$s1: netsh firewall delete allowedprogram 0x260f7:$s2: netsh firewall add allowedprogram 0x26261:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x25eeb:$s4: Execute ERROR 0x25f4b:$s4: Execute ERROR 0x25f0f:$s5: Download ERROR 0x262a7:$s6: [kl]
4.0.healastounding.exe.935129.1.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x260f7:$a1: netsh firewall add allowedprogram 0x262f1:$b1: [TAP] 0x26297:$b2: & exit 0x357b11:$b2: & exit 0x26263:$c1: md.exe /k ping 0 & del
0.0.RIP_YOUR_PC_LOL.exe.206ac1d.13.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.206ac1d.13.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x7bf3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
5.0.Pluto Panel.exe.f19c0d.3.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73acc:$key: HawkEyeKeylogger 0x75d08:$salt: 099u787978786 0x74105:$string1: HawkEye_Keylogger 0x74f58:$string1: HawkEye_Keylogger 0x75c68:$string1: HawkEye_Keylogger 0x744ee:$string2: holdermail.txt 0x7450e:$string2: holdermail.txt 0x74430:$string3: wallet.dat 0x74448:$string3: wallet.dat 0x7445e:$string3: wallet.dat 0x7584a:$string4: Keylog Records 0x75b62:$string4: Keylog Records 0x75d60:$string5: do not script --> 0x73ab4:$string6: \pidloc.txt 0x73b1a:$string7: BSPLIT 0x73b2a:$string7: BSPLIT
5.0.Pluto Panel.exe.f19c0d.3.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.0.Pluto Panel.exe.f19c0d.3.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.0.Pluto Panel.exe.f19c0d.3.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.0.Pluto Panel.exe.f19c0d.3.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7415d:$hawkstr1: HawkEye Keylogger 0x74f9e:$hawkstr1: HawkEye Keylogger 0x752cd:$hawkstr1: HawkEye Keylogger 0x75428:$hawkstr1: HawkEye Keylogger 0x7558b:$hawkstr1: HawkEye Keylogger 0x75822:$hawkstr1: HawkEye Keylogger 0x73ceb:$hawkstr2: Dear HawkEye Customers! 0x75320:$hawkstr2: Dear HawkEye Customers! 0x75477:$hawkstr2: Dear HawkEye Customers! 0x755de:$hawkstr2: Dear HawkEye Customers! 0x73e0c:$hawkstr3: HawkEye Logger Details:
11.0.22.exe.530edf.11.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xca541:$s1: blackmoon 0xca581:$s2: BlackMoon RunTime Error:
5.2.Pluto Panel.exe.f6fa72.1.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.19.unpack	JoeSecurity_ficker_stealer	Yara detected Ficker Stealer	Joe Security
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.19.unpack	MALWARE_Win_Ficker	Detects Ficker infostealer	ditekSHen	0x36fd5:$s1: JNOde\ 0x37abc:$s2: "SomeNone 0x37b00:$s3: kindmessage 0x37d37:$s5: ..\\?\.\UNC\Windows stdio in console mode does not support writing non-UTF-8 byte sequences 0x37f79:$s7: (os error other os erroroperation interruptedwrite zerotimed 0x3818c:$s9: _matherr(): %s in %s(%g, %g) (retval=%g)
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.14.unpack	JoeSecurity_ficker_stealer	Yara detected Ficker Stealer	Joe Security
15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.14.unpack	MALWARE_Win_Ficker	Detects Ficker infostealer	ditekSHen	0x36fd5:$s1: JNOde\ 0x37abc:$s2: "SomeNone 0x37b00:$s3: kindmessage 0x37d37:$s5: ..\\?\.\UNC\Windows stdio in console mode does not support writing non-UTF-8 byte sequences 0x37f79:$s7: (os error other os erroroperation interruptedwrite zerotimed 0x3818c:$s9: _matherr(): %s in %s(%g, %g) (retval=%g)
9.2.Opus.exe.5b04629.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost
9.2.Opus.exe.5b04629.6.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
9.2.Opus.exe.5b04629.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.2.Opus.exe.5b04629.6.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xb14f:$x2: NanoCore.ClientPlugin 0xb184:$x3: NanoCore.ClientPluginHost 0xb143:$i2: IClientData 0xb165:$i3: IClientNetwork 0xb174:$i5: IClientDataHost 0xb19e:$i6: IClientLoggingHost 0xb1b1:$i7: IClientNetworkHost 0xb1c4:$i8: IClientUIHost 0xb1d2:$i9: IClientNameObjectCollection 0xb1ee:$i10: IClientReadOnlyNameObjectCollection 0xaf41:$s1: ClientPlugin 0xb158:$s1: ClientPlugin 0x10179:$s6: get_ClientSettings
15.2.0fd7de5367376231a788872005d7ed4f.exe.400000.0.unpack	JoeSecurity_ficker_stealer	Yara detected Ficker Stealer	Joe Security
15.2.0fd7de5367376231a788872005d7ed4f.exe.400000.0.unpack	MALWARE_Win_Ficker	Detects Ficker infostealer	ditekSHen	0x36fd5:$s1: JNOde\ 0x37abc:$s2: "SomeNone 0x37b00:$s3: kindmessage 0x37d37:$s5: ..\\?\.\UNC\Windows stdio in console mode does not support writing non-UTF-8 byte sequences 0x37f79:$s7: (os error other os erroroperation interruptedwrite zerotimed 0x3818c:$s9: _matherr(): %s in %s(%g, %g) (retval=%g)
0.0.RIP_YOUR_PC_LOL.exe.9f86e6.3.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x754d1:$key: HawkEyeKeylogger 0x7770d:$salt: 099u787978786 0x75b0a:$string1: HawkEye_Keylogger 0x7695d:$string1: HawkEye_Keylogger 0x7766d:$string1: HawkEye_Keylogger 0x75ef3:$string2: holdermail.txt 0x75f13:$string2: holdermail.txt 0x75e35:$string3: wallet.dat 0x75e4d:$string3: wallet.dat 0x75e63:$string3: wallet.dat 0x7724f:$string4: Keylog Records 0x77567:$string4: Keylog Records 0x77765:$string5: do not script --> 0x754b9:$string6: \pidloc.txt 0x7551f:$string7: BSPLIT 0x7552f:$string7: BSPLIT
0.0.RIP_YOUR_PC_LOL.exe.9f86e6.3.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
0.0.RIP_YOUR_PC_LOL.exe.9f86e6.3.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.9f86e6.3.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.9f86e6.3.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.9f86e6.3.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b62:$hawkstr1: HawkEye Keylogger 0x769a3:$hawkstr1: HawkEye Keylogger 0x76cd2:$hawkstr1: HawkEye Keylogger 0x76e2d:$hawkstr1: HawkEye Keylogger 0x76f90:$hawkstr1: HawkEye Keylogger 0x77227:$hawkstr1: HawkEye Keylogger 0x756f0:$hawkstr2: Dear HawkEye Customers! 0x76d25:$hawkstr2: Dear HawkEye Customers! 0x76e7c:$hawkstr2: Dear HawkEye Customers! 0x76fe3:$hawkstr2: Dear HawkEye Customers! 0x75811:$hawkstr3: HawkEye Logger Details:
0.3.RIP_YOUR_PC_LOL.exe.59c8085.4.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.3.RIP_YOUR_PC_LOL.exe.59c8085.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x9702f:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
7.2.0fd7de5367376231a788872005d7ed4f.exe.24f15a0.1.unpack	JoeSecurity_ficker_stealer	Yara detected Ficker Stealer	Joe Security
7.2.0fd7de5367376231a788872005d7ed4f.exe.24f15a0.1.unpack	MALWARE_Win_Ficker	Detects Ficker infostealer	ditekSHen	0x360bc:$s2: "SomeNone 0x36100:$s3: kindmessage 0x36337:$s5: ..\\?\.\UNC\Windows stdio in console mode does not support writing non-UTF-8 byte sequences 0x36579:$s7: (os error other os erroroperation interruptedwrite zerotimed 0x3678c:$s9: _matherr(): %s in %s(%g, %g) (retval=%g)
5.2.Pluto Panel.exe.46b1030.7.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x79ad9:$key: HawkEyeKeylogger 0x7bd15:$salt: 099u787978786 0x7a112:$string1: HawkEye_Keylogger 0x7af65:$string1: HawkEye_Keylogger 0x7bc75:$string1: HawkEye_Keylogger 0x7a4fb:$string2: holdermail.txt 0x7a51b:$string2: holdermail.txt 0x7a43d:$string3: wallet.dat 0x7a455:$string3: wallet.dat 0x7a46b:$string3: wallet.dat 0x7b857:$string4: Keylog Records 0x7bb6f:$string4: Keylog Records 0x7bd6d:$string5: do not script --> 0x79ac1:$string6: \pidloc.txt 0x79b27:$string7: BSPLIT 0x79b37:$string7: BSPLIT
0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x5623:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7a16a:$hawkstr1: HawkEye Keylogger 0x7afab:$hawkstr1: HawkEye Keylogger 0x7b2da:$hawkstr1: HawkEye Keylogger 0x7b435:$hawkstr1: HawkEye Keylogger 0x7b598:$hawkstr1: HawkEye Keylogger 0x7b82f:$hawkstr1: HawkEye Keylogger 0x79cf8:$hawkstr2: Dear HawkEye Customers! 0x7b32d:$hawkstr2: Dear HawkEye Customers! 0x7b484:$hawkstr2: Dear HawkEye Customers! 0x7b5eb:$hawkstr2: Dear HawkEye Customers! 0x79e19:$hawkstr3: HawkEye Logger Details:
17.0.mediaget.exe.ab0000.2.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
17.0.mediaget.exe.ab0000.2.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
17.0.mediaget.exe.ab0000.2.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
8.0.gay.exe.d0000.3.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
8.0.gay.exe.d0000.3.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
8.0.gay.exe.d0000.3.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
4.0.healastounding.exe.902324.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
4.0.healastounding.exe.902324.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
4.0.healastounding.exe.902324.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.0.healastounding.exe.902324.6.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe0f5:$x1: NanoCore Client 0xe105:$x1: NanoCore Client 0xe34d:$x2: NanoCore.ClientPlugin 0xe38d:$x3: NanoCore.ClientPluginHost 0xe342:$i1: IClientApp 0xe363:$i2: IClientData 0xe36f:$i3: IClientNetwork 0xe37e:$i4: IClientAppHost 0xe3a7:$i5: IClientDataHost 0xe3b7:$i6: IClientLoggingHost 0xe3ca:$i7: IClientNetworkHost 0xe3dd:$i8: IClientUIHost 0xe3eb:$i9: IClientNameObjectCollection 0xe407:$i10: IClientReadOnlyNameObjectCollection 0xe154:$s1: ClientPlugin 0xe356:$s1: ClientPlugin 0xe84a:$s2: EndPoint 0xe853:$s3: IPAddress 0xe85d:$s4: IPEndPoint 0x10293:$s6: get_ClientSettings 0x10837:$s7: get_Connected
4.0.healastounding.exe.902324.6.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
9.0.Opus.exe.840000.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.0.Opus.exe.840000.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
9.0.Opus.exe.840000.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.0.Opus.exe.840000.2.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
9.0.Opus.exe.840000.2.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
4.2.healastounding.exe.3479694.5.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.healastounding.exe.3479694.5.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x7bf3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
5.0.Pluto Panel.exe.f18208.14.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x754d1:$key: HawkEyeKeylogger 0x7770d:$salt: 099u787978786 0x75b0a:$string1: HawkEye_Keylogger 0x7695d:$string1: HawkEye_Keylogger 0x7766d:$string1: HawkEye_Keylogger 0x75ef3:$string2: holdermail.txt 0x75f13:$string2: holdermail.txt 0x75e35:$string3: wallet.dat 0x75e4d:$string3: wallet.dat 0x75e63:$string3: wallet.dat 0x7724f:$string4: Keylog Records 0x77567:$string4: Keylog Records 0x77765:$string5: do not script --> 0x754b9:$string6: \pidloc.txt 0x7551f:$string7: BSPLIT 0x7552f:$string7: BSPLIT
5.0.Pluto Panel.exe.f18208.14.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
5.0.Pluto Panel.exe.f18208.14.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.0.Pluto Panel.exe.f18208.14.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.0.Pluto Panel.exe.f18208.14.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.0.Pluto Panel.exe.f18208.14.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b62:$hawkstr1: HawkEye Keylogger 0x769a3:$hawkstr1: HawkEye Keylogger 0x76cd2:$hawkstr1: HawkEye Keylogger 0x76e2d:$hawkstr1: HawkEye Keylogger 0x76f90:$hawkstr1: HawkEye Keylogger 0x77227:$hawkstr1: HawkEye Keylogger 0x756f0:$hawkstr2: Dear HawkEye Customers! 0x76d25:$hawkstr2: Dear HawkEye Customers! 0x76e7c:$hawkstr2: Dear HawkEye Customers! 0x76fe3:$hawkstr2: Dear HawkEye Customers! 0x75811:$hawkstr3: HawkEye Logger Details:
4.0.healastounding.exe.902324.14.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
4.0.healastounding.exe.902324.14.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
4.0.healastounding.exe.902324.14.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.0.healastounding.exe.902324.14.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe0f5:$x1: NanoCore Client 0xe105:$x1: NanoCore Client 0xe34d:$x2: NanoCore.ClientPlugin 0xe38d:$x3: NanoCore.ClientPluginHost 0xe342:$i1: IClientApp 0xe363:$i2: IClientData 0xe36f:$i3: IClientNetwork 0xe37e:$i4: IClientAppHost 0xe3a7:$i5: IClientDataHost 0xe3b7:$i6: IClientLoggingHost 0xe3ca:$i7: IClientNetworkHost 0xe3dd:$i8: IClientUIHost 0xe3eb:$i9: IClientNameObjectCollection 0xe407:$i10: IClientReadOnlyNameObjectCollection 0xe154:$s1: ClientPlugin 0xe356:$s1: ClientPlugin 0xe84a:$s2: EndPoint 0xe853:$s3: IPAddress 0xe85d:$s4: IPEndPoint 0x10293:$s6: get_ClientSettings 0x10837:$s7: get_Connected
4.0.healastounding.exe.902324.14.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
6.0.test.exe.da0000.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
6.0.test.exe.da0000.1.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99f3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
4.0.healastounding.exe.95312e.13.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.0.healastounding.exe.95312e.13.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.0.healastounding.exe.95312e.13.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
4.0.healastounding.exe.95312e.13.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x339b0c:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
0.2.RIP_YOUR_PC_LOL.exe.9f86e6.1.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x754d1:$key: HawkEyeKeylogger 0x7770d:$salt: 099u787978786 0x75b0a:$string1: HawkEye_Keylogger 0x7695d:$string1: HawkEye_Keylogger 0x7766d:$string1: HawkEye_Keylogger 0x75ef3:$string2: holdermail.txt 0x75f13:$string2: holdermail.txt 0x75e35:$string3: wallet.dat 0x75e4d:$string3: wallet.dat 0x75e63:$string3: wallet.dat 0x7724f:$string4: Keylog Records 0x77567:$string4: Keylog Records 0x77765:$string5: do not script --> 0x754b9:$string6: \pidloc.txt 0x7551f:$string7: BSPLIT 0x7552f:$string7: BSPLIT
0.2.RIP_YOUR_PC_LOL.exe.9f86e6.1.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
0.2.RIP_YOUR_PC_LOL.exe.9f86e6.1.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.9f86e6.1.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.9f86e6.1.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.9f86e6.1.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b62:$hawkstr1: HawkEye Keylogger 0x769a3:$hawkstr1: HawkEye Keylogger 0x76cd2:$hawkstr1: HawkEye Keylogger 0x76e2d:$hawkstr1: HawkEye Keylogger 0x76f90:$hawkstr1: HawkEye Keylogger 0x77227:$hawkstr1: HawkEye Keylogger 0x756f0:$hawkstr2: Dear HawkEye Customers! 0x76d25:$hawkstr2: Dear HawkEye Customers! 0x76e7c:$hawkstr2: Dear HawkEye Customers! 0x76fe3:$hawkstr2: Dear HawkEye Customers! 0x75811:$hawkstr3: HawkEye Logger Details:
0.3.RIP_YOUR_PC_LOL.exe.5725596.2.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.3.RIP_YOUR_PC_LOL.exe.5725596.2.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
0.3.RIP_YOUR_PC_LOL.exe.5725596.2.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
4.0.healastounding.exe.900000.12.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x106b1:$x1: NanoCore.ClientPluginHost 0x106ee:$x2: IClientNetworkHost 0x14221:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
4.0.healastounding.exe.900000.12.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.0.healastounding.exe.900000.12.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.0.healastounding.exe.900000.12.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.0.healastounding.exe.900000.12.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x5952a:$s1: netsh firewall delete allowedprogram 0x59420:$s2: netsh firewall add allowedprogram 0x5958a:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x59214:$s4: Execute ERROR 0x59274:$s4: Execute ERROR 0x59238:$s5: Download ERROR 0x595d0:$s6: [kl]
4.0.healastounding.exe.900000.12.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x10419:$x1: NanoCore Client 0x10429:$x1: NanoCore Client 0x10671:$x2: NanoCore.ClientPlugin 0x106b1:$x3: NanoCore.ClientPluginHost 0x10666:$i1: IClientApp 0x10687:$i2: IClientData 0x10693:$i3: IClientNetwork 0x106a2:$i4: IClientAppHost 0x106cb:$i5: IClientDataHost 0x106db:$i6: IClientLoggingHost 0x106ee:$i7: IClientNetworkHost 0x10701:$i8: IClientUIHost 0x1070f:$i9: IClientNameObjectCollection 0x1072b:$i10: IClientReadOnlyNameObjectCollection 0x10478:$s1: ClientPlugin 0x1067a:$s1: ClientPlugin 0x10b6e:$s2: EndPoint 0x57a2c:$s2: EndPoint 0x10b77:$s3: IPAddress 0x579f6:$s3: IPAddress 0x3886ca:$s3: IPAddress
4.0.healastounding.exe.900000.12.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10419:$a: NanoCore 0x10429:$a: NanoCore 0x1065d:$a: NanoCore 0x10671:$a: NanoCore 0x106b1:$a: NanoCore 0x10478:$b: ClientPlugin 0x1067a:$b: ClientPlugin 0x106ba:$b: ClientPlugin 0x1059f:$c: ProjectData 0x57601:$c: ProjectData 0x10fa6:$d: DESCrypto 0x18972:$e: KeepAlive 0x38722e:$e: KeepAlive 0x387948:$e: KeepAlive 0x387956:$e: KeepAlive 0x3887ff:$e: KeepAlive 0x16960:$g: LogClientMessage 0x12b5b:$i: get_Connected 0x3871b1:$i: get_Connected 0x112dc:$j: #=q 0x1130c:$j: #=q
4.0.healastounding.exe.900000.12.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x59420:$a1: netsh firewall add allowedprogram 0x5961a:$b1: [TAP] 0x595c0:$b2: & exit 0x38ae3a:$b2: & exit 0x5958c:$c1: md.exe /k ping 0 & del
4.0.healastounding.exe.935129.9.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.0.healastounding.exe.935129.9.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.0.healastounding.exe.935129.9.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x26201:$s1: netsh firewall delete allowedprogram 0x260f7:$s2: netsh firewall add allowedprogram 0x26261:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x25eeb:$s4: Execute ERROR 0x25f4b:$s4: Execute ERROR 0x25f0f:$s5: Download ERROR 0x262a7:$s6: [kl]
4.0.healastounding.exe.935129.9.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x260f7:$a1: netsh firewall add allowedprogram 0x262f1:$b1: [TAP] 0x26297:$b2: & exit 0x357b11:$b2: & exit 0x26263:$c1: md.exe /k ping 0 & del
0.3.RIP_YOUR_PC_LOL.exe.596a627.9.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.3.RIP_YOUR_PC_LOL.exe.596a627.9.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xca541:$s1: blackmoon 0xca581:$s2: BlackMoon RunTime Error:
0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x106b1:$x1: NanoCore.ClientPluginHost 0x106ee:$x2: IClientNetworkHost 0x14221:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x5952a:$s1: netsh firewall delete allowedprogram 0x59420:$s2: netsh firewall add allowedprogram 0x5958a:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x59214:$s4: Execute ERROR 0x59274:$s4: Execute ERROR 0x59238:$s5: Download ERROR 0x595d0:$s6: [kl]
0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x10419:$x1: NanoCore Client 0x10429:$x1: NanoCore Client 0x10671:$x2: NanoCore.ClientPlugin 0x106b1:$x3: NanoCore.ClientPluginHost 0x10666:$i1: IClientApp 0x10687:$i2: IClientData 0x10693:$i3: IClientNetwork 0x106a2:$i4: IClientAppHost 0x106cb:$i5: IClientDataHost 0x106db:$i6: IClientLoggingHost 0x106ee:$i7: IClientNetworkHost 0x10701:$i8: IClientUIHost 0x1070f:$i9: IClientNameObjectCollection 0x1072b:$i10: IClientReadOnlyNameObjectCollection 0x10478:$s1: ClientPlugin 0x1067a:$s1: ClientPlugin 0x10b6e:$s2: EndPoint 0x57a2c:$s2: EndPoint 0x10b77:$s3: IPAddress 0x579f6:$s3: IPAddress 0x10b81:$s4: IPEndPoint
0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10419:$a: NanoCore 0x10429:$a: NanoCore 0x1065d:$a: NanoCore 0x10671:$a: NanoCore 0x106b1:$a: NanoCore 0x10478:$b: ClientPlugin 0x1067a:$b: ClientPlugin 0x106ba:$b: ClientPlugin 0x1059f:$c: ProjectData 0x57601:$c: ProjectData 0x10fa6:$d: DESCrypto 0x18972:$e: KeepAlive 0x16960:$g: LogClientMessage 0x12b5b:$i: get_Connected 0x112dc:$j: #=q 0x1130c:$j: #=q 0x11328:$j: #=q 0x11358:$j: #=q 0x11374:$j: #=q 0x11390:$j: #=q 0x113c0:$j: #=q
0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x59420:$a1: netsh firewall add allowedprogram 0x5961a:$b1: [TAP] 0x595c0:$b2: & exit 0x5958c:$c1: md.exe /k ping 0 & del
0.1.RIP_YOUR_PC_LOL.exe.c8867b.3.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xca541:$s1: blackmoon 0xca581:$s2: BlackMoon RunTime Error:
0.1.RIP_YOUR_PC_LOL.exe.9f86e6.0.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x754d1:$key: HawkEyeKeylogger 0x7770d:$salt: 099u787978786 0x75b0a:$string1: HawkEye_Keylogger 0x7695d:$string1: HawkEye_Keylogger 0x7766d:$string1: HawkEye_Keylogger 0x75ef3:$string2: holdermail.txt 0x75f13:$string2: holdermail.txt 0x75e35:$string3: wallet.dat 0x75e4d:$string3: wallet.dat 0x75e63:$string3: wallet.dat 0x7724f:$string4: Keylog Records 0x77567:$string4: Keylog Records 0x77765:$string5: do not script --> 0x754b9:$string6: \pidloc.txt 0x7551f:$string7: BSPLIT 0x7552f:$string7: BSPLIT
0.1.RIP_YOUR_PC_LOL.exe.9f86e6.0.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
0.1.RIP_YOUR_PC_LOL.exe.9f86e6.0.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.1.RIP_YOUR_PC_LOL.exe.9f86e6.0.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0.1.RIP_YOUR_PC_LOL.exe.9f86e6.0.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0.1.RIP_YOUR_PC_LOL.exe.9f86e6.0.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b62:$hawkstr1: HawkEye Keylogger 0x769a3:$hawkstr1: HawkEye Keylogger 0x76cd2:$hawkstr1: HawkEye Keylogger 0x76e2d:$hawkstr1: HawkEye Keylogger 0x76f90:$hawkstr1: HawkEye Keylogger 0x77227:$hawkstr1: HawkEye Keylogger 0x756f0:$hawkstr2: Dear HawkEye Customers! 0x76d25:$hawkstr2: Dear HawkEye Customers! 0x76e7c:$hawkstr2: Dear HawkEye Customers! 0x76fe3:$hawkstr2: Dear HawkEye Customers! 0x75811:$hawkstr3: HawkEye Logger Details:
0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe8b1:$x1: NanoCore.ClientPluginHost 0xe8ee:$x2: IClientNetworkHost 0x12421:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x5772a:$s1: netsh firewall delete allowedprogram 0x57620:$s2: netsh firewall add allowedprogram 0x5778a:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x57414:$s4: Execute ERROR 0x57474:$s4: Execute ERROR 0x57438:$s5: Download ERROR 0x577d0:$s6: [kl]
0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe619:$x1: NanoCore Client 0xe629:$x1: NanoCore Client 0xe871:$x2: NanoCore.ClientPlugin 0xe8b1:$x3: NanoCore.ClientPluginHost 0xe866:$i1: IClientApp 0xe887:$i2: IClientData 0xe893:$i3: IClientNetwork 0xe8a2:$i4: IClientAppHost 0xe8cb:$i5: IClientDataHost 0xe8db:$i6: IClientLoggingHost 0xe8ee:$i7: IClientNetworkHost 0xe901:$i8: IClientUIHost 0xe90f:$i9: IClientNameObjectCollection 0xe92b:$i10: IClientReadOnlyNameObjectCollection 0xe678:$s1: ClientPlugin 0xe87a:$s1: ClientPlugin 0xed6e:$s2: EndPoint 0x55c2c:$s2: EndPoint 0xed77:$s3: IPAddress 0x55bf6:$s3: IPAddress 0x3868ca:$s3: IPAddress
0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe619:$a: NanoCore 0xe629:$a: NanoCore 0xe85d:$a: NanoCore 0xe871:$a: NanoCore 0xe8b1:$a: NanoCore 0xe678:$b: ClientPlugin 0xe87a:$b: ClientPlugin 0xe8ba:$b: ClientPlugin 0xe79f:$c: ProjectData 0x55801:$c: ProjectData 0xf1a6:$d: DESCrypto 0x16b72:$e: KeepAlive 0x38542e:$e: KeepAlive 0x385b48:$e: KeepAlive 0x385b56:$e: KeepAlive 0x3869ff:$e: KeepAlive 0x14b60:$g: LogClientMessage 0x10d5b:$i: get_Connected 0x3853b1:$i: get_Connected 0xf4dc:$j: #=q 0xf50c:$j: #=q
0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x57620:$a1: netsh firewall add allowedprogram 0x5781a:$b1: [TAP] 0x577c0:$b2: & exit 0x38903a:$b2: & exit 0x5778c:$c1: md.exe /k ping 0 & del
4.0.healastounding.exe.902324.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
4.0.healastounding.exe.902324.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.0.healastounding.exe.902324.3.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.0.healastounding.exe.902324.3.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.0.healastounding.exe.902324.3.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x59006:$s1: netsh firewall delete allowedprogram 0x58efc:$s2: netsh firewall add allowedprogram 0x59066:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x58cf0:$s4: Execute ERROR 0x58d50:$s4: Execute ERROR 0x58d14:$s5: Download ERROR 0x590ac:$s6: [kl]
4.0.healastounding.exe.902324.3.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x57508:$s2: EndPoint 0x10653:$s3: IPAddress 0x574d2:$s3: IPAddress 0x3881a6:$s3: IPAddress
4.0.healastounding.exe.902324.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x570dd:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x386d0a:$e: KeepAlive 0x387424:$e: KeepAlive 0x387432:$e: KeepAlive 0x3882db:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x386c8d:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q
4.0.healastounding.exe.902324.3.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x58efc:$a1: netsh firewall add allowedprogram 0x590f6:$b1: [TAP] 0x5909c:$b2: & exit 0x38a916:$b2: & exit 0x59068:$c1: md.exe /k ping 0 & del
0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe8b1:$x1: NanoCore.ClientPluginHost 0xe8ee:$x2: IClientNetworkHost 0x12421:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x5772a:$s1: netsh firewall delete allowedprogram 0x57620:$s2: netsh firewall add allowedprogram 0x5778a:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x57414:$s4: Execute ERROR 0x57474:$s4: Execute ERROR 0x57438:$s5: Download ERROR 0x577d0:$s6: [kl]
0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe619:$x1: NanoCore Client 0xe629:$x1: NanoCore Client 0xe871:$x2: NanoCore.ClientPlugin 0xe8b1:$x3: NanoCore.ClientPluginHost 0xe866:$i1: IClientApp 0xe887:$i2: IClientData 0xe893:$i3: IClientNetwork 0xe8a2:$i4: IClientAppHost 0xe8cb:$i5: IClientDataHost 0xe8db:$i6: IClientLoggingHost 0xe8ee:$i7: IClientNetworkHost 0xe901:$i8: IClientUIHost 0xe90f:$i9: IClientNameObjectCollection 0xe92b:$i10: IClientReadOnlyNameObjectCollection 0xe678:$s1: ClientPlugin 0xe87a:$s1: ClientPlugin 0xed6e:$s2: EndPoint 0x55c2c:$s2: EndPoint 0xed77:$s3: IPAddress 0x55bf6:$s3: IPAddress 0x3868ca:$s3: IPAddress
0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe619:$a: NanoCore 0xe629:$a: NanoCore 0xe85d:$a: NanoCore 0xe871:$a: NanoCore 0xe8b1:$a: NanoCore 0xe678:$b: ClientPlugin 0xe87a:$b: ClientPlugin 0xe8ba:$b: ClientPlugin 0xe79f:$c: ProjectData 0x55801:$c: ProjectData 0xf1a6:$d: DESCrypto 0x16b72:$e: KeepAlive 0x38542e:$e: KeepAlive 0x385b48:$e: KeepAlive 0x385b56:$e: KeepAlive 0x3869ff:$e: KeepAlive 0x14b60:$g: LogClientMessage 0x10d5b:$i: get_Connected 0x3853b1:$i: get_Connected 0xf4dc:$j: #=q 0xf50c:$j: #=q
0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x57620:$a1: netsh firewall add allowedprogram 0x5781a:$b1: [TAP] 0x577c0:$b2: & exit 0x38903a:$b2: & exit 0x5778c:$c1: md.exe /k ping 0 & del
11.0.22.exe.530edf.4.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xca541:$s1: blackmoon 0xca581:$s2: BlackMoon RunTime Error:
4.0.healastounding.exe.95312e.2.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.0.healastounding.exe.95312e.2.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.0.healastounding.exe.95312e.2.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
4.0.healastounding.exe.95312e.2.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x339b0c:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
4.0.healastounding.exe.900000.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x106b1:$x1: NanoCore.ClientPluginHost 0x106ee:$x2: IClientNetworkHost 0x14221:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
4.0.healastounding.exe.900000.8.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.0.healastounding.exe.900000.8.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.0.healastounding.exe.900000.8.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
4.0.healastounding.exe.900000.8.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x5952a:$s1: netsh firewall delete allowedprogram 0x59420:$s2: netsh firewall add allowedprogram 0x5958a:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x59214:$s4: Execute ERROR 0x59274:$s4: Execute ERROR 0x59238:$s5: Download ERROR 0x595d0:$s6: [kl]
4.0.healastounding.exe.900000.8.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x10419:$x1: NanoCore Client 0x10429:$x1: NanoCore Client 0x10671:$x2: NanoCore.ClientPlugin 0x106b1:$x3: NanoCore.ClientPluginHost 0x10666:$i1: IClientApp 0x10687:$i2: IClientData 0x10693:$i3: IClientNetwork 0x106a2:$i4: IClientAppHost 0x106cb:$i5: IClientDataHost 0x106db:$i6: IClientLoggingHost 0x106ee:$i7: IClientNetworkHost 0x10701:$i8: IClientUIHost 0x1070f:$i9: IClientNameObjectCollection 0x1072b:$i10: IClientReadOnlyNameObjectCollection 0x10478:$s1: ClientPlugin 0x1067a:$s1: ClientPlugin 0x10b6e:$s2: EndPoint 0x57a2c:$s2: EndPoint 0x10b77:$s3: IPAddress 0x579f6:$s3: IPAddress 0x3886ca:$s3: IPAddress
4.0.healastounding.exe.900000.8.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10419:$a: NanoCore 0x10429:$a: NanoCore 0x1065d:$a: NanoCore 0x10671:$a: NanoCore 0x106b1:$a: NanoCore 0x10478:$b: ClientPlugin 0x1067a:$b: ClientPlugin 0x106ba:$b: ClientPlugin 0x1059f:$c: ProjectData 0x57601:$c: ProjectData 0x10fa6:$d: DESCrypto 0x18972:$e: KeepAlive 0x38722e:$e: KeepAlive 0x387948:$e: KeepAlive 0x387956:$e: KeepAlive 0x3887ff:$e: KeepAlive 0x16960:$g: LogClientMessage 0x12b5b:$i: get_Connected 0x3871b1:$i: get_Connected 0x112dc:$j: #=q 0x1130c:$j: #=q
4.0.healastounding.exe.900000.8.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x59420:$a1: netsh firewall add allowedprogram 0x5961a:$b1: [TAP] 0x595c0:$b2: & exit 0x38ae3a:$b2: & exit 0x5958c:$c1: md.exe /k ping 0 & del
5.2.Pluto Panel.exe.3706aac.5.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe526f4:$x1: NanoCore.ClientPluginHost 0xe52731:$x2: IClientNetworkHost 0xe56264:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0xe9b56d:$s1: netsh firewall delete allowedprogram 0xe9b463:$s2: netsh firewall add allowedprogram 0xe9b5cd:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0xe9b257:$s4: Execute ERROR 0xe9b2b7:$s4: Execute ERROR 0xe9b27b:$s5: Download ERROR 0xe9b613:$s6: [kl]
0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe5245c:$x1: NanoCore Client 0xe5246c:$x1: NanoCore Client 0xe526b4:$x2: NanoCore.ClientPlugin 0xe526f4:$x3: NanoCore.ClientPluginHost 0xe526a9:$i1: IClientApp 0xe526ca:$i2: IClientData 0xe526d6:$i3: IClientNetwork 0xe526e5:$i4: IClientAppHost 0xe5270e:$i5: IClientDataHost 0xe5271e:$i6: IClientLoggingHost 0xe52731:$i7: IClientNetworkHost 0xe52744:$i8: IClientUIHost 0xe52752:$i9: IClientNameObjectCollection 0xe5276e:$i10: IClientReadOnlyNameObjectCollection 0xe524bb:$s1: ClientPlugin 0xe526bd:$s1: ClientPlugin 0xe52bb1:$s2: EndPoint 0xe99a6f:$s2: EndPoint 0xe52bba:$s3: IPAddress 0xe99a39:$s3: IPAddress 0x11ca70d:$s3: IPAddress
0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe5245c:$a: NanoCore 0xe5246c:$a: NanoCore 0xe526a0:$a: NanoCore 0xe526b4:$a: NanoCore 0xe526f4:$a: NanoCore 0xe524bb:$b: ClientPlugin 0xe526bd:$b: ClientPlugin 0xe526fd:$b: ClientPlugin 0xe525e2:$c: ProjectData 0xe99644:$c: ProjectData 0xe52fe9:$d: DESCrypto 0xe5a9b5:$e: KeepAlive 0x11c9271:$e: KeepAlive 0x11c998b:$e: KeepAlive 0x11c9999:$e: KeepAlive 0x11ca842:$e: KeepAlive 0xe589a3:$g: LogClientMessage 0xe54b9e:$i: get_Connected 0x11c91f4:$i: get_Connected 0x2fcc0e:$j: #=q 0x77d864:$j: #=q
0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0xe9b463:$a1: netsh firewall add allowedprogram 0xe9b65d:$b1: [TAP] 0xe9b603:$b2: & exit 0x11cce7d:$b2: & exit 0xe9b5cf:$c1: md.exe /k ping 0 & del
0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe526f4:$x1: NanoCore.ClientPluginHost 0xe52731:$x2: IClientNetworkHost 0xe56264:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0xe9b56d:$s1: netsh firewall delete allowedprogram 0xe9b463:$s2: netsh firewall add allowedprogram 0xe9b5cd:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0xe9b257:$s4: Execute ERROR 0xe9b2b7:$s4: Execute ERROR 0xe9b27b:$s5: Download ERROR 0xe9b613:$s6: [kl]
0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe5245c:$x1: NanoCore Client 0xe5246c:$x1: NanoCore Client 0xe526b4:$x2: NanoCore.ClientPlugin 0xe526f4:$x3: NanoCore.ClientPluginHost 0xe526a9:$i1: IClientApp 0xe526ca:$i2: IClientData 0xe526d6:$i3: IClientNetwork 0xe526e5:$i4: IClientAppHost 0xe5270e:$i5: IClientDataHost 0xe5271e:$i6: IClientLoggingHost 0xe52731:$i7: IClientNetworkHost 0xe52744:$i8: IClientUIHost 0xe52752:$i9: IClientNameObjectCollection 0xe5276e:$i10: IClientReadOnlyNameObjectCollection 0xe524bb:$s1: ClientPlugin 0xe526bd:$s1: ClientPlugin 0xe52bb1:$s2: EndPoint 0xe99a6f:$s2: EndPoint 0xe52bba:$s3: IPAddress 0xe99a39:$s3: IPAddress 0x11ca70d:$s3: IPAddress
0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe5245c:$a: NanoCore 0xe5246c:$a: NanoCore 0xe526a0:$a: NanoCore 0xe526b4:$a: NanoCore 0xe526f4:$a: NanoCore 0xe524bb:$b: ClientPlugin 0xe526bd:$b: ClientPlugin 0xe526fd:$b: ClientPlugin 0xe525e2:$c: ProjectData 0xe99644:$c: ProjectData 0xe52fe9:$d: DESCrypto 0xe5a9b5:$e: KeepAlive 0x11c9271:$e: KeepAlive 0x11c998b:$e: KeepAlive 0x11c9999:$e: KeepAlive 0x11ca842:$e: KeepAlive 0xe589a3:$g: LogClientMessage 0xe54b9e:$i: get_Connected 0x11c91f4:$i: get_Connected 0x2fcc0e:$j: #=q 0x77d864:$j: #=q
0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0xe9b463:$a1: netsh firewall add allowedprogram 0xe9b65d:$b1: [TAP] 0xe9b603:$b2: & exit 0x11cce7d:$b2: & exit 0xe9b5cf:$c1: md.exe /k ping 0 & del
Click to see the 661 entries

Sigma Signatures

AV Detection

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\Opus.exe, ProcessId: 3244, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

E-Banking Fraud

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\Opus.exe, ProcessId: 3244, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

System Summary

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett: Data: Command: C:\Users\user\AppData\Local\Temp\\svchost.exe, CommandLine: C:\Users\user\AppData\Local\Temp\\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\svchost.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\svchost.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\___11.19.exe" , ParentImage: C:\Users\user\AppData\Roaming\___11.19.exe, ParentProcessId: 6732, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\\svchost.exe, ProcessId: 6552

Sigma detected: Suspicius Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth: Data: Command: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp4896.tmp, CommandLine: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp4896.tmp, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\Opus.exe" , ParentImage: C:\Users\user\AppData\Roaming\Opus.exe, ParentProcessId: 3244, ProcessCommandLine: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp4896.tmp, ProcessId: 6420

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth, Patrick Bareiss, Anton Kutepov, oscd.community: Data: Command: C:\Users\user\AppData\Local\Temp\\svchost.exe, CommandLine: C:\Users\user\AppData\Local\Temp\\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\svchost.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\svchost.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\___11.19.exe" , ParentImage: C:\Users\user\AppData\Roaming\___11.19.exe, ParentProcessId: 6732, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\\svchost.exe, ProcessId: 6552

Sigma detected: Suspicious Svchost Process

Source: Process started

Author: Florian Roth: Data: Command: C:\Users\user\AppData\Local\Temp\\svchost.exe, CommandLine: C:\Users\user\AppData\Local\Temp\\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\svchost.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\svchost.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\___11.19.exe" , ParentImage: C:\Users\user\AppData\Roaming\___11.19.exe, ParentProcessId: 6732, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\\svchost.exe, ProcessId: 6552

Sigma detected: File Created with System Process Name

Source: File created

Author: Sander Wiebing, Tim Shelton: Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\22.exe, ProcessId: 1272, TargetFilename: C:\Windows\Help\Winlogon.exe

Sigma detected: Suspicious Add Scheduled Task From User AppData Temp

Source: Process started

Author: frack113: Data: Command: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp4896.tmp, CommandLine: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp4896.tmp, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\Opus.exe" , ParentImage: C:\Users\user\AppData\Roaming\Opus.exe, ParentProcessId: 3244, ProcessCommandLine: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp4896.tmp, ProcessId: 6420

Source: Process started

Author: Markus Neis, Sander Wiebing: Data: Command: netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\mediaget.exe" "mediaget.exe" ENABLE, CommandLine: netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\mediaget.exe" "mediaget.exe" ENABLE, CommandLine|base64offset|contains: l, Image: C:\Windows\SysWOW64\netsh.exe, NewProcessName: C:\Windows\SysWOW64\netsh.exe, OriginalFileName: C:\Windows\SysWOW64\netsh.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\mediaget.exe" , ParentImage: C:\Users\user\AppData\Roaming\mediaget.exe, ParentProcessId: 4688, ProcessCommandLine: netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\mediaget.exe" "mediaget.exe" ENABLE, ProcessId: 7092

Source: DNS query

Author: Brandon George (blog post), Thomas Patzke (rule): Data: Image: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe, QueryName: api.ipify.org

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Roaming\mediaget.exe" .., EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\mediaget.exe, ProcessId: 4688, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\a797c6ca3f5e7aff8fa1149c47fe9466

Source: Process started

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\Opus.exe, ProcessId: 3244, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Monitor

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton: Data: Details: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\Opus.exe, ProcessId: 3244, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Monitor

Source: Process started

Author: frack113: Data: Command: C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\user\AppData\Local\Temp\svchost.exe > nul, CommandLine: C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\user\AppData\Local\Temp\svchost.exe > nul, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\\svchost.exe, ParentImage: C:\Users\user\AppData\Local\Temp\svchost.exe, ParentProcessId: 6552, ProcessCommandLine: C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\user\AppData\Local\Temp\svchost.exe > nul, ProcessId: 1852

Source: Process started

Author: vburov: Data: Command: C:\Users\user\AppData\Local\Temp\\svchost.exe, CommandLine: C:\Users\user\AppData\Local\Temp\\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\svchost.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\svchost.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\___11.19.exe" , ParentImage: C:\Users\user\AppData\Roaming\___11.19.exe, ParentProcessId: 6732, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\\svchost.exe, ProcessId: 6552

Source: Process started

Author: frack113: Data: Command: "C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe" , CommandLine: "C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe" , ParentImage: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe, ParentProcessId: 5376, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe" , ProcessId: 6920

Stealing of Sensitive Information

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\Opus.exe, ProcessId: 3244, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Remote Access Functionality

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\Opus.exe, ProcessId: 3244, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Roaming\Opus.exe	Avira: detection malicious, Label: TR/Dropper.MSIL.Gen7
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Roaming\___11.19.exe	Avira: detection malicious, Label: TR/Dropper.GR
Source: C:\Users\user\AppData\Roaming\___11.19.exe	Avira: detection malicious, Label: TR/Agent.aagt
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Avira: detection malicious, Label: TR/AD.RedLineSteal.cjshc
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Avira: detection malicious, Label: TR/Dropper.MSIL.Gen7
Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe	Avira: detection malicious, Label: TR/AD.MalwareCrypter.rrsdk
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Avira: detection malicious, Label: TR/Dropper.MSIL.Gen7
Source: C:\Windows\Help\active_desktop_render.dll	Avira: detection malicious, Label: HEUR/AGEN.1245024
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a797c6ca3f5e7aff8fa1149c47fe9466.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Roaming\gay.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\Dcvxaamev.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Roaming\22.exe	Avira: detection malicious, Label: HEUR/AGEN.1227810
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Avira: detection malicious, Label: TR/AD.MExecute.lzrac
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Avira: detection malicious, Label: SPR/Tool.MailPassView.473
Source: C:\Windows\Cursors\WUDFhosts.exe	Avira: detection malicious, Label: HEUR/AGEN.1213003
Source: C:\Users\user\AppData\Roaming\a.exe	Avira: detection malicious, Label: TR/AD.RedLineSteal.cjshc
Source: C:\Users\user\AppData\Roaming\3.exe	Avira: detection malicious, Label: HEUR/AGEN.1203070
Source: C:\Users\user\AppData\Roaming\test.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Roaming\aaa.exe	Avira: detection malicious, Label: TR/Dropper.MSIL.Gen

Yara detected Nanocore RAT

Source: Yara match	File source: RIP_YOUR_PC_LOL.exe, type: SAMPLE
Source: Yara match	File source: 9.2.Opus.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.Opus.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.5b00000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.4474268.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.5b00000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.4474268.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.Opus.exe.840000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.3edeacc.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.Opus.exe.840000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.3ed9c96.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.3edeacc.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.3ee30f5.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.902324.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.5b04629.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.Opus.exe.840000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000000.414257385.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.707363158.0000000003ECB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.414807841.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.416456851.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.700831183.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.475797127.0000000000572000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.567040014.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000000.491059532.0000000000272000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.629223400.0000000000572000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.415266906.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.579383399.0000000004081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.514866763.0000000000922000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.546334194.0000000004474000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.461250332.0000000000922000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.679442760.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.708751563.0000000005B00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.674377761.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.673042782.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: healastounding.exe PID: 3572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Opus.exe PID: 3244, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Opus.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\healastounding.exe, type: DROPPED

Multi AV Scanner detection for submitted file

Source: RIP_YOUR_PC_LOL.exe	Virustotal: Detection: 63%	Perma Link
Source: RIP_YOUR_PC_LOL.exe	Metadefender: Detection: 33%	Perma Link
Source: RIP_YOUR_PC_LOL.exe	ReversingLabs: Detection: 73%

Yara detected Njrat

Source: Yara match	File source: RIP_YOUR_PC_LOL.exe, type: SAMPLE
Source: Yara match	File source: 4.2.healastounding.exe.34865dc.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.gay.exe.d0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.gay.exe.d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1d1caed.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.3479694.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.mediaget.exe.ab0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.mediaget.exe.ab0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.95312e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.3474284.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.mediaget.exe.ab0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.gay.exe.d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.gay.exe.d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.34865dc.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1d1caed.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.mediaget.exe.ab0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.5707591.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.mediaget.exe.ab0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.gay.exe.d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.5725596.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.411478373.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.449565052.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000000.507357595.0000000000FB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.445953483.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.701265514.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000003B.00000000.627731740.00000000007A2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000000.548907669.0000000000722000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.445251023.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.610238464.0000000000722000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.552899490.0000000000FB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.410285813.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.408615715.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.447375879.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.386628983.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.446671445.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.409570794.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.679442760.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: healastounding.exe PID: 3572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gay.exe PID: 1104, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mediaget.exe PID: 4688, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\gay.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a797c6ca3f5e7aff8fa1149c47fe9466.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\mediaget.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\healastounding.exe, type: DROPPED

Antivirus / Scanner detection for submitted sample

Source: RIP_YOUR_PC_LOL.exe	Avira: detected
Source: RIP_YOUR_PC_LOL.exe	Avira: detected
Source: RIP_YOUR_PC_LOL.exe	Avira: detected
Source: RIP_YOUR_PC_LOL.exe	Avira: detected
Source: RIP_YOUR_PC_LOL.exe	Avira: detected
Source: RIP_YOUR_PC_LOL.exe	Avira: detected
Source: RIP_YOUR_PC_LOL.exe	Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Metadefender: Detection: 85%	Perma Link
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Local\Temp\Dcvxaamev.exe	Metadefender: Detection: 29%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\Dcvxaamev.exe	ReversingLabs: Detection: 85%
Source: C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe	Metadefender: Detection: 29%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe	ReversingLabs: Detection: 85%
Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe	Metadefender: Detection: 29%	Perma Link
Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe	ReversingLabs: Detection: 92%
Source: C:\Users\user\AppData\Roaming\22.exe	Metadefender: Detection: 38%	Perma Link
Source: C:\Users\user\AppData\Roaming\22.exe	ReversingLabs: Detection: 85%
Source: C:\Users\user\AppData\Roaming\3.exe	Metadefender: Detection: 47%	Perma Link
Source: C:\Users\user\AppData\Roaming\3.exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Roaming\4.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	Metadefender: Detection: 26%	Perma Link
Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	ReversingLabs: Detection: 85%

Machine Learning detection for sample

Source: RIP_YOUR_PC_LOL.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Opus.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\___11.19.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Joe Sandbox ML: detected
Source: C:\Windows\Help\active_desktop_render.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a797c6ca3f5e7aff8fa1149c47fe9466.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\gay.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Dcvxaamev.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\22.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Joe Sandbox ML: detected
Source: C:\Windows\Cursors\WUDFhosts.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\a.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\test.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\aaa.exe	Joe Sandbox ML: detected

Source: 9.2.Opus.exe.840000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 14.0.8f1c8b40c7be588389a8d382040b23bb.exe.476f20.4.unpack	Avira: Label: TR/Dropper.Gen
Source: 4.0.healastounding.exe.900000.4.unpack	Avira: Label: TR/AD.RedLineSteal.cjshc
Source: 4.0.healastounding.exe.900000.4.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 5.0.Pluto Panel.exe.f10000.8.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 5.0.Pluto Panel.exe.f10000.8.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 9.0.Opus.exe.840000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 5.2.Pluto Panel.exe.f10000.0.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 5.2.Pluto Panel.exe.f10000.0.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 14.0.8f1c8b40c7be588389a8d382040b23bb.exe.4bdf52.2.unpack	Avira: Label: TR/Dropper.Gen
Source: 12.2.aaa.exe.2c0000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 8.0.gay.exe.d0000.2.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 12.0.aaa.exe.2c0000.2.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 0.3.RIP_YOUR_PC_LOL.exe.57b3478.6.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.RIP_YOUR_PC_LOL.exe.5755c99.18.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 11.0.22.exe.457136.14.unpack	Avira: Label: TR/Crypt.XPACK.Gen7
Source: 0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack	Avira: Label: TR/Inject.vcoldi
Source: 14.0.8f1c8b40c7be588389a8d382040b23bb.exe.400000.3.unpack	Avira: Label: TR/Dropper.Gen
Source: 6.2.test.exe.da0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 8.2.gay.exe.d0000.0.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 12.0.aaa.exe.2c0000.1.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 4.2.healastounding.exe.900000.0.unpack	Avira: Label: TR/AD.RedLineSteal.cjshc
Source: 4.2.healastounding.exe.900000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 14.0.8f1c8b40c7be588389a8d382040b23bb.exe.476f20.1.unpack	Avira: Label: TR/Dropper.Gen
Source: 4.0.healastounding.exe.900000.0.unpack	Avira: Label: TR/AD.RedLineSteal.cjshc
Source: 4.0.healastounding.exe.900000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 14.0.8f1c8b40c7be588389a8d382040b23bb.exe.400000.6.unpack	Avira: Label: TR/Dropper.Gen
Source: 9.2.Opus.exe.5b00000.7.unpack	Avira: Label: TR/NanoCore.fadte
Source: 14.0.8f1c8b40c7be588389a8d382040b23bb.exe.4bdf52.5.unpack	Avira: Label: TR/Dropper.Gen
Source: 11.0.22.exe.457136.21.unpack	Avira: Label: TR/Crypt.XPACK.Gen7
Source: 0.1.RIP_YOUR_PC_LOL.exe.dda1e2.6.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 14.0.8f1c8b40c7be588389a8d382040b23bb.exe.400000.9.unpack	Avira: Label: TR/Dropper.Gen
Source: 0.2.RIP_YOUR_PC_LOL.exe.e387f7.8.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 6.0.test.exe.da0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 17.0.mediaget.exe.ab0000.3.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 0.2.RIP_YOUR_PC_LOL.exe.d587a1.7.unpack	Avira: Label: TR/Crypt.XPACK.Gen7
Source: 17.0.mediaget.exe.ab0000.0.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 11.0.22.exe.457136.9.unpack	Avira: Label: TR/Crypt.XPACK.Gen7
Source: 9.0.Opus.exe.840000.3.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 14.0.8f1c8b40c7be588389a8d382040b23bb.exe.4bdf52.8.unpack	Avira: Label: TR/Dropper.Gen
Source: 14.0.8f1c8b40c7be588389a8d382040b23bb.exe.476f20.10.unpack	Avira: Label: TR/Dropper.Gen
Source: 0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack	Avira: Label: TR/Inject.vcoldi
Source: 17.2.mediaget.exe.ab0000.0.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 14.0.8f1c8b40c7be588389a8d382040b23bb.exe.476f20.7.unpack	Avira: Label: TR/Dropper.Gen
Source: 9.0.Opus.exe.840000.1.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 8.0.gay.exe.d0000.1.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 8.0.gay.exe.d0000.0.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 11.0.22.exe.457136.3.unpack	Avira: Label: TR/Crypt.XPACK.Gen7
Source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 4.2.healastounding.exe.4582ffa.11.unpack	Avira: Label: TR/Dropper.Gen
Source: 0.0.RIP_YOUR_PC_LOL.exe.e387f7.8.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.0.RIP_YOUR_PC_LOL.exe.dda1e2.7.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 12.0.aaa.exe.2c0000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 0.2.RIP_YOUR_PC_LOL.exe.56d4258.19.unpack	Avira: Label: TR/Crypt.XPACK.Gen7
Source: 17.0.mediaget.exe.ab0000.1.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 0.1.RIP_YOUR_PC_LOL.exe.d587a1.5.unpack	Avira: Label: TR/Crypt.XPACK.Gen7
Source: 0.2.RIP_YOUR_PC_LOL.exe.dda1e2.6.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 4.0.healastounding.exe.900000.12.unpack	Avira: Label: TR/AD.RedLineSteal.cjshc
Source: 4.0.healastounding.exe.900000.12.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 0.3.RIP_YOUR_PC_LOL.exe.5956fd2.3.unpack	Avira: Label: TR/Dropper.Gen
Source: 6.0.test.exe.da0000.2.unpack	Avira: Label: TR/Dropper.Gen
Source: 5.0.Pluto Panel.exe.f10000.4.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 5.0.Pluto Panel.exe.f10000.4.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 0.0.RIP_YOUR_PC_LOL.exe.d587a1.6.unpack	Avira: Label: TR/Crypt.XPACK.Gen7
Source: 5.0.Pluto Panel.exe.f10000.12.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 5.0.Pluto Panel.exe.f10000.12.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 5.0.Pluto Panel.exe.f10000.0.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 5.0.Pluto Panel.exe.f10000.0.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 6.0.test.exe.da0000.3.unpack	Avira: Label: TR/Dropper.Gen
Source: 0.2.RIP_YOUR_PC_LOL.exe.5821276.21.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.1.RIP_YOUR_PC_LOL.exe.e387f7.7.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.0.RIP_YOUR_PC_LOL.exe.1f6c52e.15.unpack	Avira: Label: TR/Dropper.Gen
Source: 0.2.RIP_YOUR_PC_LOL.exe.1f6c52e.15.unpack	Avira: Label: TR/Dropper.Gen
Source: 12.0.aaa.exe.2c0000.3.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.unpack	Avira: Label: TR/Inject.vcoldi
Source: 7.2.0fd7de5367376231a788872005d7ed4f.exe.24f15a0.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 14.0.8f1c8b40c7be588389a8d382040b23bb.exe.4bdf52.11.unpack	Avira: Label: TR/Dropper.Gen
Source: 0.1.RIP_YOUR_PC_LOL.exe.ea57bf.8.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 14.0.8f1c8b40c7be588389a8d382040b23bb.exe.400000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 4.2.healastounding.exe.44c50a8.8.unpack	Avira: Label: TR/Dropper.Gen
Source: 0.2.RIP_YOUR_PC_LOL.exe.57b42ae.20.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 17.0.mediaget.exe.ab0000.2.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 9.0.Opus.exe.840000.2.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 8.0.gay.exe.d0000.3.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 4.0.healastounding.exe.900000.8.unpack	Avira: Label: TR/AD.RedLineSteal.cjshc
Source: 4.0.healastounding.exe.900000.8.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 6.0.test.exe.da0000.1.unpack	Avira: Label: TR/Dropper.Gen
Source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: RIP_YOUR_PC_LOL.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Source: RIP_YOUR_PC_LOL.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.374606826.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.388952115.00000000059C7000.00000004.00000800.00020000.00000000.sdmp, healastounding.exe, healastounding.exe, 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, 4.exe, 00000010.00000000.446983407.0000000001203000.00000002.00000001.01000000.0000000E.sdmp, 4.exe, 00000010.00000002.519990989.0000000001203000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\buildbot\slave1\desktop_screen\build\bin\active_desktop_launcher.pdb source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 22.exe, 0000000B.00000000.422804028.000000000042B000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\nutideyebibede\soy\gebetugito\meliyo zodoz.pdb source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 0fd7de5367376231a788872005d7ed4f.exe, 00000007.00000000.407475822.000000000041E000.00000002.00000001.01000000.00000008.sdmp, 0fd7de5367376231a788872005d7ed4f.exe, 00000007.00000002.465903756.000000000041E000.00000002.00000001.01000000.00000008.sdmp, 0fd7de5367376231a788872005d7ed4f.exe, 0000000F.00000000.436842136.000000000041E000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: ]C:\nutideyebibede\soy\gebetugito\meliyo zodoz.pdb source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 0fd7de5367376231a788872005d7ed4f.exe, 00000007.00000000.407475822.000000000041E000.00000002.00000001.01000000.00000008.sdmp, 0fd7de5367376231a788872005d7ed4f.exe, 00000007.00000002.465903756.000000000041E000.00000002.00000001.01000000.00000008.sdmp, 0fd7de5367376231a788872005d7ed4f.exe, 0000000F.00000000.436842136.000000000041E000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, Pluto Panel.exe, Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Pluto Panel.exe, 00000005.00000002.710948269.0000000003B3A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.712472379.0000000007710000.00000004.00000001.00040000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.705753147.0000000003691000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.706244077.0000000003705000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: f:\Projects\VS2005\mailpv\Release\mailpv.pdb source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, Pluto Panel.exe, 00000005.00000002.711210574.0000000004691000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, Pluto Panel.exe, 00000005.00000002.711210574.0000000004691000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp

Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: healastounding.exe	Binary or memory string: autorun.inf
Source: healastounding.exe	Binary or memory string: [autorun]
Source: healastounding.exe, 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: autorun.inf
Source: healastounding.exe, 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: [autorun]
Source: healastounding.exe, 00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: healastounding.exe, 00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Pluto Panel.exe	Binary or memory string: [autorun]
Source: Pluto Panel.exe	Binary or memory string: autorun.inf
Source: Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: autorun.inf
Source: Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: [autorun]
Source: gay.exe	Binary or memory string: autorun.inf
Source: gay.exe	Binary or memory string: [autorun]
Source: gay.exe, 00000008.00000000.411478373.00000000000D2000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: autorun.inf
Source: gay.exe, 00000008.00000000.411478373.00000000000D2000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: [autorun]
Source: gay.exe, 00000008.00000002.451519757.0000000002744000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: gay.exe, 00000008.00000002.451519757.0000000002744000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: mediaget.exe, 00000011.00000000.445953483.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: autorun.inf
Source: mediaget.exe, 00000011.00000000.445953483.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: [autorun]
Source: mediaget.exe, 00000011.00000003.646152049.0000000001338000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: mediaget.exe, 00000011.00000003.646152049.0000000001338000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: mediaget.exe, 00000011.00000002.704209643.00000000032B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: mediaget.exe, 00000011.00000002.704209643.00000000032B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]

Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 4x nop then lea esp, dword ptr [ebp-0Ch]
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 4x nop then lea esp, dword ptr [ebp-0Ch]
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 4x nop then call 03201B20h
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 4x nop then lea esp, dword ptr [ebp-0Ch]
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 4x nop then lea esp, dword ptr [ebp-0Ch]
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 4x nop then jmp 03201A73h
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 4x nop then jmp 03201A73h
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 4x nop then lea esp, dword ptr [ebp-0Ch]
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 4x nop then lea esp, dword ptr [ebp-0Ch]
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 4x nop then call 03201B20h
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 4x nop then lea esp, dword ptr [ebp-0Ch]
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 4x nop then call 03201B20h
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 4x nop then lea esp, dword ptr [ebp-0Ch]
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 4x nop then mov esp, ebp
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 4x nop then lea esp, dword ptr [ebp-0Ch]
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 4x nop then lea esp, dword ptr [ebp-0Ch]
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 4x nop then lea esp, dword ptr [ebp-0Ch]
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 4x nop then lea esp, dword ptr [ebp-0Ch]
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 4x nop then lea esp, dword ptr [ebp-0Ch]
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 4x nop then lea esp, dword ptr [ebp-0Ch]

Networking

Performs DNS queries to domains with low reputation

Source:

DNS query: yabynennet.xyz

May check the online IP address of the machine

Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com

Uses dynamic DNS services

Source: unknown

DNS query: name: gfhhjgh.duckdns.org

Source: global traffic

HTTP traffic detected: GET /?format=xml HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	TCP traffic: 192.168.2.6:49768 -> 179.13.1.253:8050
Source: global traffic	TCP traffic: 192.168.2.6:49774 -> 41.249.51.34:1470

Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.711210574.0000000004691000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
Source: Pluto Panel.exe, 00000005.00000002.712709095.0000000008430000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 22.exe, 0000000B.00000000.422804028.000000000042B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.711210574.0000000004691000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 22.exe, 0000000B.00000000.422804028.000000000042B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 22.exe, 0000000B.00000000.422804028.000000000042B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 22.exe, 0000000B.00000000.422804028.000000000042B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: healastounding.exe	String found in binary or memory: http://schemas.microsof
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 22.exe, 0000000B.00000000.422804028.000000000042B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 22.exe, 0000000B.00000000.422804028.000000000042B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 22.exe, 0000000B.00000000.422804028.000000000042B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 22.exe, 0000000B.00000000.422804028.000000000042B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 22.exe, 0000000B.00000000.422804028.000000000042B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 22.exe, 0000000B.00000000.422804028.000000000042B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: Pluto Panel.exe, 00000005.00000002.705753147.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://whatismyipaddress.com
Source: Pluto Panel.exe, Pluto Panel.exe, 00000005.00000002.705753147.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://whatismyipaddress.com/
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://whatismyipaddress.com/-
Source: Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Pluto Panel.exe, 00000005.00000003.462837238.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.463380932.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.461983546.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460984251.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: Pluto Panel.exe, 00000005.00000003.445443819.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437487558.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.439099390.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437239432.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.436798009.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437773657.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437023378.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.440045453.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.441297022.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.439790741.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.442021245.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.438069908.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.445694166.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.445564416.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.441503544.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.441818008.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.445818252.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: Pluto Panel.exe, 00000005.00000003.436798009.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437023378.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com.
Source: Pluto Panel.exe, 00000005.00000003.437487558.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437239432.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437023378.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comTC
Source: Pluto Panel.exe, 00000005.00000003.440045453.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.441297022.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comY
Source: Pluto Panel.exe, 00000005.00000003.442021245.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.441503544.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.441818008.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comkC
Source: Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Pluto Panel.exe, 00000005.00000003.439099390.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.439790741.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.438069908.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.como.W
Source: Pluto Panel.exe, 00000005.00000003.437023378.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comt
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: Pluto Panel.exe, 00000005.00000003.620876949.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.645268957.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.630356431.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.585753311.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.593605825.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.539432667.0000000005C5C000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.561809650.0000000005C54000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.570284939.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.578609523.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Pluto Panel.exe, 00000005.00000003.620876949.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.645268957.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.630356431.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.585753311.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.593605825.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/C
Source: Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Pluto Panel.exe, 00000005.00000003.569553799.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Pluto Panel.exe, 00000005.00000003.569553799.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlf
Source: Pluto Panel.exe, 00000005.00000003.546333465.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.537131070.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.588600543.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.556315402.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.580567393.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.570425092.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.541181738.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.551450060.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.573427389.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.569553799.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Pluto Panel.exe, 00000005.00000003.585753311.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersh
Source: Pluto Panel.exe, 00000005.00000003.645268957.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.539432667.0000000005C5C000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.561809650.0000000005C54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: Pluto Panel.exe, 00000005.00000003.539432667.0000000005C5C000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.561809650.0000000005C54000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.570284939.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comFX
Source: Pluto Panel.exe, 00000005.00000002.711887980.0000000005C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: Pluto Panel.exe, 00000005.00000003.539432667.0000000005C5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comd
Source: Pluto Panel.exe, 00000005.00000003.539432667.0000000005C5C000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.561809650.0000000005C54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comd&
Source: Pluto Panel.exe, 00000005.00000003.585753311.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.593605825.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.578609523.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comitu
Source: Pluto Panel.exe, 00000005.00000003.620876949.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.645268957.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.630356431.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.585753311.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.593605825.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comlicd
Source: Pluto Panel.exe, 00000005.00000003.570284939.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comn
Source: Pluto Panel.exe, 00000005.00000002.711887980.0000000005C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comoX
Source: Pluto Panel.exe, 00000005.00000003.539432667.0000000005C5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comonyn
Source: Pluto Panel.exe, 00000005.00000003.645268957.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comrsiv
Source: Pluto Panel.exe, 00000005.00000003.539432667.0000000005C5C000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.561809650.0000000005C54000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.570284939.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comsiv/C
Source: Pluto Panel.exe, 00000005.00000003.570284939.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comtu
Source: Pluto Panel.exe, 00000005.00000003.413764911.0000000005C85000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.413943860.0000000005C85000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.413057625.0000000005C85000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.413330512.0000000005C85000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Pluto Panel.exe, 00000005.00000003.413330512.0000000005C85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comC
Source: Pluto Panel.exe, 00000005.00000003.431908494.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.432587858.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.433071734.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Pluto Panel.exe, 00000005.00000003.431908494.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn$
Source: Pluto Panel.exe, 00000005.00000003.434083509.0000000005C7E000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.433444494.0000000005C7E000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.432944886.0000000005C7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: Pluto Panel.exe, 00000005.00000003.434083509.0000000005C7E000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.434485944.0000000005C7E000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.433444494.0000000005C7E000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.434712918.0000000005C7F000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.432944886.0000000005C7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/)
Source: Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Pluto Panel.exe, 00000005.00000003.433444494.0000000005C7E000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.432459781.0000000005C7F000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.432944886.0000000005C7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnT
Source: Pluto Panel.exe, 00000005.00000003.431908494.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cncz
Source: Pluto Panel.exe, 00000005.00000003.431908494.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cncz$
Source: Pluto Panel.exe, 00000005.00000003.431908494.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnv
Source: Pluto Panel.exe, 00000005.00000003.431908494.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cp
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.367521899.0000000000E31000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000002.696610265.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.freeeim.com/D
Source: Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Pluto Panel.exe, 00000005.00000003.423909901.0000000005C85000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.425696650.0000000005C85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.i.
Source: Pluto Panel.exe, 00000005.00000003.462837238.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.466345951.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.459485550.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.469643417.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457715522.0000000005C56000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.463380932.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.466752175.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460010944.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.464082407.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.452001254.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457092303.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.465692163.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.467819425.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.461983546.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.464883846.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460984251.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.467392892.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Pluto Panel.exe, 00000005.00000003.448193641.0000000005C53000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457715522.0000000005C56000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.452001254.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457092303.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/)
Source: Pluto Panel.exe, 00000005.00000003.448193641.0000000005C53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/J
Source: Pluto Panel.exe, 00000005.00000003.459485550.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457715522.0000000005C56000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460010944.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.452001254.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457092303.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.461983546.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460984251.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Q
Source: Pluto Panel.exe, 00000005.00000003.448193641.0000000005C53000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.459485550.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460010944.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.452001254.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.461983546.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460984251.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/X
Source: Pluto Panel.exe, 00000005.00000003.452001254.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/eu-e
Source: Pluto Panel.exe, 00000005.00000003.459485550.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457715522.0000000005C56000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460010944.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457092303.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.461983546.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460984251.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/g
Source: Pluto Panel.exe, 00000005.00000003.448193641.0000000005C53000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.452001254.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/i
Source: Pluto Panel.exe, 00000005.00000003.462837238.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.459485550.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457715522.0000000005C56000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.463380932.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460010944.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.464082407.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457092303.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.461983546.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.464883846.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460984251.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: Pluto Panel.exe, 00000005.00000003.459485550.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460010944.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.461983546.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460984251.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/)
Source: Pluto Panel.exe, 00000005.00000003.459485550.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457715522.0000000005C56000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.452001254.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457092303.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/C
Source: Pluto Panel.exe, 00000005.00000003.459485550.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457715522.0000000005C56000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.452001254.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457092303.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/J
Source: Pluto Panel.exe, 00000005.00000003.457715522.0000000005C56000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457092303.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/X
Source: Pluto Panel.exe, 00000005.00000003.448193641.0000000005C53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/ls
Source: Pluto Panel.exe, 00000005.00000003.448193641.0000000005C53000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.462837238.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.459485550.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457715522.0000000005C56000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.463380932.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460010944.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.464082407.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.452001254.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457092303.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.461983546.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.464883846.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460984251.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/n
Source: Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.nirsoft.net/
Source: Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Pluto Panel.exe, 00000005.00000003.461983546.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Pluto Panel.exe, 00000005.00000003.461535327.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.462539198.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.comm
Source: Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Pluto Panel.exe, 00000005.00000002.705753147.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.site.com/logs.php
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 22.exe, 0000000B.00000000.422804028.000000000042B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 22.exe, 0000000B.00000000.422804028.000000000042B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Pluto Panel.exe, 00000005.00000003.434485944.0000000005C7E000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.434712918.0000000005C7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com&
Source: Pluto Panel.exe, 00000005.00000003.445903668.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com=
Source: Pluto Panel.exe, 00000005.00000003.445903668.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.comic
Source: Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Pluto Panel.exe, 00000005.00000003.646787103.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.494373371.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.493190429.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.497114575.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.de
Source: Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Pluto Panel.exe, 00000005.00000003.646787103.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deMTq
Source: Pluto Panel.exe, 00000005.00000003.494373371.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.493190429.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.497114575.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deR
Source: Pluto Panel.exe, 00000005.00000003.646787103.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deg
Source: Pluto Panel.exe, 00000005.00000003.494373371.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.493190429.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.497114575.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.derasg
Source: Pluto Panel.exe, 00000005.00000003.437773657.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.438069908.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.co
Source: Pluto Panel.exe, 00000005.00000003.437487558.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437239432.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.436798009.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.436695339.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437023378.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Pluto Panel.exe, 00000005.00000003.437487558.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.439099390.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437239432.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.436798009.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.436695339.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437773657.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437023378.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.439790741.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.438069908.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnY
Source: Pluto Panel.exe, 00000005.00000003.436695339.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnm
Source: Pluto Panel.exe, 00000005.00000003.437487558.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437239432.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.436798009.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.436695339.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437023378.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cno.
Source: Pluto Panel.exe, 00000005.00000003.437487558.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437239432.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.436798009.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.436695339.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437773657.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437023378.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cno.W
Source: Pluto Panel.exe, 00000005.00000003.437487558.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437239432.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.436798009.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.436695339.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437023378.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnts
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 22.exe, 0000000B.00000000.422804028.000000000042B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 22.exe, 0000000B.00000000.422804028.000000000042B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: healastounding.exe, healastounding.exe, 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, healastounding.exe, 00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp, gay.exe, gay.exe, 00000008.00000000.411478373.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, mediaget.exe, 00000011.00000000.445953483.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, mediaget.exe, 00000011.00000003.646152049.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0
Source: Pluto Panel.exe	String found in binary or memory: https://login.yahoo.com/config/login
Source: Pluto Panel.exe, 00000005.00000002.705753147.0000000003691000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.706003291.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://whatismyipaddress.com/
Source: Pluto Panel.exe, 00000005.00000002.706003291.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://whatismyipaddress.comx&
Source: Pluto Panel.exe, 00000005.00000002.706003291.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: Pluto Panel.exe	String found in binary or memory: https://www.google.com/accounts/servicelogin

Source: unknown

DNS traffic detected: queries for: store-images.s-microsoft.com

Source: global traffic

Source: unknown	TCP traffic detected without corresponding DNS query: 80.87.192.115
Source: unknown	TCP traffic detected without corresponding DNS query: 80.87.192.115
Source: unknown	TCP traffic detected without corresponding DNS query: 172.98.92.42
Source: unknown	TCP traffic detected without corresponding DNS query: 172.98.92.42
Source: unknown	TCP traffic detected without corresponding DNS query: 172.98.92.42
Source: unknown	TCP traffic detected without corresponding DNS query: 172.98.92.42
Source: unknown	TCP traffic detected without corresponding DNS query: 172.98.92.42
Source: unknown	TCP traffic detected without corresponding DNS query: 172.98.92.42
Source: unknown	TCP traffic detected without corresponding DNS query: 80.87.192.115
Source: unknown	TCP traffic detected without corresponding DNS query: 172.98.92.42
Source: unknown	TCP traffic detected without corresponding DNS query: 172.98.92.42
Source: unknown	TCP traffic detected without corresponding DNS query: 172.98.92.42
Source: unknown	TCP traffic detected without corresponding DNS query: 172.98.92.42
Source: unknown	TCP traffic detected without corresponding DNS query: 172.98.92.42
Source: unknown	TCP traffic detected without corresponding DNS query: 172.98.92.42
Source: unknown	TCP traffic detected without corresponding DNS query: 172.98.92.42
Source: unknown	TCP traffic detected without corresponding DNS query: 172.98.92.42
Source: unknown	TCP traffic detected without corresponding DNS query: 172.98.92.42
Source: unknown	TCP traffic detected without corresponding DNS query: 172.98.92.42
Source: unknown	TCP traffic detected without corresponding DNS query: 172.98.92.42
Source: unknown	TCP traffic detected without corresponding DNS query: 172.98.92.42

Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.711210574.0000000004691000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.711210574.0000000004691000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
Source: Pluto Panel.exe	String found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected HawkEye Keylogger

Source: Yara match	File source: RIP_YOUR_PC_LOL.exe, type: SAMPLE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f10000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.f6fa72.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.f10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.f18208.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.f19c0d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f18208.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f6fa72.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f18208.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.1.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f18208.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f6fa72.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f6fa72.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f6fa72.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f10000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.5731eca.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f10000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.9f86e6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f18208.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.9f86e6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.1.RIP_YOUR_PC_LOL.exe.9f86e6.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.706080641.00000000036DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.394040229.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.394636472.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.701277187.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.502131214.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000001.375725825.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.397247474.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RIP_YOUR_PC_LOL.exe PID: 6880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Pluto Panel.exe PID: 4236, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Pluto Panel.exe, type: DROPPED

Yara detected AsyncRAT

Source: Yara match	File source: RIP_YOUR_PC_LOL.exe, type: SAMPLE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.206ac1d.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.5a556c1.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.test.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1f6c52e.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1f6c52e.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.3479694.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.test.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1fdd5e1.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.5a556c1.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.3474284.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.test.exe.da0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.206ac1d.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1fdd5e1.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.test.exe.da0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.206ac1d.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.206ac1d.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.59c8085.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.3479694.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.test.exe.da0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.596a627.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.397644420.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.388952115.00000000059C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.374606826.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.693319449.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.405813841.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.394727625.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.399704980.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.701012196.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RIP_YOUR_PC_LOL.exe PID: 6880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: healastounding.exe PID: 3572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: test.exe PID: 6236, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\test.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\healastounding.exe, type: DROPPED

Contains functionality to log keystrokes (.Net Source)

Source: Pluto Panel.exe.0.dr, Form1.cs	.Net Code: HookKeyboard
Source: gay.exe.4.dr, kl.cs	.Net Code: VKCodeToUnicode
Source: 5.0.Pluto Panel.exe.f10000.8.unpack, Form1.cs	.Net Code: HookKeyboard
Source: 5.2.Pluto Panel.exe.f10000.0.unpack, Form1.cs	.Net Code: HookKeyboard
Source: 5.0.Pluto Panel.exe.f10000.4.unpack, Form1.cs	.Net Code: HookKeyboard
Source: 5.0.Pluto Panel.exe.f10000.12.unpack, Form1.cs	.Net Code: HookKeyboard

Source: Opus.exe, 00000009.00000002.701598795.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: Opus.exe, 00000009.00000002.707363158.0000000003ECB000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud

Yara detected Nanocore RAT

Source: Yara match	File source: RIP_YOUR_PC_LOL.exe, type: SAMPLE
Source: Yara match	File source: 9.2.Opus.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.Opus.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.5b00000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.4474268.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.5b00000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.4474268.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.Opus.exe.840000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.3edeacc.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.Opus.exe.840000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.3ed9c96.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.3edeacc.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.3ee30f5.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.902324.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.5b04629.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.Opus.exe.840000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000000.414257385.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.707363158.0000000003ECB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.414807841.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.416456851.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.700831183.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.475797127.0000000000572000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.567040014.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000000.491059532.0000000000272000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.629223400.0000000000572000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.415266906.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.579383399.0000000004081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.514866763.0000000000922000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.546334194.0000000004474000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.461250332.0000000000922000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.679442760.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.708751563.0000000005B00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.674377761.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.673042782.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: healastounding.exe PID: 3572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Opus.exe PID: 3244, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Opus.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\healastounding.exe, type: DROPPED

Yara detected Njrat

Source: Yara match	File source: RIP_YOUR_PC_LOL.exe, type: SAMPLE
Source: Yara match	File source: 4.2.healastounding.exe.34865dc.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.gay.exe.d0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.gay.exe.d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1d1caed.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.3479694.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.mediaget.exe.ab0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.mediaget.exe.ab0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.95312e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.3474284.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.mediaget.exe.ab0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.gay.exe.d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.gay.exe.d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.34865dc.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1d1caed.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.mediaget.exe.ab0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.5707591.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.mediaget.exe.ab0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.gay.exe.d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.5725596.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.411478373.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.449565052.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000000.507357595.0000000000FB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.445953483.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.701265514.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000003B.00000000.627731740.00000000007A2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000000.548907669.0000000000722000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.445251023.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.610238464.0000000000722000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.552899490.0000000000FB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.410285813.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.408615715.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.447375879.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.386628983.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.446671445.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.409570794.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.679442760.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: healastounding.exe PID: 3572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gay.exe PID: 1104, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mediaget.exe PID: 4688, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\gay.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a797c6ca3f5e7aff8fa1149c47fe9466.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\mediaget.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\healastounding.exe, type: DROPPED

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\AppData\Roaming\mediaget.exe

Process information set: 01 00 00 00

System Summary

Malicious sample detected (through community Yara rule)

Source: RIP_YOUR_PC_LOL.exe, type: SAMPLE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: RIP_YOUR_PC_LOL.exe, type: SAMPLE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: RIP_YOUR_PC_LOL.exe, type: SAMPLE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: RIP_YOUR_PC_LOL.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: RIP_YOUR_PC_LOL.exe, type: SAMPLE	Matched rule: Detects NanoCore Author: ditekSHen
Source: RIP_YOUR_PC_LOL.exe, type: SAMPLE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: RIP_YOUR_PC_LOL.exe, type: SAMPLE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: RIP_YOUR_PC_LOL.exe, type: SAMPLE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.RIP_YOUR_PC_LOL.exe.206ac1d.13.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.RIP_YOUR_PC_LOL.exe.d4dd52.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.3.RIP_YOUR_PC_LOL.exe.5a556c1.5.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 9.2.Opus.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.Opus.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 9.2.Opus.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.0.Opus.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.0.Opus.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 9.0.Opus.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.2.healastounding.exe.34865dc.7.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.2.healastounding.exe.34865dc.7.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 8.0.gay.exe.d0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 8.0.gay.exe.d0000.2.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.0.RIP_YOUR_PC_LOL.exe.c8867b.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 11.0.22.exe.5f65b6.17.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.0.Pluto Panel.exe.f10000.8.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.0.Pluto Panel.exe.f10000.8.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.Pluto Panel.exe.f6fa72.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.2.Pluto Panel.exe.f6fa72.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.Pluto Panel.exe.f10000.0.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.2.Pluto Panel.exe.f10000.0.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 9.2.Opus.exe.5b00000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.Opus.exe.5b00000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 5.2.Pluto Panel.exe.f18208.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.2.Pluto Panel.exe.f18208.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.test.exe.da0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects Ficker infostealer Author: ditekSHen
Source: 8.2.gay.exe.d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 8.2.gay.exe.d0000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 7.2.0fd7de5367376231a788872005d7ed4f.exe.24f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Ficker infostealer Author: ditekSHen
Source: 0.2.RIP_YOUR_PC_LOL.exe.1f6c52e.15.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 5.2.Pluto Panel.exe.f19c0d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.2.Pluto Panel.exe.f19c0d.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.healastounding.exe.4474268.10.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.2.healastounding.exe.4474268.10.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 4.2.healastounding.exe.4474268.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.0.RIP_YOUR_PC_LOL.exe.1f6c52e.15.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.RIP_YOUR_PC_LOL.exe.1d1caed.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.RIP_YOUR_PC_LOL.exe.1d1caed.10.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 9.2.Opus.exe.5b00000.7.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.Opus.exe.5b00000.7.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 4.2.healastounding.exe.3479694.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 4.2.healastounding.exe.3479694.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.2.healastounding.exe.3479694.5.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Detects Ficker infostealer Author: ditekSHen
Source: 4.0.healastounding.exe.902324.11.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.0.healastounding.exe.902324.11.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 4.0.healastounding.exe.902324.11.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.0.22.exe.5f65b6.23.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 11.0.22.exe.530edf.22.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 11.0.22.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 11.0.22.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 5.0.Pluto Panel.exe.f18208.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.0.Pluto Panel.exe.f18208.5.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.2.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detects Ficker infostealer Author: ditekSHen
Source: 6.0.test.exe.da0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 17.0.mediaget.exe.ab0000.3.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 17.0.mediaget.exe.ab0000.3.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 4.0.healastounding.exe.95312e.10.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.0.healastounding.exe.95312e.10.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 9.2.Opus.exe.2ea1844.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.Opus.exe.2ea1844.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 4.0.healastounding.exe.95312e.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.0.healastounding.exe.95312e.10.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 17.0.mediaget.exe.ab0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 17.0.mediaget.exe.ab0000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.0.RIP_YOUR_PC_LOL.exe.1fdd5e1.14.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.17.unpack, type: UNPACKEDPE	Matched rule: Detects Ficker infostealer Author: ditekSHen
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects Ficker infostealer Author: ditekSHen
Source: 0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 11.0.22.exe.5f65b6.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 4.0.healastounding.exe.900000.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.0.healastounding.exe.900000.4.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.0.healastounding.exe.900000.4.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 4.0.healastounding.exe.900000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.0.healastounding.exe.900000.4.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 4.2.healastounding.exe.4474268.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.2.healastounding.exe.4474268.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 4.2.healastounding.exe.4474268.10.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.3.RIP_YOUR_PC_LOL.exe.5a556c1.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 9.0.Opus.exe.840000.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.0.Opus.exe.840000.3.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 9.0.Opus.exe.840000.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.0.Pluto Panel.exe.f19c0d.15.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.0.Pluto Panel.exe.f19c0d.15.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.15.unpack, type: UNPACKEDPE	Matched rule: Detects Ficker infostealer Author: ditekSHen
Source: 0.3.RIP_YOUR_PC_LOL.exe.596a627.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 11.0.22.exe.43de6f.19.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 11.0.22.exe.530edf.16.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 4.2.healastounding.exe.95312e.2.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.2.healastounding.exe.95312e.2.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 11.0.22.exe.43de6f.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 4.2.healastounding.exe.3474284.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 4.2.healastounding.exe.3474284.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.2.healastounding.exe.3474284.6.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 4.0.healastounding.exe.902324.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.0.healastounding.exe.902324.14.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.0.healastounding.exe.902324.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.0.healastounding.exe.902324.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 4.0.healastounding.exe.902324.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.0.healastounding.exe.902324.6.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 4.0.healastounding.exe.902324.14.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.0.healastounding.exe.902324.14.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 4.0.healastounding.exe.902324.14.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.0.healastounding.exe.902324.14.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 17.2.mediaget.exe.ab0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 17.2.mediaget.exe.ab0000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 11.0.22.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.0.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.0.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 9.2.Opus.exe.3edeacc.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.Opus.exe.3edeacc.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.RIP_YOUR_PC_LOL.exe.c8867b.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 4.0.healastounding.exe.935129.15.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.0.healastounding.exe.935129.15.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Detects Ficker infostealer Author: ditekSHen
Source: 11.0.22.exe.43de6f.13.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 4.0.healastounding.exe.902324.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.0.healastounding.exe.902324.3.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 4.0.healastounding.exe.902324.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 8.0.gay.exe.d0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 8.0.gay.exe.d0000.1.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 8.0.gay.exe.d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 8.0.gay.exe.d0000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 9.0.Opus.exe.840000.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.0.Opus.exe.840000.1.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 9.0.Opus.exe.840000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.0.22.exe.530edf.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 5.0.Pluto Panel.exe.f19c0d.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.0.Pluto Panel.exe.f19c0d.11.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.2.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 4.2.healastounding.exe.34865dc.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.2.healastounding.exe.34865dc.7.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 9.2.Opus.exe.5870000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.Opus.exe.5870000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 4.2.healastounding.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.2.healastounding.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.2.healastounding.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 4.2.healastounding.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.2.healastounding.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 5.0.Pluto Panel.exe.f6fa72.13.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.0.Pluto Panel.exe.f6fa72.13.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.Pluto Panel.exe.f18208.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.0.Pluto Panel.exe.f18208.10.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.RIP_YOUR_PC_LOL.exe.1d1caed.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.2.RIP_YOUR_PC_LOL.exe.1d1caed.10.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 4.0.healastounding.exe.902324.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.0.healastounding.exe.902324.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.0.healastounding.exe.902324.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 4.0.healastounding.exe.902324.11.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.0.healastounding.exe.902324.11.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 11.0.22.exe.5f65b6.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Detects Ficker infostealer Author: ditekSHen
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.16.unpack, type: UNPACKEDPE	Matched rule: Detects Ficker infostealer Author: ditekSHen
Source: 0.1.RIP_YOUR_PC_LOL.exe.d4dd52.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 4.0.healastounding.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.0.healastounding.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.0.healastounding.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 4.0.healastounding.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.0.healastounding.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 4.0.healastounding.exe.95312e.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.0.healastounding.exe.95312e.7.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: Detects Ficker infostealer Author: ditekSHen
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Detects Ficker infostealer Author: ditekSHen
Source: 9.2.Opus.exe.3ed9c96.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.Opus.exe.3ed9c96.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 9.2.Opus.exe.3ed9c96.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.0.RIP_YOUR_PC_LOL.exe.c8867b.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.1.RIP_YOUR_PC_LOL.exe.c8867b.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.1.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.1.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 4.0.healastounding.exe.95312e.2.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.0.healastounding.exe.95312e.2.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 9.2.Opus.exe.3edeacc.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.Opus.exe.3edeacc.3.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 9.2.Opus.exe.3ee30f5.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.Opus.exe.3ee30f5.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 4.0.healastounding.exe.95312e.7.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.0.healastounding.exe.95312e.7.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.2.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.2.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.2.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 4.2.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.2.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 5.0.Pluto Panel.exe.f18208.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.0.Pluto Panel.exe.f18208.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.Pluto Panel.exe.f6fa72.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.0.Pluto Panel.exe.f6fa72.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.Pluto Panel.exe.f6fa72.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.0.Pluto Panel.exe.f6fa72.9.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 17.0.mediaget.exe.ab0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 17.0.mediaget.exe.ab0000.1.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 11.0.22.exe.43de6f.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 4.0.healastounding.exe.95312e.13.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.0.healastounding.exe.95312e.13.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.18.unpack, type: UNPACKEDPE	Matched rule: Detects Ficker infostealer Author: ditekSHen
Source: 11.0.22.exe.400000.18.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.2.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.Pluto Panel.exe.f6fa72.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.0.Pluto Panel.exe.f6fa72.7.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 11.0.22.exe.530edf.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.3.RIP_YOUR_PC_LOL.exe.5839748.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 6.0.test.exe.da0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.RIP_YOUR_PC_LOL.exe.206ac1d.13.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 11.0.22.exe.530edf.22.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.2.RIP_YOUR_PC_LOL.exe.1fdd5e1.14.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 4.2.healastounding.exe.902324.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.2.healastounding.exe.902324.3.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 4.2.healastounding.exe.902324.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.0.RIP_YOUR_PC_LOL.exe.d4dd52.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.13.unpack, type: UNPACKEDPE	Matched rule: Detects Ficker infostealer Author: ditekSHen
Source: 0.2.RIP_YOUR_PC_LOL.exe.c8867b.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 11.0.22.exe.530edf.16.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 5.0.Pluto Panel.exe.f10000.4.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.0.Pluto Panel.exe.f10000.4.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.test.exe.da0000.3.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.3.RIP_YOUR_PC_LOL.exe.5731eca.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.3.RIP_YOUR_PC_LOL.exe.5731eca.7.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 0.3.RIP_YOUR_PC_LOL.exe.5707591.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.3.RIP_YOUR_PC_LOL.exe.5707591.1.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 4.0.healastounding.exe.935129.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.0.healastounding.exe.935129.5.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 5.0.Pluto Panel.exe.f10000.12.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.0.Pluto Panel.exe.f10000.12.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.RIP_YOUR_PC_LOL.exe.206ac1d.13.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detects Ficker infostealer Author: ditekSHen
Source: 5.0.Pluto Panel.exe.f19c0d.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.0.Pluto Panel.exe.f19c0d.6.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 0.3.RIP_YOUR_PC_LOL.exe.5a2fcfe.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.Pluto Panel.exe.f10000.0.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.0.Pluto Panel.exe.f10000.0.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 4.0.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.0.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.0.RIP_YOUR_PC_LOL.exe.206ac1d.13.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 5.0.Pluto Panel.exe.f19c0d.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.0.Pluto Panel.exe.f19c0d.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 11.0.22.exe.530edf.11.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.19.unpack, type: UNPACKEDPE	Matched rule: Detects Ficker infostealer Author: ditekSHen
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.14.unpack, type: UNPACKEDPE	Matched rule: Detects Ficker infostealer Author: ditekSHen
Source: 9.2.Opus.exe.5b04629.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.Opus.exe.5b04629.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 15.2.0fd7de5367376231a788872005d7ed4f.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Ficker infostealer Author: ditekSHen
Source: 0.0.RIP_YOUR_PC_LOL.exe.9f86e6.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.0.RIP_YOUR_PC_LOL.exe.9f86e6.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 0.3.RIP_YOUR_PC_LOL.exe.59c8085.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 7.2.0fd7de5367376231a788872005d7ed4f.exe.24f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects Ficker infostealer Author: ditekSHen
Source: 0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 17.0.mediaget.exe.ab0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 17.0.mediaget.exe.ab0000.2.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 8.0.gay.exe.d0000.3.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 8.0.gay.exe.d0000.3.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 4.0.healastounding.exe.902324.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.0.healastounding.exe.902324.6.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 4.0.healastounding.exe.902324.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.0.Opus.exe.840000.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.0.Opus.exe.840000.2.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 9.0.Opus.exe.840000.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.2.healastounding.exe.3479694.5.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 5.0.Pluto Panel.exe.f18208.14.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.0.Pluto Panel.exe.f18208.14.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 4.0.healastounding.exe.902324.14.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.0.healastounding.exe.902324.14.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 4.0.healastounding.exe.902324.14.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.0.test.exe.da0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 4.0.healastounding.exe.95312e.13.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.0.healastounding.exe.95312e.13.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.2.RIP_YOUR_PC_LOL.exe.9f86e6.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.RIP_YOUR_PC_LOL.exe.9f86e6.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 0.3.RIP_YOUR_PC_LOL.exe.5725596.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.3.RIP_YOUR_PC_LOL.exe.5725596.2.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 4.0.healastounding.exe.900000.12.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.0.healastounding.exe.900000.12.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.0.healastounding.exe.900000.12.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 4.0.healastounding.exe.900000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.0.healastounding.exe.900000.12.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 4.0.healastounding.exe.935129.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.0.healastounding.exe.935129.9.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.3.RIP_YOUR_PC_LOL.exe.596a627.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.1.RIP_YOUR_PC_LOL.exe.c8867b.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.1.RIP_YOUR_PC_LOL.exe.9f86e6.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.1.RIP_YOUR_PC_LOL.exe.9f86e6.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 4.0.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.0.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.0.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 4.0.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.0.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 11.0.22.exe.530edf.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 4.0.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.0.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 4.0.healastounding.exe.900000.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.0.healastounding.exe.900000.8.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.0.healastounding.exe.900000.8.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 4.0.healastounding.exe.900000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.0.healastounding.exe.900000.8.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000009.00000000.414257385.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000000.414257385.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000006.00000000.397644420.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000009.00000002.707363158.0000000003ECB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000008.00000000.411478373.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000009.00000000.414807841.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000000.414807841.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000009.00000000.416456851.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000000.416456851.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000009.00000002.700831183.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000002.700831183.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000008.00000002.449565052.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000000.00000003.388952115.00000000059C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0000002A.00000000.507357595.0000000000FB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000011.00000000.445953483.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000011.00000002.701265514.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000003B.00000000.627731740.00000000007A2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000000.00000000.374606826.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Source: 00000000.00000000.374606826.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000011.00000003.646152049.0000000001338000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000024.00000000.475797127.0000000000572000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000024.00000000.475797127.0000000000572000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000006.00000002.701971433.0000000001354000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000001C.00000002.567040014.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000019.00000003.459495184.0000000000673000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 0000002E.00000000.548907669.0000000000722000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000011.00000000.445251023.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000002E.00000002.610238464.0000000000722000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 0000002A.00000002.552899490.0000000000FB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000005.00000002.706080641.00000000036DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.693319449.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Source: 00000000.00000002.693319449.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000006.00000000.405813841.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000008.00000000.410285813.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000005.00000000.394040229.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000005.00000000.394040229.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000000.408615715.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000000.447375879.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000006.00000000.394727625.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000005.00000000.394636472.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000005.00000000.394636472.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 00000026.00000000.491059532.0000000000272000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000026.00000000.491059532.0000000000272000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000006.00000000.399704980.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000024.00000002.629223400.0000000000572000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000024.00000002.629223400.0000000000572000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000006.00000002.703770994.00000000030D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000009.00000000.415266906.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000000.415266906.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000019.00000003.459275166.0000000000698000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.701277187.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000005.00000002.701277187.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 00000019.00000003.458681148.000000000067C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.502131214.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.502131214.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 0000001C.00000002.579383399.0000000004081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000003.386628983.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000001C.00000002.514866763.0000000000922000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001C.00000002.514866763.0000000000922000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000001.375725825.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000001.375725825.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.546334194.0000000004474000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000004.00000002.546334194.0000000004474000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Source: 00000004.00000002.546334194.0000000004474000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000011.00000000.446671445.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000009.00000002.708577022.0000000005870000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000002.708577022.0000000005870000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects NanoCore Author: ditekSHen
Source: 00000008.00000000.409570794.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000019.00000003.458183685.0000000000660000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000006.00000002.701012196.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000025.00000000.491609227.00000000002A2000.00000002.00000001.01000000.00000016.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000001C.00000000.461250332.0000000000922000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001C.00000000.461250332.0000000000922000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.679442760.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.679442760.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.679442760.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000009.00000002.708751563.0000000005B00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000002.708751563.0000000005B00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects NanoCore Author: ditekSHen
Source: 00000024.00000002.674377761.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000024.00000002.673042782.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000005.00000000.397247474.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000005.00000000.397247474.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: Process Memory Space: RIP_YOUR_PC_LOL.exe PID: 6880, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: healastounding.exe PID: 3572, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: healastounding.exe PID: 3572, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: healastounding.exe PID: 3572, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: test.exe PID: 6236, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: test.exe PID: 6236, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: Opus.exe PID: 3244, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Opus.exe PID: 3244, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: C:\Users\user\AppData\Roaming\gay.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\gay.exe, type: DROPPED	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\Users\user\AppData\Roaming\Opus.exe, type: DROPPED	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\Opus.exe, type: DROPPED	Matched rule: Detects NanoCore Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Opus.exe, type: DROPPED	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a797c6ca3f5e7aff8fa1149c47fe9466.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a797c6ca3f5e7aff8fa1149c47fe9466.exe, type: DROPPED	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\Users\user\AppData\Roaming\mediaget.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\mediaget.exe, type: DROPPED	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, type: DROPPED	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, type: DROPPED	Matched rule: Detects NanoCore Author: ditekSHen
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, type: DROPPED	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: C:\Users\user\AppData\Roaming\test.exe, type: DROPPED	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: C:\Windows\Help\active_desktop_render.dll, type: DROPPED	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe, type: DROPPED	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe, type: DROPPED	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\3.exe, type: DROPPED	Matched rule: DCRat payload Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\3.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\22.exe, type: DROPPED	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\healastounding.exe, type: DROPPED	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\healastounding.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\healastounding.exe, type: DROPPED	Matched rule: Detects NanoCore Author: ditekSHen

PE file has nameless sections

Source: a.exe.4.dr	Static PE information: section name:
Source: a.exe.4.dr	Static PE information: section name:
Source: a.exe.4.dr	Static PE information: section name:
Source: a.exe.4.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Roaming\healastounding.exe	Code function: 4_2_009466CB
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Code function: 4_2_0090576E
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_00F1D426
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_00F2D5AE
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_00F1D523
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_00F27646
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_00F529BE
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_00F56AF4
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_00F7ABFC
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_00F73CBE
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_00F73C4D
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_00F73DC0
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_00F73D2F
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_00F1ED03
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_00F2AFA6
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_00F1CF92
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_01672477
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_03205758
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_03201D98
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_03207FCA
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_03207FD0
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_03206048
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_0320708A
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_03207098
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_00F4C7BC
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_03201DA8
Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe	Code function: 7_2_0040D390
Source: C:\Users\user\AppData\Roaming\gay.exe	Code function: 8_2_000D6B5E

Source: Pluto Panel.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Pluto Panel.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Pluto Panel.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 0fd7de5367376231a788872005d7ed4f.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 0fd7de5367376231a788872005d7ed4f.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 0fd7de5367376231a788872005d7ed4f.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 0fd7de5367376231a788872005d7ed4f.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ___11.19.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ___11.19.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ___11.19.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ___11.19.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ___11.19.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ___11.19.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ___11.19.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ___11.19.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\AppData\Roaming\4.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Users\user\AppData\Roaming\4.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Users\user\AppData\Roaming\4.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Users\user\AppData\Roaming\4.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Users\user\AppData\Roaming\4.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll
Source: C:\Users\user\AppData\Roaming\4.exe	Section loaded: dxgidebug.dll

Source: RIP_YOUR_PC_LOL.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: RIP_YOUR_PC_LOL.exe, type: SAMPLE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: RIP_YOUR_PC_LOL.exe, type: SAMPLE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: RIP_YOUR_PC_LOL.exe, type: SAMPLE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: RIP_YOUR_PC_LOL.exe, type: SAMPLE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: RIP_YOUR_PC_LOL.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: RIP_YOUR_PC_LOL.exe, type: SAMPLE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: RIP_YOUR_PC_LOL.exe, type: SAMPLE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: RIP_YOUR_PC_LOL.exe, type: SAMPLE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: RIP_YOUR_PC_LOL.exe, type: SAMPLE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 0.0.RIP_YOUR_PC_LOL.exe.206ac1d.13.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.RIP_YOUR_PC_LOL.exe.d4dd52.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.3.RIP_YOUR_PC_LOL.exe.5a556c1.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 9.2.Opus.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.Opus.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.Opus.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 9.2.Opus.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.0.Opus.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.0.Opus.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.0.Opus.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 9.0.Opus.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.2.healastounding.exe.34865dc.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.2.healastounding.exe.34865dc.7.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 8.0.gay.exe.d0000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 8.0.gay.exe.d0000.2.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.0.RIP_YOUR_PC_LOL.exe.c8867b.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 11.0.22.exe.5f65b6.17.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 5.2.Pluto Panel.exe.36b9cb4.4.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 5.0.Pluto Panel.exe.f10000.8.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 5.0.Pluto Panel.exe.f10000.8.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.0.Pluto Panel.exe.f10000.8.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.Pluto Panel.exe.f6fa72.1.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 5.2.Pluto Panel.exe.f6fa72.1.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.Pluto Panel.exe.f10000.0.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 5.2.Pluto Panel.exe.f10000.0.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.Pluto Panel.exe.f10000.0.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 9.2.Opus.exe.5b00000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.Opus.exe.5b00000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.Opus.exe.5b00000.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 5.2.Pluto Panel.exe.f18208.3.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 5.2.Pluto Panel.exe.f18208.3.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.Pluto Panel.exe.f18208.3.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.test.exe.da0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Ficker author = ditekSHen, description = Detects Ficker infostealer, clamav_sig = MALWARE.Win.Trojan.Ficker
Source: 8.2.gay.exe.d0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 8.2.gay.exe.d0000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 7.2.0fd7de5367376231a788872005d7ed4f.exe.24f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Ficker author = ditekSHen, description = Detects Ficker infostealer, clamav_sig = MALWARE.Win.Trojan.Ficker
Source: 0.2.RIP_YOUR_PC_LOL.exe.1f6c52e.15.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 5.2.Pluto Panel.exe.f19c0d.2.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 5.2.Pluto Panel.exe.f19c0d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.healastounding.exe.4474268.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.healastounding.exe.4474268.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 4.2.healastounding.exe.4474268.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 4.2.healastounding.exe.4474268.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.0.RIP_YOUR_PC_LOL.exe.1f6c52e.15.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 0.0.RIP_YOUR_PC_LOL.exe.1d1caed.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.RIP_YOUR_PC_LOL.exe.1d1caed.10.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 9.2.Opus.exe.5b00000.7.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.Opus.exe.5b00000.7.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.Opus.exe.5b00000.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 5.2.Pluto Panel.exe.3b3a1c4.6.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 4.2.healastounding.exe.3479694.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 4.2.healastounding.exe.3479694.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.2.healastounding.exe.3479694.5.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Ficker author = ditekSHen, description = Detects Ficker infostealer, clamav_sig = MALWARE.Win.Trojan.Ficker
Source: 5.2.Pluto Panel.exe.7700000.9.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 4.0.healastounding.exe.902324.11.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.0.healastounding.exe.902324.11.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 4.0.healastounding.exe.902324.11.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 4.0.healastounding.exe.902324.11.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.0.22.exe.5f65b6.23.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 11.0.22.exe.530edf.22.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 11.0.22.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 11.0.22.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 5.0.Pluto Panel.exe.f18208.5.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 5.0.Pluto Panel.exe.f18208.5.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.0.Pluto Panel.exe.f18208.5.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.2.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Ficker author = ditekSHen, description = Detects Ficker infostealer, clamav_sig = MALWARE.Win.Trojan.Ficker
Source: 6.0.test.exe.da0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 17.0.mediaget.exe.ab0000.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 17.0.mediaget.exe.ab0000.3.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 4.0.healastounding.exe.95312e.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.0.healastounding.exe.95312e.10.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 9.2.Opus.exe.2ea1844.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.Opus.exe.2ea1844.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.Opus.exe.2ea1844.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 4.0.healastounding.exe.95312e.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.0.healastounding.exe.95312e.10.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 17.0.mediaget.exe.ab0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 17.0.mediaget.exe.ab0000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.0.RIP_YOUR_PC_LOL.exe.1fdd5e1.14.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.17.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Ficker author = ditekSHen, description = Detects Ficker infostealer, clamav_sig = MALWARE.Win.Trojan.Ficker
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Ficker author = ditekSHen, description = Detects Ficker infostealer, clamav_sig = MALWARE.Win.Trojan.Ficker
Source: 0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 11.0.22.exe.5f65b6.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 4.0.healastounding.exe.900000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.0.healastounding.exe.900000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.0.healastounding.exe.900000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 4.0.healastounding.exe.900000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.0.healastounding.exe.900000.4.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 4.2.healastounding.exe.4474268.10.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.healastounding.exe.4474268.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 4.2.healastounding.exe.4474268.10.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.3.RIP_YOUR_PC_LOL.exe.5a556c1.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 9.0.Opus.exe.840000.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.0.Opus.exe.840000.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.0.Opus.exe.840000.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 9.0.Opus.exe.840000.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 5.0.Pluto Panel.exe.f19c0d.15.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 5.0.Pluto Panel.exe.f19c0d.15.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.15.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Ficker author = ditekSHen, description = Detects Ficker infostealer, clamav_sig = MALWARE.Win.Trojan.Ficker
Source: 0.3.RIP_YOUR_PC_LOL.exe.596a627.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 11.0.22.exe.43de6f.19.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 11.0.22.exe.530edf.16.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 4.2.healastounding.exe.95312e.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.2.healastounding.exe.95312e.2.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 11.0.22.exe.43de6f.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 4.2.healastounding.exe.3474284.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 4.2.healastounding.exe.3474284.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.2.healastounding.exe.3474284.6.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 4.0.healastounding.exe.902324.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.0.healastounding.exe.902324.14.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.0.healastounding.exe.902324.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.0.healastounding.exe.902324.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 4.0.healastounding.exe.902324.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.0.healastounding.exe.902324.6.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 4.0.healastounding.exe.902324.14.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.0.healastounding.exe.902324.14.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 4.0.healastounding.exe.902324.14.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.0.healastounding.exe.902324.14.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 17.2.mediaget.exe.ab0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 17.2.mediaget.exe.ab0000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 11.0.22.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.0.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 0.0.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 9.2.Opus.exe.3edeacc.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.Opus.exe.3edeacc.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.Opus.exe.3edeacc.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.RIP_YOUR_PC_LOL.exe.c8867b.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 4.0.healastounding.exe.935129.15.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.0.healastounding.exe.935129.15.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Ficker author = ditekSHen, description = Detects Ficker infostealer, clamav_sig = MALWARE.Win.Trojan.Ficker
Source: 11.0.22.exe.43de6f.13.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 4.0.healastounding.exe.902324.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.0.healastounding.exe.902324.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 4.0.healastounding.exe.902324.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 4.0.healastounding.exe.902324.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 8.0.gay.exe.d0000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 8.0.gay.exe.d0000.1.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 8.0.gay.exe.d0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 8.0.gay.exe.d0000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 9.0.Opus.exe.840000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.0.Opus.exe.840000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.0.Opus.exe.840000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 9.0.Opus.exe.840000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.0.22.exe.530edf.11.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 5.0.Pluto Panel.exe.f19c0d.11.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 5.0.Pluto Panel.exe.f19c0d.11.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.2.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 4.2.healastounding.exe.34865dc.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.2.healastounding.exe.34865dc.7.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 9.2.Opus.exe.5870000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.Opus.exe.5870000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.Opus.exe.5870000.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 4.2.healastounding.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.healastounding.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.2.healastounding.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 4.2.healastounding.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.2.healastounding.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 5.0.Pluto Panel.exe.f6fa72.13.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 5.0.Pluto Panel.exe.f6fa72.13.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.Pluto Panel.exe.f18208.10.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 5.0.Pluto Panel.exe.f18208.10.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.0.Pluto Panel.exe.f18208.10.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.RIP_YOUR_PC_LOL.exe.1d1caed.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.2.RIP_YOUR_PC_LOL.exe.1d1caed.10.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 4.0.healastounding.exe.902324.11.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.0.healastounding.exe.902324.11.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.0.healastounding.exe.902324.11.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 4.0.healastounding.exe.902324.11.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.0.healastounding.exe.902324.11.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 11.0.22.exe.5f65b6.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Ficker author = ditekSHen, description = Detects Ficker infostealer, clamav_sig = MALWARE.Win.Trojan.Ficker
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.16.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Ficker author = ditekSHen, description = Detects Ficker infostealer, clamav_sig = MALWARE.Win.Trojan.Ficker
Source: 0.1.RIP_YOUR_PC_LOL.exe.d4dd52.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 4.0.healastounding.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.0.healastounding.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.0.healastounding.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 4.0.healastounding.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.0.healastounding.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 4.0.healastounding.exe.95312e.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.0.healastounding.exe.95312e.7.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Ficker author = ditekSHen, description = Detects Ficker infostealer, clamav_sig = MALWARE.Win.Trojan.Ficker
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Ficker author = ditekSHen, description = Detects Ficker infostealer, clamav_sig = MALWARE.Win.Trojan.Ficker
Source: 9.2.Opus.exe.3ed9c96.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.Opus.exe.3ed9c96.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.Opus.exe.3ed9c96.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 9.2.Opus.exe.3ed9c96.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.0.RIP_YOUR_PC_LOL.exe.c8867b.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 5.2.Pluto Panel.exe.7710000.10.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.1.RIP_YOUR_PC_LOL.exe.c8867b.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.1.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 0.1.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 4.0.healastounding.exe.95312e.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.0.healastounding.exe.95312e.2.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 9.2.Opus.exe.3edeacc.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.Opus.exe.3edeacc.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.Opus.exe.3edeacc.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 9.2.Opus.exe.3ee30f5.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.Opus.exe.3ee30f5.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.Opus.exe.3ee30f5.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 4.0.healastounding.exe.95312e.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.0.healastounding.exe.95312e.7.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.2.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.2.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 4.2.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.2.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 5.0.Pluto Panel.exe.f18208.2.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 5.0.Pluto Panel.exe.f18208.2.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.0.Pluto Panel.exe.f18208.2.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.Pluto Panel.exe.f6fa72.1.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 5.0.Pluto Panel.exe.f6fa72.1.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.Pluto Panel.exe.f6fa72.9.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 5.0.Pluto Panel.exe.f6fa72.9.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 17.0.mediaget.exe.ab0000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 17.0.mediaget.exe.ab0000.1.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 11.0.22.exe.43de6f.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 4.0.healastounding.exe.95312e.13.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.0.healastounding.exe.95312e.13.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.18.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Ficker author = ditekSHen, description = Detects Ficker infostealer, clamav_sig = MALWARE.Win.Trojan.Ficker
Source: 11.0.22.exe.400000.18.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.2.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 0.2.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.Pluto Panel.exe.f6fa72.7.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 5.0.Pluto Panel.exe.f6fa72.7.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 11.0.22.exe.530edf.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.3.RIP_YOUR_PC_LOL.exe.5839748.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 6.0.test.exe.da0000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.RIP_YOUR_PC_LOL.exe.206ac1d.13.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 11.0.22.exe.530edf.22.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.2.RIP_YOUR_PC_LOL.exe.1fdd5e1.14.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 4.2.healastounding.exe.902324.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.healastounding.exe.902324.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 4.2.healastounding.exe.902324.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 4.2.healastounding.exe.902324.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.0.RIP_YOUR_PC_LOL.exe.d4dd52.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.13.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Ficker author = ditekSHen, description = Detects Ficker infostealer, clamav_sig = MALWARE.Win.Trojan.Ficker
Source: 0.2.RIP_YOUR_PC_LOL.exe.c8867b.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 11.0.22.exe.530edf.16.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 5.0.Pluto Panel.exe.f10000.4.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 5.0.Pluto Panel.exe.f10000.4.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.0.Pluto Panel.exe.f10000.4.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.test.exe.da0000.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.3.RIP_YOUR_PC_LOL.exe.5731eca.7.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 0.3.RIP_YOUR_PC_LOL.exe.5731eca.7.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 0.3.RIP_YOUR_PC_LOL.exe.5707591.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.3.RIP_YOUR_PC_LOL.exe.5707591.1.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 4.0.healastounding.exe.935129.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.0.healastounding.exe.935129.5.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 5.0.Pluto Panel.exe.f10000.12.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 5.0.Pluto Panel.exe.f10000.12.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.0.Pluto Panel.exe.f10000.12.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.RIP_YOUR_PC_LOL.exe.206ac1d.13.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Ficker author = ditekSHen, description = Detects Ficker infostealer, clamav_sig = MALWARE.Win.Trojan.Ficker
Source: 5.0.Pluto Panel.exe.f19c0d.6.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 5.0.Pluto Panel.exe.f19c0d.6.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 0.3.RIP_YOUR_PC_LOL.exe.5a2fcfe.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.Pluto Panel.exe.f10000.0.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 5.0.Pluto Panel.exe.f10000.0.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.0.Pluto Panel.exe.f10000.0.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 4.0.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.0.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.0.RIP_YOUR_PC_LOL.exe.206ac1d.13.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 5.0.Pluto Panel.exe.f19c0d.3.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 5.0.Pluto Panel.exe.f19c0d.3.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 11.0.22.exe.530edf.11.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.19.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Ficker author = ditekSHen, description = Detects Ficker infostealer, clamav_sig = MALWARE.Win.Trojan.Ficker
Source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.14.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Ficker author = ditekSHen, description = Detects Ficker infostealer, clamav_sig = MALWARE.Win.Trojan.Ficker
Source: 9.2.Opus.exe.5b04629.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.Opus.exe.5b04629.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.Opus.exe.5b04629.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 15.2.0fd7de5367376231a788872005d7ed4f.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Ficker author = ditekSHen, description = Detects Ficker infostealer, clamav_sig = MALWARE.Win.Trojan.Ficker
Source: 0.0.RIP_YOUR_PC_LOL.exe.9f86e6.3.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 0.0.RIP_YOUR_PC_LOL.exe.9f86e6.3.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.0.RIP_YOUR_PC_LOL.exe.9f86e6.3.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 0.3.RIP_YOUR_PC_LOL.exe.59c8085.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 7.2.0fd7de5367376231a788872005d7ed4f.exe.24f15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Ficker author = ditekSHen, description = Detects Ficker infostealer, clamav_sig = MALWARE.Win.Trojan.Ficker
Source: 0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 17.0.mediaget.exe.ab0000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 17.0.mediaget.exe.ab0000.2.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 8.0.gay.exe.d0000.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 8.0.gay.exe.d0000.3.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 4.0.healastounding.exe.902324.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.0.healastounding.exe.902324.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 4.0.healastounding.exe.902324.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 4.0.healastounding.exe.902324.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.0.Opus.exe.840000.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.0.Opus.exe.840000.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.0.Opus.exe.840000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 9.0.Opus.exe.840000.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.2.healastounding.exe.3479694.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 5.0.Pluto Panel.exe.f18208.14.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 5.0.Pluto Panel.exe.f18208.14.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.0.Pluto Panel.exe.f18208.14.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 4.0.healastounding.exe.902324.14.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.0.healastounding.exe.902324.14.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 4.0.healastounding.exe.902324.14.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 4.0.healastounding.exe.902324.14.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.0.test.exe.da0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 4.0.healastounding.exe.95312e.13.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.0.healastounding.exe.95312e.13.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.2.RIP_YOUR_PC_LOL.exe.9f86e6.1.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 0.2.RIP_YOUR_PC_LOL.exe.9f86e6.1.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.RIP_YOUR_PC_LOL.exe.9f86e6.1.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 0.3.RIP_YOUR_PC_LOL.exe.5725596.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.3.RIP_YOUR_PC_LOL.exe.5725596.2.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 4.0.healastounding.exe.900000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.0.healastounding.exe.900000.12.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.0.healastounding.exe.900000.12.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 4.0.healastounding.exe.900000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.0.healastounding.exe.900000.12.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 4.0.healastounding.exe.935129.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.0.healastounding.exe.935129.9.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.3.RIP_YOUR_PC_LOL.exe.596a627.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.1.RIP_YOUR_PC_LOL.exe.c8867b.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.1.RIP_YOUR_PC_LOL.exe.9f86e6.0.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 0.1.RIP_YOUR_PC_LOL.exe.9f86e6.0.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.1.RIP_YOUR_PC_LOL.exe.9f86e6.0.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 4.0.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.0.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.0.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 4.0.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.0.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 11.0.22.exe.530edf.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 4.0.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.0.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 4.0.healastounding.exe.900000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.0.healastounding.exe.900000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.0.healastounding.exe.900000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 4.0.healastounding.exe.900000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.0.healastounding.exe.900000.8.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 5.2.Pluto Panel.exe.3706aac.5.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000009.00000000.414257385.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000000.414257385.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000006.00000000.397644420.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000009.00000002.707363158.0000000003ECB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000008.00000000.411478373.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000009.00000000.414807841.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000000.414807841.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000009.00000000.416456851.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000000.416456851.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000009.00000002.700831183.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000002.700831183.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000008.00000002.449565052.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000000.00000003.388952115.00000000059C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0000002A.00000000.507357595.0000000000FB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000011.00000000.445953483.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000011.00000002.701265514.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000003B.00000000.627731740.00000000007A2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000000.00000000.374606826.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000000.374606826.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000011.00000003.646152049.0000000001338000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000024.00000000.475797127.0000000000572000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000024.00000000.475797127.0000000000572000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000006.00000002.701971433.0000000001354000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000001C.00000002.567040014.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000019.00000003.459495184.0000000000673000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 0000002E.00000000.548907669.0000000000722000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000011.00000000.445251023.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000002E.00000002.610238464.0000000000722000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 0000002A.00000002.552899490.0000000000FB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000005.00000002.706080641.00000000036DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.693319449.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000002.693319449.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000006.00000000.405813841.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000008.00000000.410285813.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000005.00000002.712472379.0000000007710000.00000004.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000005.00000000.394040229.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 00000005.00000000.394040229.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000000.408615715.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000000.447375879.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000006.00000000.394727625.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000005.00000000.394636472.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 00000005.00000000.394636472.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 00000026.00000000.491059532.0000000000272000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000026.00000000.491059532.0000000000272000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000006.00000000.399704980.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000024.00000002.629223400.0000000000572000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000024.00000002.629223400.0000000000572000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000006.00000002.703770994.00000000030D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000009.00000000.415266906.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000000.415266906.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000019.00000003.459275166.0000000000698000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.701277187.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 00000005.00000002.701277187.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 00000019.00000003.458681148.000000000067C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.502131214.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 00000000.00000002.502131214.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 0000001C.00000002.579383399.0000000004081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000003.386628983.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000001C.00000002.514866763.0000000000922000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001C.00000002.514866763.0000000000922000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000001.375725825.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 00000000.00000001.375725825.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.546334194.0000000004474000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000004.00000002.546334194.0000000004474000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000004.00000002.546334194.0000000004474000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000011.00000000.446671445.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000009.00000002.708577022.0000000005870000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000002.708577022.0000000005870000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000009.00000002.708577022.0000000005870000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000008.00000000.409570794.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000019.00000003.458183685.0000000000660000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net

Source: C:\Users\user\AppData\Roaming\22.exe

File created: C:\Windows\Help\Winlogon.exe

Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe

Code function: String function: 00F5BA9D appears 35 times

Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.367521899.0000000000E31000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefreeeim.exe vs RIP_YOUR_PC_LOL.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.374606826.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamereiudxamcsyuasdx.exePADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.374606826.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamereiudxamcsyuasdx.exePADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.374606826.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs RIP_YOUR_PC_LOL.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.374606826.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamehealastounding.exe4 vs RIP_YOUR_PC_LOL.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.374606826.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefoampounding.exe, vs RIP_YOUR_PC_LOL.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000003.388952115.00000000059C7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamereiudxamcsyuasdx.exePADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000003.388952115.00000000059C7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs RIP_YOUR_PC_LOL.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000003.388952115.00000000059C7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamehealastounding.exe4 vs RIP_YOUR_PC_LOL.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCMemoryExecute.dll@ vs RIP_YOUR_PC_LOL.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWebBrowserPassView.exeF vs RIP_YOUR_PC_LOL.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamemailpv.exe< vs RIP_YOUR_PC_LOL.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePhulli.exe0 vs RIP_YOUR_PC_LOL.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameactive_desktop_launcher.exe, vs RIP_YOUR_PC_LOL.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000002.696291372.0000000004350000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamebaseline.dll4 vs RIP_YOUR_PC_LOL.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000002.696610265.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefreeeim.exe vs RIP_YOUR_PC_LOL.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebBrowserPassView.exeF vs RIP_YOUR_PC_LOL.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemailpv.exe< vs RIP_YOUR_PC_LOL.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePhulli.exe0 vs RIP_YOUR_PC_LOL.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameactive_desktop_launcher.exe, vs RIP_YOUR_PC_LOL.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000003.388706064.0000000005956000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamereiudxamcsyuasdx.exePADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000002.696344828.00000000046D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamebaseline.dll4 vs RIP_YOUR_PC_LOL.exe

Source: 8f1c8b40c7be588389a8d382040b23bb.exe.4.dr

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: a.exe.4.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: Opus.exe.4.dr	Static PE information: Section: .rsrc ZLIB complexity 0.995233050847
Source: a.exe.4.dr	Static PE information: Section: ZLIB complexity 1.00057768486
Source: a.exe.4.dr	Static PE information: Section: ZLIB complexity 1.021484375

Source: RIP_YOUR_PC_LOL.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe

File created: C:\Users\user\AppData\Roaming\healastounding.exe

Jump to behavior

Source: classification engine

Classification label: mal100.troj.adwa.spyw.evad.winEXE@84/32@48/5

Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: Opus.exe.4.dr, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: Opus.exe.4.dr, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.0.Pluto Panel.exe.f10000.4.unpack, Form1.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: Pluto Panel.exe.0.dr, Form1.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 5.2.Pluto Panel.exe.f10000.0.unpack, Form1.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 5.0.Pluto Panel.exe.f10000.8.unpack, Form1.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 5.0.Pluto Panel.exe.f10000.12.unpack, Form1.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: test.exe.4.dr, Client/Helper/Methods.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: test.exe.4.dr, Client/Helper/Methods.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: C:\Users\user\AppData\Roaming\Opus.exe

File created: C:\Program Files (x86)\DHCP Monitor

Jump to behavior

Source: RIP_YOUR_PC_LOL.exe	Virustotal: Detection: 63%
Source: RIP_YOUR_PC_LOL.exe	Metadefender: Detection: 33%
Source: RIP_YOUR_PC_LOL.exe	ReversingLabs: Detection: 73%

Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe "C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe"
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process created: C:\Users\user\AppData\Roaming\healastounding.exe "C:\Users\user\AppData\Roaming\healastounding.exe"
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process created: C:\Users\user\AppData\Roaming\Pluto Panel.exe "C:\Users\user\AppData\Roaming\Pluto Panel.exe"
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process created: C:\Users\user\AppData\Roaming\test.exe "C:\Users\user\AppData\Roaming\test.exe"
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process created: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe "C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe"
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process created: C:\Users\user\AppData\Roaming\gay.exe "C:\Users\user\AppData\Roaming\gay.exe"
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process created: C:\Users\user\AppData\Roaming\Opus.exe "C:\Users\user\AppData\Roaming\Opus.exe"
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process created: C:\Users\user\AppData\Roaming\22.exe "C:\Users\user\AppData\Roaming\22.exe"
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process created: C:\Users\user\AppData\Roaming\aaa.exe "C:\Users\user\AppData\Roaming\aaa.exe"
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process created: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe "C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe"
Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe	Process created: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe "C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe"
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process created: C:\Users\user\AppData\Roaming\4.exe "C:\Users\user\AppData\Roaming\4.exe"
Source: C:\Users\user\AppData\Roaming\gay.exe	Process created: C:\Users\user\AppData\Roaming\mediaget.exe "C:\Users\user\AppData\Roaming\mediaget.exe"
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process created: C:\Users\user\AppData\Roaming\aaa.exe C:\Users\user\AppData\Roaming\aaa.exe
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp4896.tmp
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process created: C:\Users\user\AppData\Roaming\a.exe "C:\Users\user\AppData\Roaming\a.exe"
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add policy name=Block
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process created: C:\Users\user\AppData\Roaming\___11.19.exe "C:\Users\user\AppData\Roaming\___11.19.exe"
Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	Process created: C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe "C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe"
Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	Process created: C:\Users\user\AppData\Local\Temp\Dcvxaamev.exe "C:\Users\user\AppData\Local\Temp\Dcvxaamev.exe"
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filterlist name=Filter1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Opus.exe C:\Users\user\AppData\Roaming\Opus.exe 0
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp5D87.tmp
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\mediaget.exe" "mediaget.exe" ENABLE
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe"
Source: C:\Users\user\AppData\Roaming\4.exe	Process created: C:\Users\user\AppData\Roaming\3.exe "C:\Users\user\AppData\Roaming\3.exe"
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" 0
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\___11.19.exe	Process created: C:\Users\user\AppData\Local\Temp\svchost.exe C:\Users\user\AppData\Local\Temp\\svchost.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\mediaget.exe "C:\Users\user\AppData\Roaming\mediaget.exe" ..
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\___11.19.exe	Process created: C:\Users\user\AppData\Local\Temp\svchos.exe C:\Users\user\AppData\Local\Temp\\svchos.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\mediaget.exe "C:\Users\user\AppData\Roaming\mediaget.exe" ..
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe -auto
Source: unknown	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe -k " "
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\user\AppData\Local\Temp\svchost.exe > nul
Source: C:\Windows\SysWOW64\TXPlatforn.exe	Process created: C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe -acsi
Source: C:\Users\user\AppData\Roaming\___11.19.exe	Process created: C:\Users\user\AppData\Roaming\HD____11.19.exe C:\Users\user\AppData\Roaming\HD____11.19.exe
Source: unknown	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe -k " "
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\mediaget.exe "C:\Users\user\AppData\Roaming\mediaget.exe" ..
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process created: C:\Users\user\AppData\Roaming\healastounding.exe "C:\Users\user\AppData\Roaming\healastounding.exe"
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process created: C:\Users\user\AppData\Roaming\Pluto Panel.exe "C:\Users\user\AppData\Roaming\Pluto Panel.exe"
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process created: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe "C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe"
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process created: C:\Users\user\AppData\Roaming\22.exe "C:\Users\user\AppData\Roaming\22.exe"
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process created: C:\Users\user\AppData\Roaming\___11.19.exe "C:\Users\user\AppData\Roaming\___11.19.exe"
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process created: C:\Users\user\AppData\Roaming\test.exe "C:\Users\user\AppData\Roaming\test.exe"
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process created: C:\Users\user\AppData\Roaming\gay.exe "C:\Users\user\AppData\Roaming\gay.exe"
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process created: C:\Users\user\AppData\Roaming\Opus.exe "C:\Users\user\AppData\Roaming\Opus.exe"
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process created: C:\Users\user\AppData\Roaming\aaa.exe "C:\Users\user\AppData\Roaming\aaa.exe"
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process created: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe "C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe"
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process created: C:\Users\user\AppData\Roaming\4.exe "C:\Users\user\AppData\Roaming\4.exe"
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process created: C:\Users\user\AppData\Roaming\a.exe "C:\Users\user\AppData\Roaming\a.exe"
Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe	Process created: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe "C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe"
Source: C:\Users\user\AppData\Roaming\gay.exe	Process created: C:\Users\user\AppData\Roaming\mediaget.exe "C:\Users\user\AppData\Roaming\mediaget.exe"
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp4896.tmp
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp5D87.tmp
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add policy name=Block
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filterlist name=Filter1
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process created: C:\Users\user\AppData\Roaming\aaa.exe C:\Users\user\AppData\Roaming\aaa.exe
Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	Process created: C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe "C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe"
Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	Process created: C:\Users\user\AppData\Local\Temp\Dcvxaamev.exe "C:\Users\user\AppData\Local\Temp\Dcvxaamev.exe"
Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\4.exe	Process created: C:\Users\user\AppData\Roaming\3.exe "C:\Users\user\AppData\Roaming\3.exe"
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\mediaget.exe" "mediaget.exe" ENABLE

Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Users\user\AppData\Roaming\Opus.exe

File created: C:\Users\user\AppData\Local\Temp\tmp4896.tmp

Jump to behavior

Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, Pluto Panel.exe, 00000005.00000002.711210574.0000000004691000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, Pluto Panel.exe, 00000005.00000002.711210574.0000000004691000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.711210574.0000000004691000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, Pluto Panel.exe, 00000005.00000002.711210574.0000000004691000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, Pluto Panel.exe, 00000005.00000002.711210574.0000000004691000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, Pluto Panel.exe, 00000005.00000002.711210574.0000000004691000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, Pluto Panel.exe, 00000005.00000002.711210574.0000000004691000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Users\user\AppData\Roaming\test.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\gay.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\gay.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\AppData\Roaming\gay.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Users\user\AppData\Roaming\Opus.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\Opus.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\AppData\Roaming\Opus.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Users\user\AppData\Roaming\aaa.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp

Source: Pluto Panel.exe.0.dr, Form1.cs	Base64 encoded string: 'jKnnv2OtHmCVbL4ukcqXfe1z4H4de/YNg8JCpqpr9q1DDxgSWA+kEDbvzq/lfM8KFapQuuMTsxM2O5Tzlzm+pg==', 'PN4TW3peZ3UeXi7asDB56E4dMEf6JrdkxXNUlrUjLlWcjHK1wZ5CpLZZKB/ocuFWy9Kw0Q8tIc1Qv7OEgqzD+w=='
Source: test.exe.4.dr, Client/Settings.cs	Base64 encoded string: 'v6koimo+vF3BpFPktw8BetB7AEEQsjTP+2fUrZBifNQL3VLBnsc6kqaCQyc26UwN+wJnzl3S0KePTZMjcmvKrQ==', 'hTlHatPbydXHCRGS9wyzSyGV3lDBjQwrOqcw8Vu2ZOiS6WdPzcixmQ4HQ74RFBC6IMp/8uc3fwBetM+DvU0ymg==', 'j0OwZXpz3MhzuEDS2rXS7OtK+rzFCsdqLtzyvOufk6Hure4UbTid4lu2DW/pkfNHiHpQdBE7xG8Bv5C2vrXdr/5RPFWbYiikokKMgmOOwECq/gZBf/xMN+tqo8T6IdU11WyFn3e8GnRhXu4krLuUdn5GTGqK6YvkOcHIGi0V23f3whp8j938+2uBQF81gh1eZWnmX/Adg6NUzc6zZJbcT37Wlmkuxhx5HSsng6R9wfaCltxt2HGJ42LlJ8TQbUyyb37z06u+evh46N7yQC4/UICXf3SrJDdCJboqe5Ypj8W06qI5hiwDfXPTsZ9mwP2j92HVxADP4ke+qmuBOq39Cl+4d2eg8YQ5LPyEUqP57Vz1hojVHczX+cSSDrgSYGkQLtqdXvuKVppXmewf43sp1MWfupRJvsdEQhLFeZTq6AshNzRK9SuEWkX5AKvbrJTH84dzebrFhJkVx72bCCumcBsNNpP5MhZRpzer5iTpj+qXdEI2hoCK2iJ+1d7HZn3Tt4tpB0Sl8SJFiyKH9JKLLU9Ugr4m4ZaQU4mYB8gt5X89QNbs8D3pXdZWjrvkSVgt/xlTZxBgdBOYrg+tr/HngCfi2Kx7We4/z3pOM1h4XdRhylcvqJFLV+fH1p0xtxdh7pZHcM+/iv/ylB0tUfL7LZIAvteXH8p16IwcMGDDnL48QST2NGU81IG2NnG/YF1gqh6IoaUHcpS4YnNjsMR6WynNEU1n8vDXm2xKtpkI/3JvWifxuFywE4AV+DhPDNvLgJDnuM/LWE0mjf4wTzJd2qy5dHFoP63Rmym9k6tx6RSl7KogPRCKDI37Q3UU94ncZmroK93aTqNdXwIQ3M+/SYBmGFycVwK14ZxpxiZaPn1tAOyyqlHmoHZ/wvu0wRvXzLz0Yz8MsH/Oqe0VF8lJfkkI/vsaK6CsxSNIs10/SRoNqQhE25Qk2t0bsAKtoo07wPSz8h+kcKu7fMWDJi1e7zwCVDbjlv4G0AFU+KDGNPw14skoh4OGjb1BDYcGQvDjBK0EcLFXoVjiHlX4DBijgXJ310SrWh1oPfKL1lVrT/1+sahb2XLr5PHq+NCaap83vpON2oI71gktByS1YzDS2MZpTyOga9UTpqFvPXixvGNwfpSIPzGtNnAyDy07rcNNFNUjf8SHt13DhfyhysusoxI3Vra7S1NrFAid0tga5J5wZWKWq4HSnxF+7ETKLAZ1iMem9hX6ncUPHP1UVvVvK8mlnSq4qqqYosgz+QjWvuxTJYh7iLQ0KtGI/ly6gAsYLVEmmY4p4Ri/N7adzTZ+YAr3Y1bourrzZPFe7r+CWC7COQ5iu4qtpnNRkYr5vO5o24CHP7wLR8SwUvEy2XNOv5iezPcVfoxXa5k60+Hv2nItSqPHhCkm4PwIByj03RpGq5NvvtlFY93o/p6lat4Y5l5z4Y4udrtFQ8tYxeEbz+x1vTcz7+a3wCUPVqANqffoDgpHv/FJTCVyGo4GNuSpwVTtunblyRDcvbSjOvWXa05ALD6DFRJUd6oHeqY8qCwsIvO6ZYJ4NMndlV4Irvu2aTCa5dNAQoJwvrsww0UAM06iHepyACy0q6F8M66xRD3gRbH3IEz6gKk+SH81VEtooboOyhs0CiS5rwKMKYfiPC3vF6K5O1HkVoDaE7wWZwlSrRPc0EVgnGT/1lAOh+/ZLSMeXZavkeK1h0PiKFlPaWvBtv0+U3QPIfvt7WcXNIwY82qp9CxIzZqR6qeSyRg9KIzguztTd0Pknanz01eZBJXdjbBx7LP2hV3+rVE9Skwt0Ss3pIq9vvXMIzCce6382xRieRGZz7wBytnF+HchtEfqMgldBSml2T1PuiXPVEXpk851eM/5RgIotedQih/SZPQ0lBV1wsEZsfrRHjuHtD6I7tUjs6u5nN/txypJ8B37JG0y4ThtSJVcwQ4svfyo7qf/u3B+iIOyBUndZU899ENgsPeLcP4rw5Cs25vZ1CyhyT4jcHd1Z5ecFIscsDapgEcCvt8iHtL+soZMyG1Q94SguIxPVcR2W8YzFQoHw4E99uqs3x9okCcR6KdqO2Ll0Rqz3RIyibMvjkNgxXN3YTCMj3oe6SJ4ahNQYBYimoHq6RhAxx4diDP6FiSOvlOv9PAwC/lyi20FlBnMiFY/cOXh9yIQur5DwvWkF6cYNEvXpc461c2vtr35NeQ4VJfKm/XLGQ33eZyImy/zmOej2N+A9mzRmYIDVJ2gu6UIBU3g/GzBybXtZ26LH0ISGmT40ytAUKieRUHNJ5MwbNI3tHRH6PR5eozKWogp/cnBGk+XpvrHF+FZ/JmupkxMHqoFi3dvT6C/yyHsQyfqkoQdmpI=', 'PNacpggE943C4yIAxkJJwCUgYrYxQZpenLl1Bqh8BnvgpkUJXkpgRwU5h3mt3Cs4MAyKzMVHoAd0U+v8e9UB1A==', 'Sg/SHVSZ/qR5y5EwqyWIRqfVY6rjte36C54KgrTe3F7ZT2bUzQddbjrFaSGUdi+PF9Qsi/pnRMxLVP5LZxs8og==', 'sgQCpAYNGXYv9lrcYNb6mSAEdN16LkgynbAWXkrPD7KnesLckmg3bIeh1bBoqD4eudmpegWPTJfkJgwn/f88lg==', 'GnRcTByJoC136DtixgIf1zT5HUVC8VfztoP4k7zA7bYXSoona8laBJOFq51jtcEvabtT740ceMv5a1woOTDVtA=='
Source: 5.0.Pluto Panel.exe.f10000.8.unpack, Form1.cs	Base64 encoded string: 'jKnnv2OtHmCVbL4ukcqXfe1z4H4de/YNg8JCpqpr9q1DDxgSWA+kEDbvzq/lfM8KFapQuuMTsxM2O5Tzlzm+pg==', 'PN4TW3peZ3UeXi7asDB56E4dMEf6JrdkxXNUlrUjLlWcjHK1wZ5CpLZZKB/ocuFWy9Kw0Q8tIc1Qv7OEgqzD+w=='
Source: 5.2.Pluto Panel.exe.f10000.0.unpack, Form1.cs	Base64 encoded string: 'jKnnv2OtHmCVbL4ukcqXfe1z4H4de/YNg8JCpqpr9q1DDxgSWA+kEDbvzq/lfM8KFapQuuMTsxM2O5Tzlzm+pg==', 'PN4TW3peZ3UeXi7asDB56E4dMEf6JrdkxXNUlrUjLlWcjHK1wZ5CpLZZKB/ocuFWy9Kw0Q8tIc1Qv7OEgqzD+w=='
Source: 5.0.Pluto Panel.exe.f10000.4.unpack, Form1.cs	Base64 encoded string: 'jKnnv2OtHmCVbL4ukcqXfe1z4H4de/YNg8JCpqpr9q1DDxgSWA+kEDbvzq/lfM8KFapQuuMTsxM2O5Tzlzm+pg==', 'PN4TW3peZ3UeXi7asDB56E4dMEf6JrdkxXNUlrUjLlWcjHK1wZ5CpLZZKB/ocuFWy9Kw0Q8tIc1Qv7OEgqzD+w=='
Source: 5.0.Pluto Panel.exe.f10000.12.unpack, Form1.cs	Base64 encoded string: 'jKnnv2OtHmCVbL4ukcqXfe1z4H4de/YNg8JCpqpr9q1DDxgSWA+kEDbvzq/lfM8KFapQuuMTsxM2O5Tzlzm+pg==', 'PN4TW3peZ3UeXi7asDB56E4dMEf6JrdkxXNUlrUjLlWcjHK1wZ5CpLZZKB/ocuFWy9Kw0Q8tIc1Qv7OEgqzD+w=='

Source: C:\Users\user\AppData\Roaming\Opus.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{c5a0b6d8-d1f7-45cd-943b-d5fda411e988}
Source: C:\Users\user\AppData\Roaming\test.exe	Mutant created: \Sessions\1\BaseNamedObjects\AsyncMutex_6SI8OkPnk
Source: C:\Users\user\AppData\Roaming\Opus.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe	Mutant created: \Sessions\1\BaseNamedObjects\serhershesrhsfesrf

Source: Pluto Panel.exe.0.dr, Form1.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: Pluto Panel.exe.0.dr, Form1.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: Pluto Panel.exe.0.dr, Form1.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: Pluto Panel.exe.0.dr, Form1.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Opus.exe.4.dr, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: Opus.exe.4.dr, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Opus.exe.4.dr, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: C:\Users\user\AppData\Roaming\test.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\test.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\mediaget.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\mediaget.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Source: RIP_YOUR_PC_LOL.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Source: RIP_YOUR_PC_LOL.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: RIP_YOUR_PC_LOL.exe

Static file information: File size 23633920 > 1048576

Source: RIP_YOUR_PC_LOL.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1689600

Source: RIP_YOUR_PC_LOL.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.374606826.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.388952115.00000000059C7000.00000004.00000800.00020000.00000000.sdmp, healastounding.exe, healastounding.exe, 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, 4.exe, 00000010.00000000.446983407.0000000001203000.00000002.00000001.01000000.0000000E.sdmp, 4.exe, 00000010.00000002.519990989.0000000001203000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\buildbot\slave1\desktop_screen\build\bin\active_desktop_launcher.pdb source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 22.exe, 0000000B.00000000.422804028.000000000042B000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\nutideyebibede\soy\gebetugito\meliyo zodoz.pdb source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 0fd7de5367376231a788872005d7ed4f.exe, 00000007.00000000.407475822.000000000041E000.00000002.00000001.01000000.00000008.sdmp, 0fd7de5367376231a788872005d7ed4f.exe, 00000007.00000002.465903756.000000000041E000.00000002.00000001.01000000.00000008.sdmp, 0fd7de5367376231a788872005d7ed4f.exe, 0000000F.00000000.436842136.000000000041E000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: ]C:\nutideyebibede\soy\gebetugito\meliyo zodoz.pdb source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 0fd7de5367376231a788872005d7ed4f.exe, 00000007.00000000.407475822.000000000041E000.00000002.00000001.01000000.00000008.sdmp, 0fd7de5367376231a788872005d7ed4f.exe, 00000007.00000002.465903756.000000000041E000.00000002.00000001.01000000.00000008.sdmp, 0fd7de5367376231a788872005d7ed4f.exe, 0000000F.00000000.436842136.000000000041E000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, Pluto Panel.exe, Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Pluto Panel.exe, 00000005.00000002.710948269.0000000003B3A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.712472379.0000000007710000.00000004.00000001.00040000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.705753147.0000000003691000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.706244077.0000000003705000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: f:\Projects\VS2005\mailpv\Release\mailpv.pdb source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, Pluto Panel.exe, 00000005.00000002.711210574.0000000004691000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, Pluto Panel.exe, 00000005.00000002.711210574.0000000004691000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: RIP_YOUR_PC_LOL.exe, Program.cs	.Net Code: Main System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: healastounding.exe.0.dr, Program.cs	.Net Code: Main System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: Pluto Panel.exe.0.dr, Form1.cs	.Net Code: IsDotNet System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: Pluto Panel.exe.0.dr, Form1.cs	.Net Code: run System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: Pluto Panel.exe.0.dr, Form1.cs	.Net Code: stealMail System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: Pluto Panel.exe.0.dr, Form1.cs	.Net Code: stealWebroswers System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: test.exe.4.dr, Client/Handle_Packet/Packet.cs	.Net Code: Invoke System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: gay.exe.4.dr, OK.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: Opus.exe.4.dr, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: Opus.exe.4.dr, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.healastounding.exe.900000.4.unpack, Program.cs	.Net Code: Main System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.2.healastounding.exe.900000.0.unpack, Program.cs	.Net Code: Main System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.healastounding.exe.900000.0.unpack, Program.cs	.Net Code: Main System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.healastounding.exe.900000.12.unpack, Program.cs	.Net Code: Main System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.healastounding.exe.900000.8.unpack, Program.cs	.Net Code: Main System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Pluto Panel.exe.f10000.8.unpack, Form1.cs	.Net Code: IsDotNet System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Pluto Panel.exe.f10000.8.unpack, Form1.cs	.Net Code: run System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Pluto Panel.exe.f10000.8.unpack, Form1.cs	.Net Code: stealMail System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Pluto Panel.exe.f10000.8.unpack, Form1.cs	.Net Code: stealWebroswers System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.2.Pluto Panel.exe.f10000.0.unpack, Form1.cs	.Net Code: IsDotNet System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.2.Pluto Panel.exe.f10000.0.unpack, Form1.cs	.Net Code: run System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.2.Pluto Panel.exe.f10000.0.unpack, Form1.cs	.Net Code: stealMail System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.2.Pluto Panel.exe.f10000.0.unpack, Form1.cs	.Net Code: stealWebroswers System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Pluto Panel.exe.f10000.4.unpack, Form1.cs	.Net Code: IsDotNet System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Pluto Panel.exe.f10000.4.unpack, Form1.cs	.Net Code: run System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Pluto Panel.exe.f10000.4.unpack, Form1.cs	.Net Code: stealMail System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Pluto Panel.exe.f10000.4.unpack, Form1.cs	.Net Code: stealWebroswers System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Pluto Panel.exe.f10000.12.unpack, Form1.cs	.Net Code: IsDotNet System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Pluto Panel.exe.f10000.12.unpack, Form1.cs	.Net Code: run System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Pluto Panel.exe.f10000.12.unpack, Form1.cs	.Net Code: stealMail System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Pluto Panel.exe.f10000.12.unpack, Form1.cs	.Net Code: stealWebroswers System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_00F80712 push eax; ret
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_00F80712 push eax; ret
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_00F5BA9D push eax; ret
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_00F5BA9D push eax; ret
Source: C:\Users\user\AppData\Roaming\test.exe	Code function: 6_2_00DA2F81 push eax; ret
Source: C:\Users\user\AppData\Roaming\test.exe	Code function: 6_2_00DA7201 push es; iretd
Source: C:\Users\user\AppData\Roaming\test.exe	Code function: 6_2_00DA4122 push eax; ret
Source: C:\Users\user\AppData\Roaming\test.exe	Code function: 6_2_00DA2A66 push 0000003Eh; retn 0000h

Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe

Code function: 7_2_00416480 LoadLibraryA,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,

Source: a.exe.4.dr

Static PE information: 0x85C84FCD [Thu Feb 14 23:29:17 2041 UTC]

Source: 4.exe.4.dr	Static PE information: section name: .didat
Source: a.exe.4.dr	Static PE information: section name:
Source: a.exe.4.dr	Static PE information: section name:
Source: a.exe.4.dr	Static PE information: section name:
Source: a.exe.4.dr	Static PE information: section name:
Source: a.exe.4.dr	Static PE information: section name: .uxD5Xzb
Source: a.exe.4.dr	Static PE information: section name: .adata

Source: Opus.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0x361f1
Source: healastounding.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x38fcef
Source: test.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0x12c3f
Source: aaa.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0x2b8ea
Source: 4.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0x8ea8d
Source: a.exe.4.dr	Static PE information: real checksum: 0x36412d should be: 0x179cea
Source: Pluto Panel.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0xe3f4e
Source: gay.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0x17231
Source: 0fd7de5367376231a788872005d7ed4f.exe.0.dr	Static PE information: real checksum: 0x8cb64 should be: 0x8bd88
Source: 22.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x2047ff

Source: C:\Users\user\AppData\Roaming\4.exe

File created: C:\Users\user\AppData\Roaming\__tmp_rar_sfx_access_check_21517828

Source: initial sample	Static PE information: section name: .text entropy: 7.23229435769
Source: initial sample	Static PE information: section name: .text entropy: 7.79704182216
Source: initial sample	Static PE information: section name: entropy: 7.99417258092
Source: initial sample	Static PE information: section name: entropy: 7.59206430894
Source: initial sample	Static PE information: section name: .uxD5Xzb entropy: 7.91678806903

Source: Opus.exe.4.dr, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: Opus.exe.4.dr, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	File created: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\healastounding.exe	File created: C:\Users\user\AppData\Roaming\Opus.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\healastounding.exe	File created: C:\Users\user\AppData\Roaming\aaa.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\healastounding.exe	File created: C:\Users\user\AppData\Roaming\a.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\healastounding.exe	File created: C:\Users\user\AppData\Roaming\test.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\gay.exe	File created: C:\Users\user\AppData\Roaming\mediaget.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\healastounding.exe	File created: C:\Users\user\AppData\Roaming\gay.exe	Jump to dropped file
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	File created: C:\Users\user\AppData\Roaming\healastounding.exe	Jump to dropped file
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	File created: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe	Jump to dropped file
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	File created: C:\Users\user\AppData\Roaming\___11.19.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\healastounding.exe	File created: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\healastounding.exe	File created: C:\Users\user\AppData\Roaming\4.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\22.exe	File created: C:\Windows\Cursors\WUDFhosts.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\22.exe	File created: C:\Windows\Help\Winlogon.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mediaget.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a797c6ca3f5e7aff8fa1149c47fe9466.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	File created: C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	File created: C:\Users\user\AppData\Local\Temp\Dcvxaamev.exe	Jump to dropped file
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	File created: C:\Users\user\AppData\Roaming\22.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Opus.exe	File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\22.exe	File created: C:\Windows\Help\active_desktop_render.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\4.exe	File created: C:\Users\user\AppData\Roaming\3.exe	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\22.exe	File created: C:\Windows\Cursors\WUDFhosts.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\22.exe	File created: C:\Windows\Help\Winlogon.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\22.exe	File created: C:\Windows\Help\active_desktop_render.dll	Jump to dropped file

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: RIP_YOUR_PC_LOL.exe, type: SAMPLE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.206ac1d.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.5a556c1.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.test.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1f6c52e.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1f6c52e.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.3479694.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.test.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1fdd5e1.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.5a556c1.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.3474284.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.test.exe.da0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.206ac1d.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1fdd5e1.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.test.exe.da0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.206ac1d.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.206ac1d.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.59c8085.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.3479694.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.test.exe.da0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.596a627.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.397644420.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.388952115.00000000059C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.374606826.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.693319449.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.405813841.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.394727625.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.399704980.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.701012196.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RIP_YOUR_PC_LOL.exe PID: 6880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: healastounding.exe PID: 3572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: test.exe PID: 6236, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\test.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\healastounding.exe, type: DROPPED

Drops PE files to the startup folder

Source: C:\Users\user\AppData\Roaming\mediaget.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a797c6ca3f5e7aff8fa1149c47fe9466.exe

Jump to dropped file

Creates autostart registry keys with suspicious names

Source: C:\Users\user\AppData\Roaming\mediaget.exe

Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run a797c6ca3f5e7aff8fa1149c47fe9466

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Roaming\Opus.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp4896.tmp

Source: C:\Users\user\AppData\Roaming\mediaget.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a797c6ca3f5e7aff8fa1149c47fe9466.exe

Source: C:\Users\user\AppData\Roaming\22.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\KuGouMusic

Source: C:\Users\user\AppData\Roaming\mediaget.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a797c6ca3f5e7aff8fa1149c47fe9466.exe

Source: C:\Users\user\AppData\Roaming\22.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\KuGouMusic

Source: C:\Users\user\AppData\Roaming\mediaget.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run a797c6ca3f5e7aff8fa1149c47fe9466
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run a797c6ca3f5e7aff8fa1149c47fe9466

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\AppData\Roaming\Opus.exe	File opened: C:\Users\user\AppData\Roaming\Opus.exe:Zone.Identifier read attributes \| delete
Source: C:\Users\user\AppData\Roaming\aaa.exe	File opened: C:\Users\user\AppData\Roaming\aaa.exe:Zone.Identifier read attributes \| delete

Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\test.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\22.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\22.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: RIP_YOUR_PC_LOL.exe, type: SAMPLE
Source: Yara match	File source: Process Memory Space: RIP_YOUR_PC_LOL.exe PID: 6880, type: MEMORYSTR

Yara detected AsyncRAT

Source: Yara match	File source: RIP_YOUR_PC_LOL.exe, type: SAMPLE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.206ac1d.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.5a556c1.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.test.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1f6c52e.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1f6c52e.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.3479694.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.test.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1fdd5e1.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.5a556c1.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.3474284.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.test.exe.da0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.206ac1d.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1fdd5e1.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.test.exe.da0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.206ac1d.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.206ac1d.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.59c8085.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.3479694.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.test.exe.da0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.596a627.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.397644420.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.388952115.00000000059C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.374606826.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.693319449.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.405813841.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.394727625.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.399704980.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.701012196.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RIP_YOUR_PC_LOL.exe PID: 6880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: healastounding.exe PID: 3572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: test.exe PID: 6236, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\test.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\healastounding.exe, type: DROPPED

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.374606826.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.388952115.00000000059C7000.00000004.00000800.00020000.00000000.sdmp, healastounding.exe, healastounding.exe, 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, healastounding.exe, 00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp, test.exe, test.exe, 00000006.00000000.397644420.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe TID: 7116	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\healastounding.exe TID: 5312	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe TID: 3440	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\gay.exe TID: 5732	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Opus.exe TID: 3456	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Opus.exe TID: 6076	Thread sleep time: -40000s >= -30000s
Source: C:\Users\user\AppData\Roaming\aaa.exe TID: 5664	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Roaming\Opus.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\gay.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Opus.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\aaa.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe

API coverage: 9.9 %

Source: C:\Users\user\AppData\Roaming\22.exe	Dropped PE file which has not been started: C:\Windows\Cursors\WUDFhosts.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\22.exe	Dropped PE file which has not been started: C:\Windows\Help\Winlogon.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\22.exe	Dropped PE file which has not been started: C:\Windows\Help\active_desktop_render.dll	Jump to dropped file

Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\gay.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Opus.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\aaa.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe

API call chain: ExitProcess graph end node

Source: test.exe, 00000006.00000000.397644420.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: vmware
Source: 4.exe, 00000010.00000002.549082146.0000000005A31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}oy
Source: test.exe, 00000006.00000002.703368085.0000000001410000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllO
Source: healastounding.exe	Binary or memory string: \VMWare\
Source: 8f1c8b40c7be588389a8d382040b23bb.exe, 0000000E.00000000.431135181.00000000004BD000.00000020.00000001.01000000.0000000D.sdmp	Binary or memory string: \VMWare\F\oracle\virtualbox guest additions\
Source: 4.exe, 00000010.00000002.549082146.0000000005A31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Opus.exe, 00000009.00000002.702218807.0000000000F66000.00000004.00000020.00020000.00000000.sdmp, mediaget.exe, 00000011.00000003.496866786.0000000001375000.00000004.00000020.00020000.00000000.sdmp, mediaget.exe, 00000011.00000003.497883150.0000000001375000.00000004.00000020.00020000.00000000.sdmp, mediaget.exe, 00000011.00000003.628943964.0000000001375000.00000004.00000020.00020000.00000000.sdmp, mediaget.exe, 00000011.00000003.641573561.0000000001374000.00000004.00000020.00020000.00000000.sdmp, mediaget.exe, 00000011.00000003.499366565.0000000001375000.00000004.00000020.00020000.00000000.sdmp, mediaget.exe, 00000011.00000003.536070108.0000000001375000.00000004.00000020.00020000.00000000.sdmp, mediaget.exe, 00000011.00000003.518432103.0000000001375000.00000004.00000020.00020000.00000000.sdmp, mediaget.exe, 00000011.00000003.645223386.0000000001374000.00000004.00000020.00020000.00000000.sdmp, mediaget.exe, 00000011.00000003.501699554.0000000001375000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: aaa.exe, 0000000C.00000002.458844469.0000000002915000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware svga ii3vm additions s3 trio32/64

Source: C:\Users\user\AppData\Roaming\Opus.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Roaming\test.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe

Code function: 7_2_0040EE60 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

Source: C:\Users\user\AppData\Roaming\Opus.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\mediaget.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe	Code function: 7_2_0040EE60 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe	Code function: 7_2_00404770 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe	Code function: 7_2_0041A780 _memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\aaa.exe

Memory written: C:\Users\user\AppData\Roaming\aaa.exe base: 3E0000 value starts with: 4D5A

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe

Section unmapped: unknown base address: 400000

.NET source code references suspicious native API functions

Source: Pluto Panel.exe.0.dr, Form1.cs	Reference to suspicious API methods: ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: Pluto Panel.exe.0.dr, RunPE.cs	Reference to suspicious API methods: ('ReadProcessMemory', 'ReadProcessMemory@kernel32'), ('WriteProcessMemory', 'WriteProcessMemory@kernel32'), ('VirtualProtectEx', 'VirtualProtectEx@kernel32'), ('VirtualAllocEx', 'VirtualAllocEx@kernel32')
Source: gay.exe.4.dr, OK.cs	Reference to suspicious API methods: ('capGetDriverDescriptionA', 'capGetDriverDescriptionA@avicap32.dll')
Source: gay.exe.4.dr, kl.cs	Reference to suspicious API methods: ('GetAsyncKeyState', 'GetAsyncKeyState@user32'), ('MapVirtualKey', 'MapVirtualKey@user32.dll')
Source: Opus.exe.4.dr, u0023u003dqjryTBW16mUfo_ItH9KWoGQu003du003d.cs	Reference to suspicious API methods: ('#=qxG$Aklpbf6gyBfAqTMmORA==', 'OpenProcess@kernel32.dll'), ('#=qh7diH14jww3Fm9rMJ_jIfQ==', 'FindResourceEx@kernel32.dll')
Source: 5.0.Pluto Panel.exe.f10000.8.unpack, Form1.cs	Reference to suspicious API methods: ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: 5.0.Pluto Panel.exe.f10000.8.unpack, RunPE.cs	Reference to suspicious API methods: ('ReadProcessMemory', 'ReadProcessMemory@kernel32'), ('WriteProcessMemory', 'WriteProcessMemory@kernel32'), ('VirtualProtectEx', 'VirtualProtectEx@kernel32'), ('VirtualAllocEx', 'VirtualAllocEx@kernel32')
Source: 5.2.Pluto Panel.exe.f10000.0.unpack, Form1.cs	Reference to suspicious API methods: ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: 5.2.Pluto Panel.exe.f10000.0.unpack, RunPE.cs	Reference to suspicious API methods: ('ReadProcessMemory', 'ReadProcessMemory@kernel32'), ('WriteProcessMemory', 'WriteProcessMemory@kernel32'), ('VirtualProtectEx', 'VirtualProtectEx@kernel32'), ('VirtualAllocEx', 'VirtualAllocEx@kernel32')
Source: 5.0.Pluto Panel.exe.f10000.4.unpack, Form1.cs	Reference to suspicious API methods: ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: 5.0.Pluto Panel.exe.f10000.4.unpack, RunPE.cs	Reference to suspicious API methods: ('ReadProcessMemory', 'ReadProcessMemory@kernel32'), ('WriteProcessMemory', 'WriteProcessMemory@kernel32'), ('VirtualProtectEx', 'VirtualProtectEx@kernel32'), ('VirtualAllocEx', 'VirtualAllocEx@kernel32')
Source: 5.0.Pluto Panel.exe.f10000.12.unpack, Form1.cs	Reference to suspicious API methods: ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: 5.0.Pluto Panel.exe.f10000.12.unpack, RunPE.cs	Reference to suspicious API methods: ('ReadProcessMemory', 'ReadProcessMemory@kernel32'), ('WriteProcessMemory', 'WriteProcessMemory@kernel32'), ('VirtualProtectEx', 'VirtualProtectEx@kernel32'), ('VirtualAllocEx', 'VirtualAllocEx@kernel32')

Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process created: C:\Users\user\AppData\Roaming\healastounding.exe "C:\Users\user\AppData\Roaming\healastounding.exe"
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process created: C:\Users\user\AppData\Roaming\Pluto Panel.exe "C:\Users\user\AppData\Roaming\Pluto Panel.exe"
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process created: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe "C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe"
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process created: C:\Users\user\AppData\Roaming\22.exe "C:\Users\user\AppData\Roaming\22.exe"
Source: C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe	Process created: C:\Users\user\AppData\Roaming\___11.19.exe "C:\Users\user\AppData\Roaming\___11.19.exe"
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process created: C:\Users\user\AppData\Roaming\test.exe "C:\Users\user\AppData\Roaming\test.exe"
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process created: C:\Users\user\AppData\Roaming\gay.exe "C:\Users\user\AppData\Roaming\gay.exe"
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process created: C:\Users\user\AppData\Roaming\Opus.exe "C:\Users\user\AppData\Roaming\Opus.exe"
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process created: C:\Users\user\AppData\Roaming\aaa.exe "C:\Users\user\AppData\Roaming\aaa.exe"
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process created: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe "C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe"
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process created: C:\Users\user\AppData\Roaming\4.exe "C:\Users\user\AppData\Roaming\4.exe"
Source: C:\Users\user\AppData\Roaming\healastounding.exe	Process created: C:\Users\user\AppData\Roaming\a.exe "C:\Users\user\AppData\Roaming\a.exe"
Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe	Process created: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe "C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe"
Source: C:\Users\user\AppData\Roaming\gay.exe	Process created: C:\Users\user\AppData\Roaming\mediaget.exe "C:\Users\user\AppData\Roaming\mediaget.exe"
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp4896.tmp
Source: C:\Users\user\AppData\Roaming\Opus.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp5D87.tmp
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add policy name=Block
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filterlist name=Filter1
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP
Source: C:\Users\user\AppData\Roaming\22.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\aaa.exe	Process created: C:\Users\user\AppData\Roaming\aaa.exe C:\Users\user\AppData\Roaming\aaa.exe
Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	Process created: C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe "C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe"
Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	Process created: C:\Users\user\AppData\Local\Temp\Dcvxaamev.exe "C:\Users\user\AppData\Local\Temp\Dcvxaamev.exe"
Source: C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\4.exe	Process created: C:\Users\user\AppData\Roaming\3.exe "C:\Users\user\AppData\Roaming\3.exe"

Source: mediaget.exe, 00000011.00000002.705065903.0000000003315000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program managerH
Source: Opus.exe, 00000009.00000002.706154944.000000000307A000.00000004.00000800.00020000.00000000.sdmp, Opus.exe, 00000009.00000002.706141297.0000000003078000.00000004.00000800.00020000.00000000.sdmp, Opus.exe, 00000009.00000002.702218807.0000000000F66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: mediaget.exe, 00000011.00000002.705065903.0000000003315000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program manager.
Source: mediaget.exe, 00000011.00000002.704209643.00000000032B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program manager
Source: mediaget.exe, 00000011.00000003.646152049.0000000001338000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RhProgram Manager$

Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Users\user\AppData\Roaming\test.exe	Queries volume information: C:\Users\user\AppData\Roaming\test.exe VolumeInformation

Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe

Code function: 7_2_0040AE40 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: RIP_YOUR_PC_LOL.exe, type: SAMPLE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.206ac1d.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.5a556c1.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.test.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1f6c52e.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1f6c52e.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.3479694.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.test.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1fdd5e1.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.5a556c1.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.3474284.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.test.exe.da0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.206ac1d.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1fdd5e1.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.test.exe.da0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.206ac1d.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.206ac1d.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.59c8085.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.3479694.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.test.exe.da0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.596a627.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.397644420.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.388952115.00000000059C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.374606826.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.693319449.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.405813841.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.394727625.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.399704980.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.701012196.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RIP_YOUR_PC_LOL.exe PID: 6880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: healastounding.exe PID: 3572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: test.exe PID: 6236, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\test.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\healastounding.exe, type: DROPPED

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\AppData\Roaming\22.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add policy name=Block

Modifies the windows firewall

Source: C:\Users\user\AppData\Roaming\mediaget.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\mediaget.exe" "mediaget.exe" ENABLE

Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.367521899.0000000000E31000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000002.696610265.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: acs.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.367521899.0000000000E31000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000002.696610265.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vsserv.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.367521899.0000000000E31000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000002.696610265.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: avcenter.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.367521899.0000000000E31000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000002.696610265.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: kxetray.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.367521899.0000000000E31000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000002.696610265.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.367521899.0000000000E31000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000002.696610265.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: cfp.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.367521899.0000000000E31000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000002.696610265.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: KSafeTray.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.367521899.0000000000E31000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000002.696610265.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: rtvscan.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.367521899.0000000000E31000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000002.696610265.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 360tray.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.367521899.0000000000E31000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000002.696610265.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ashDisp.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.367521899.0000000000E31000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000002.696610265.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: TMBMSRV.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.367521899.0000000000E31000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000002.696610265.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: avgwdsvc.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.367521899.0000000000E31000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000002.696610265.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AYAgent.aye
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.367521899.0000000000E31000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000002.696610265.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: QUHLPSVC.EXE
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.367521899.0000000000E31000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000002.696610265.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: RavMonD.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.367521899.0000000000E31000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000002.696610265.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Mcshield.exe
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.367521899.0000000000E31000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000002.696610265.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: K7TSecurity.exe

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000014.00000003.641078460.00000000035A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected MailPassView

Source: Yara match	File source: RIP_YOUR_PC_LOL.exe, type: SAMPLE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.5731eca.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f10000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.f6fa72.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.f10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.f18208.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.f19c0d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f18208.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f6fa72.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f6fa72.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f18208.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.4698e10.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.1.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f18208.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f6fa72.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f6fa72.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f6fa72.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f6fa72.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f6fa72.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f6fa72.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.4698e10.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f10000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.5731eca.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f10000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.f6fa72.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.9f86e6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f18208.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.9f86e6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.1.RIP_YOUR_PC_LOL.exe.9f86e6.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.711210574.0000000004691000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.394040229.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.394636472.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.701277187.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.502131214.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000001.375725825.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.397247474.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RIP_YOUR_PC_LOL.exe PID: 6880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Pluto Panel.exe PID: 4236, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Pluto Panel.exe, type: DROPPED

Yara detected HawkEye Keylogger

Source: Yara match	File source: RIP_YOUR_PC_LOL.exe, type: SAMPLE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f10000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.f6fa72.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.f10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.f18208.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.f19c0d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f18208.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f6fa72.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f18208.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.1.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f18208.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f6fa72.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f6fa72.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f6fa72.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f10000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.5731eca.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f10000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.9f86e6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f18208.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.9f86e6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.1.RIP_YOUR_PC_LOL.exe.9f86e6.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.706080641.00000000036DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.394040229.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.394636472.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.701277187.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.502131214.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000001.375725825.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.397247474.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RIP_YOUR_PC_LOL.exe PID: 6880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Pluto Panel.exe PID: 4236, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Pluto Panel.exe, type: DROPPED

Yara detected Azorult Info Stealer

Source: Yara match	File source: 00000019.00000003.459495184.0000000000673000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.459275166.0000000000698000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.458681148.000000000067C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.458183685.0000000000660000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Nanocore RAT

Source: Yara match	File source: RIP_YOUR_PC_LOL.exe, type: SAMPLE
Source: Yara match	File source: 9.2.Opus.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.Opus.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.5b00000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.4474268.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.5b00000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.4474268.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.Opus.exe.840000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.3edeacc.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.Opus.exe.840000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.3ed9c96.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.3edeacc.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.3ee30f5.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.902324.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.5b04629.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.Opus.exe.840000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000000.414257385.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.707363158.0000000003ECB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.414807841.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.416456851.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.700831183.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.475797127.0000000000572000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.567040014.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000000.491059532.0000000000272000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.629223400.0000000000572000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.415266906.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.579383399.0000000004081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.514866763.0000000000922000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.546334194.0000000004474000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.461250332.0000000000922000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.679442760.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.708751563.0000000005B00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.674377761.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.673042782.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: healastounding.exe PID: 3572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Opus.exe PID: 3244, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Opus.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\healastounding.exe, type: DROPPED

Yara detected DCRat

Source: Yara match	File source: 00000025.00000000.491609227.00000000002A2000.00000002.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\3.exe, type: DROPPED

Yara detected Generic Dropper

Source: Yara match	File source: RIP_YOUR_PC_LOL.exe, type: SAMPLE
Source: Yara match	File source: Process Memory Space: RIP_YOUR_PC_LOL.exe PID: 6880, type: MEMORYSTR

Yara detected Azorult

Source: Yara match	File source: 00000019.00000003.459495184.0000000000673000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.459275166.0000000000698000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.458681148.000000000067C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.458183685.0000000000660000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Njrat

Source: Yara match	File source: RIP_YOUR_PC_LOL.exe, type: SAMPLE
Source: Yara match	File source: 4.2.healastounding.exe.34865dc.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.gay.exe.d0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.gay.exe.d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1d1caed.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.3479694.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.mediaget.exe.ab0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.mediaget.exe.ab0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.95312e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.3474284.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.mediaget.exe.ab0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.gay.exe.d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.gay.exe.d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.34865dc.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1d1caed.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.mediaget.exe.ab0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.5707591.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.mediaget.exe.ab0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.gay.exe.d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.5725596.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.411478373.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.449565052.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000000.507357595.0000000000FB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.445953483.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.701265514.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000003B.00000000.627731740.00000000007A2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000000.548907669.0000000000722000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.445251023.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.610238464.0000000000722000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.552899490.0000000000FB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.410285813.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.408615715.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.447375879.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.386628983.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.446671445.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.409570794.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.679442760.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: healastounding.exe PID: 3572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gay.exe PID: 1104, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mediaget.exe PID: 4688, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\gay.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a797c6ca3f5e7aff8fa1149c47fe9466.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\mediaget.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\healastounding.exe, type: DROPPED

Yara detected Mimikatz

Source: Yara match	File source: 00000032.00000002.658863684.0000000010101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000035.00000002.705801059.0000000010101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.598333947.0000000010101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Ficker Stealer

Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.0fd7de5367376231a788872005d7ed4f.exe.24f15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.18.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.0fd7de5367376231a788872005d7ed4f.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.0fd7de5367376231a788872005d7ed4f.exe.24f15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.468272297.00000000024F0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected WebBrowserPassView password recovery tool

Source: Yara match	File source: RIP_YOUR_PC_LOL.exe, type: SAMPLE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.9fa0eb.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f10000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.1.RIP_YOUR_PC_LOL.exe.9fa0eb.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.f10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.f18208.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.9fa0eb.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.f19c0d.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.f19c0d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f18208.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.46b1030.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f18208.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.5707591.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.1.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f18208.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.4698e10.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f10000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f10000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.9f86e6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.46b1030.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f18208.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.9f86e6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.1.RIP_YOUR_PC_LOL.exe.9f86e6.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.711210574.0000000004691000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.394040229.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.394636472.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.701277187.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.502131214.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000001.375725825.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.397247474.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RIP_YOUR_PC_LOL.exe PID: 6880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Pluto Panel.exe PID: 4236, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Pluto Panel.exe, type: DROPPED

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000014.00000003.641078460.00000000035A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected HawkEye Keylogger

Source: Yara match	File source: RIP_YOUR_PC_LOL.exe, type: SAMPLE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f10000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.f6fa72.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.f10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.f18208.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Pluto Panel.exe.f19c0d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f18208.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f6fa72.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f18208.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.1.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f18208.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f6fa72.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f6fa72.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.9fa0eb.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f6fa72.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f10000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.5731eca.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f10000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f19c0d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.9f86e6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.Pluto Panel.exe.f18208.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.9f86e6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.1.RIP_YOUR_PC_LOL.exe.9f86e6.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.706080641.00000000036DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.394040229.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.394636472.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.701277187.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.502131214.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000001.375725825.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.397247474.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RIP_YOUR_PC_LOL.exe PID: 6880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Pluto Panel.exe PID: 4236, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Pluto Panel.exe, type: DROPPED

Detected Nanocore Rat

Source: healastounding.exe	String found in binary or memory: NanoCore.ClientPluginHost
Source: healastounding.exe, 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: healastounding.exe, 00000004.00000002.546334194.0000000004474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: Opus.exe, 00000009.00000000.414257385.0000000000842000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: Opus.exe, 00000009.00000002.707363158.0000000003ECB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: Opus.exe, 00000009.00000002.707363158.0000000003ECB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: Opus.exe, 00000009.00000002.703475232.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: Opus.exe, 00000009.00000002.703475232.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: Opus.exe, 00000009.00000002.708577022.0000000005870000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: Opus.exe, 00000009.00000002.708577022.0000000005870000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: Opus.exe, 00000009.00000002.708751563.0000000005B00000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost

Yara detected Nanocore RAT

Source: Yara match	File source: RIP_YOUR_PC_LOL.exe, type: SAMPLE
Source: Yara match	File source: 9.2.Opus.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.Opus.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.5b00000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.4474268.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.5b00000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.4474268.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.Opus.exe.840000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.3edeacc.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.Opus.exe.840000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.3ed9c96.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.3edeacc.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.3ee30f5.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.902324.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Opus.exe.5b04629.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.Opus.exe.840000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000000.414257385.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.707363158.0000000003ECB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.414807841.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.416456851.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.700831183.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.475797127.0000000000572000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.567040014.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000000.491059532.0000000000272000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.629223400.0000000000572000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.415266906.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.579383399.0000000004081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.514866763.0000000000922000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.546334194.0000000004474000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.461250332.0000000000922000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.679442760.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.708751563.0000000005B00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.674377761.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.673042782.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: healastounding.exe PID: 3572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Opus.exe PID: 3244, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Opus.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\healastounding.exe, type: DROPPED

Yara detected DCRat

Source: Yara match	File source: 00000025.00000000.491609227.00000000002A2000.00000002.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\3.exe, type: DROPPED

Detected njRat

Source: gay.exe.4.dr, OK.cs

.Net Code: njRat config detected

Yara detected Njrat

Source: Yara match	File source: RIP_YOUR_PC_LOL.exe, type: SAMPLE
Source: Yara match	File source: 4.2.healastounding.exe.34865dc.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.gay.exe.d0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.gay.exe.d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1d1caed.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.3479694.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.mediaget.exe.ab0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.mediaget.exe.ab0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.95312e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.3474284.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.mediaget.exe.ab0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.gay.exe.d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.gay.exe.d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.34865dc.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1d1caed.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.mediaget.exe.ab0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.5707591.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce9ce8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.mediaget.exe.ab0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.gay.exe.d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.RIP_YOUR_PC_LOL.exe.5725596.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.935129.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.902324.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.1ce97c4.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.95312e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.healastounding.exe.900000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.411478373.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.449565052.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000000.507357595.0000000000FB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.445953483.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.701265514.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000003B.00000000.627731740.00000000007A2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000000.548907669.0000000000722000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.445251023.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.610238464.0000000000722000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.552899490.0000000000FB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.410285813.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.408615715.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.447375879.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.386628983.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.446671445.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.409570794.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.679442760.0000000001893000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: healastounding.exe PID: 3572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gay.exe PID: 1104, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mediaget.exe PID: 4688, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\gay.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a797c6ca3f5e7aff8fa1149c47fe9466.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\mediaget.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\healastounding.exe, type: DROPPED

Detected HawkEye Rat

Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: \pidloc.txt!HawkEyeKeylogger
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Installed Firewall: MHawkEye_Keylogger_Execution_Confirmed_.txtUHawkEye Keylogger \| Execution Confirmed \|
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: ==============================================EHawkEye_Keylogger_Stealer_Records_MHawkEye Keylogger \| Stealer Records \|
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: .jpegCHawkEye_Keylogger_Keylog_Records_
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \pidloc.txt!HawkEyeKeylogger
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Installed Firewall: MHawkEye_Keylogger_Execution_Confirmed_.txtUHawkEye Keylogger \| Execution Confirmed \|
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ==============================================EHawkEye_Keylogger_Stealer_Records_MHawkEye Keylogger \| Stealer Records \|
Source: RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: .jpegCHawkEye_Keylogger_Keylog_Records_
Source: Pluto Panel.exe	String found in binary or memory: HawkEye_Keylogger_Stealer_Records_
Source: Pluto Panel.exe	String found in binary or memory: HawkEyeKeylogger
Source: Pluto Panel.exe	String found in binary or memory: HawkEye_Keylogger_Keylog_Records_
Source: Pluto Panel.exe	String found in binary or memory: HawkEye_Keylogger_Execution_Confirmed_
Source: Pluto Panel.exe, 00000005.00000002.710776976.0000000003B1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: HqA@HawkEye_Keylogger_Stealer_Records_813435 3.8.2022 6:03:10 PM.txt
Source: Pluto Panel.exe, 00000005.00000002.710776976.0000000003B1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Hq\[ftp://files.000webhost.com/HawkEye_Keylogger_Stealer_Records_813435 3.8.2022 6:03:10 PM.txt
Source: Pluto Panel.exe, 00000005.00000002.710776976.0000000003B1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ftp://files.000webhost.com/HawkEye_Keylogger_Stealer_Records_813435%203.8.2022%206:03:10%20PM.txt
Source: Pluto Panel.exe, 00000005.00000002.710776976.0000000003B1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Hqbaftp://files.000webhost.com/HawkEye_Keylogger_Stealer_Records_813435%203.8.2022%206:03:10%20PM.txt
Source: Pluto Panel.exe, 00000005.00000002.710776976.0000000003B1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: HqBA/HawkEye_Keylogger_Stealer_Records_813435 3.8.2022 6:03:10 PM.txt
Source: Pluto Panel.exe, 00000005.00000002.710776976.0000000003B1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: HqA@HawkEye_Keylogger_Stealer_Records_813435 3.8.2022 6:03:10 PM.txtd8
Source: Pluto Panel.exe, 00000005.00000002.710776976.0000000003B1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: HqHGSTOR HawkEye_Keylogger_Stealer_Records_813435 3.8.2022 6:03:10 PM.txt
Source: Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: \pidloc.txt!HawkEyeKeylogger
Source: Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: Installed Firewall: MHawkEye_Keylogger_Execution_Confirmed_.txtUHawkEye Keylogger \| Execution Confirmed \|
Source: Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: ==============================================EHawkEye_Keylogger_Stealer_Records_MHawkEye Keylogger \| Stealer Records \|
Source: Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: .jpegCHawkEye_Keylogger_Keylog_Records_
Source: Pluto Panel.exe, 00000005.00000002.706080641.00000000036DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Hq'&HawkEye_Keylogger_Execution_Confirmed_
Source: Pluto Panel.exe, 00000005.00000002.705753147.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: HawkEyeKeylogger
Source: Pluto Panel.exe, 00000005.00000002.706244077.0000000003705000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Hq#"HawkEye_Keylogger_Stealer_Records_

Yara detected Ficker Stealer

Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.0fd7de5367376231a788872005d7ed4f.exe.24f15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.18.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.0fd7de5367376231a788872005d7ed4f.exe.400000.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.0fd7de5367376231a788872005d7ed4f.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.0fd7de5367376231a788872005d7ed4f.exe.24f15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.468272297.00000000024F0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_03230A8E listen,
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_03230E9E bind,
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_03230E6B bind,
Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe	Code function: 5_2_03230A50 listen,

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Replication Through Removable Media	12 Native API	1 DLL Side-Loading	1 DLL Side-Loading	21 Disable or Modify Tools	121 Input Capture	1 System Time Discovery	1 Replication Through Removable Media	11 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Shared Modules	2 Windows Service	2 Windows Service	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Peripheral Device Discovery	Remote Desktop Protocol	121 Input Capture	Exfiltration Over Bluetooth	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Scheduled Task/Job	2 Scheduled Task/Job	212 Process Injection	141 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	221 Registry Run Keys / Startup Folder	2 Scheduled Task/Job	15 Software Packing	NTDS	14 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Remote Access Software	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	221 Registry Run Keys / Startup Folder	1 Timestomp	LSA Secrets	1 Query Registry	SSH	Keylogging	Data Transfer Size Limits	2 Non-Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 DLL Side-Loading	Cached Domain Credentials	221 Security Software Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	112 Application Layer Protocol	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	22 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	21 Virtualization/Sandbox Evasion	Proc Filesystem	21 Virtualization/Sandbox Evasion	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	212 Process Injection	/etc/passwd and /etc/shadow	1 Remote System Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Hidden Files and Directories	Network Sniffing	1 System Network Configuration Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RIP_YOUR_PC_LOL.exe	63%	Virustotal		Browse
RIP_YOUR_PC_LOL.exe	33%	Metadefender		Browse
RIP_YOUR_PC_LOL.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.Remcos
RIP_YOUR_PC_LOL.exe	100%	Avira	TR/AD.MExecute.lzrac
RIP_YOUR_PC_LOL.exe	100%	Avira	SPR/Tool.MailPassView.473
RIP_YOUR_PC_LOL.exe	100%	Avira	TR/AD.MalwareCrypter.rrsdk
RIP_YOUR_PC_LOL.exe	100%	Avira	TR/Dropper.GR
RIP_YOUR_PC_LOL.exe	100%	Avira	TR/Agent.aagt
RIP_YOUR_PC_LOL.exe	100%	Avira	TR/AD.RedLineSteal.cjshc
RIP_YOUR_PC_LOL.exe	100%	Avira	TR/Dropper.MSIL.Gen7
RIP_YOUR_PC_LOL.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\Opus.exe	100%	Avira	TR/Dropper.MSIL.Gen7
C:\Users\user\AppData\Roaming\mediaget.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Roaming\___11.19.exe	100%	Avira	TR/Dropper.GR
C:\Users\user\AppData\Roaming\___11.19.exe	100%	Avira	TR/Agent.aagt
C:\Users\user\AppData\Roaming\healastounding.exe	100%	Avira	TR/AD.RedLineSteal.cjshc
C:\Users\user\AppData\Roaming\healastounding.exe	100%	Avira	TR/Dropper.MSIL.Gen7
C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe	100%	Avira	TR/AD.MalwareCrypter.rrsdk
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	100%	Avira	TR/Dropper.MSIL.Gen7
C:\Windows\Help\active_desktop_render.dll	100%	Avira	HEUR/AGEN.1245024
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a797c6ca3f5e7aff8fa1149c47fe9466.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Roaming\gay.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\Dcvxaamev.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\22.exe	100%	Avira	HEUR/AGEN.1227810
C:\Users\user\AppData\Roaming\Pluto Panel.exe	100%	Avira	TR/AD.MExecute.lzrac
C:\Users\user\AppData\Roaming\Pluto Panel.exe	100%	Avira	SPR/Tool.MailPassView.473
C:\Windows\Cursors\WUDFhosts.exe	100%	Avira	HEUR/AGEN.1213003
C:\Users\user\AppData\Roaming\a.exe	100%	Avira	TR/AD.RedLineSteal.cjshc
C:\Users\user\AppData\Roaming\3.exe	100%	Avira	HEUR/AGEN.1203070
C:\Users\user\AppData\Roaming\test.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\aaa.exe	100%	Avira	TR/Dropper.MSIL.Gen
C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Opus.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\mediaget.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\___11.19.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\healastounding.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	100%	Joe Sandbox ML
C:\Windows\Help\active_desktop_render.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a797c6ca3f5e7aff8fa1149c47fe9466.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\gay.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Dcvxaamev.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\22.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Pluto Panel.exe	100%	Joe Sandbox ML
C:\Windows\Cursors\WUDFhosts.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\a.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\test.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\aaa.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	85%	Metadefender		Browse
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	100%	ReversingLabs	ByteCode-MSIL.Backdoor.NanoCore
C:\Users\user\AppData\Local\Temp\Dcvxaamev.exe	29%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\Dcvxaamev.exe	86%	ReversingLabs	Win32.Trojan.Fragtor
C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe	29%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe	86%	ReversingLabs	Win32.Infostealer.Azorult
C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe	29%	Metadefender		Browse
C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe	92%	ReversingLabs	Win32.Ransomware.StopCrypt
C:\Users\user\AppData\Roaming\22.exe	38%	Metadefender		Browse
C:\Users\user\AppData\Roaming\22.exe	86%	ReversingLabs	Win32.Trojan.BlackMoon
C:\Users\user\AppData\Roaming\3.exe	47%	Metadefender		Browse
C:\Users\user\AppData\Roaming\3.exe	82%	ReversingLabs	ByteCode-MSIL.Trojan.SpyNoon
C:\Users\user\AppData\Roaming\4.exe	17%	Metadefender		Browse
C:\Users\user\AppData\Roaming\4.exe	75%	ReversingLabs	Win32.Trojan.SpyNoon
C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	26%	Metadefender		Browse
C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe	86%	ReversingLabs	Win32.Infostealer.Azorult

Unpacked PE Files

Source	Detection	Scanner	Label	Download
11.0.22.exe.400000.12.unpack	100%	Avira	HEUR/AGEN.1227810	Download File
9.2.Opus.exe.840000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
14.0.8f1c8b40c7be588389a8d382040b23bb.exe.476f20.4.unpack	100%	Avira	TR/Dropper.Gen	Download File
7.0.0fd7de5367376231a788872005d7ed4f.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1242347	Download File
4.0.healastounding.exe.900000.4.unpack	100%	Avira	TR/AD.RedLineSteal.cjshc	Download File
4.0.healastounding.exe.900000.4.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
5.0.Pluto Panel.exe.f10000.8.unpack	100%	Avira	TR/AD.MExecute.lzrac	Download File
5.0.Pluto Panel.exe.f10000.8.unpack	100%	Avira	SPR/Tool.MailPassView.473	Download File
9.0.Opus.exe.840000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
5.2.Pluto Panel.exe.f10000.0.unpack	100%	Avira	TR/AD.MExecute.lzrac	Download File
5.2.Pluto Panel.exe.f10000.0.unpack	100%	Avira	SPR/Tool.MailPassView.473	Download File
14.0.8f1c8b40c7be588389a8d382040b23bb.exe.4bdf52.2.unpack	100%	Avira	TR/Dropper.Gen	Download File
12.2.aaa.exe.2c0000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen	Download File
8.0.gay.exe.d0000.2.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
12.0.aaa.exe.2c0000.2.unpack	100%	Avira	TR/Dropper.MSIL.Gen	Download File
0.3.RIP_YOUR_PC_LOL.exe.57b3478.6.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
7.0.0fd7de5367376231a788872005d7ed4f.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1242347	Download File
11.0.22.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1227810	Download File
0.2.RIP_YOUR_PC_LOL.exe.5755c99.18.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
11.0.22.exe.457136.14.unpack	100%	Avira	TR/Crypt.XPACK.Gen7	Download File
0.1.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack	100%	Avira	TR/Inject.vcoldi	Download File
14.0.8f1c8b40c7be588389a8d382040b23bb.exe.400000.3.unpack	100%	Avira	TR/Dropper.Gen	Download File
6.2.test.exe.da0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
8.2.gay.exe.d0000.0.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
12.0.aaa.exe.2c0000.1.unpack	100%	Avira	TR/Dropper.MSIL.Gen	Download File
4.2.healastounding.exe.900000.0.unpack	100%	Avira	TR/AD.RedLineSteal.cjshc	Download File
4.2.healastounding.exe.900000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
14.0.8f1c8b40c7be588389a8d382040b23bb.exe.476f20.1.unpack	100%	Avira	TR/Dropper.Gen	Download File
4.0.healastounding.exe.900000.0.unpack	100%	Avira	TR/AD.RedLineSteal.cjshc	Download File
4.0.healastounding.exe.900000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
14.0.8f1c8b40c7be588389a8d382040b23bb.exe.400000.6.unpack	100%	Avira	TR/Dropper.Gen	Download File
9.2.Opus.exe.5b00000.7.unpack	100%	Avira	TR/NanoCore.fadte	Download File
14.0.8f1c8b40c7be588389a8d382040b23bb.exe.4bdf52.5.unpack	100%	Avira	TR/Dropper.Gen	Download File
11.0.22.exe.457136.21.unpack	100%	Avira	TR/Crypt.XPACK.Gen7	Download File
0.1.RIP_YOUR_PC_LOL.exe.dda1e2.6.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
14.0.8f1c8b40c7be588389a8d382040b23bb.exe.400000.9.unpack	100%	Avira	TR/Dropper.Gen	Download File
0.2.RIP_YOUR_PC_LOL.exe.e387f7.8.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
11.0.22.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1227810	Download File
6.0.test.exe.da0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
17.0.mediaget.exe.ab0000.3.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
0.2.RIP_YOUR_PC_LOL.exe.d587a1.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen7	Download File
11.0.22.exe.43de6f.2.unpack	100%	Avira	HEUR/AGEN.1245024	Download File
17.0.mediaget.exe.ab0000.0.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
11.0.22.exe.43de6f.19.unpack	100%	Avira	HEUR/AGEN.1245024	Download File
11.0.22.exe.457136.9.unpack	100%	Avira	TR/Crypt.XPACK.Gen7	Download File
9.0.Opus.exe.840000.3.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
11.0.22.exe.400000.18.unpack	100%	Avira	HEUR/AGEN.1227810	Download File
14.0.8f1c8b40c7be588389a8d382040b23bb.exe.4bdf52.8.unpack	100%	Avira	TR/Dropper.Gen	Download File
11.0.22.exe.43de6f.13.unpack	100%	Avira	HEUR/AGEN.1245024	Download File
14.0.8f1c8b40c7be588389a8d382040b23bb.exe.476f20.10.unpack	100%	Avira	TR/Dropper.Gen	Download File
0.0.RIP_YOUR_PC_LOL.exe.9f22de.1.unpack	100%	Avira	TR/Inject.vcoldi	Download File
17.2.mediaget.exe.ab0000.0.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
14.0.8f1c8b40c7be588389a8d382040b23bb.exe.476f20.7.unpack	100%	Avira	TR/Dropper.Gen	Download File
0.3.RIP_YOUR_PC_LOL.exe.5839748.8.unpack	100%	Avira	HEUR/AGEN.1227785	Download File
9.0.Opus.exe.840000.1.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
8.0.gay.exe.d0000.1.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
8.0.gay.exe.d0000.0.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
11.0.22.exe.457136.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen7	Download File
0.0.RIP_YOUR_PC_LOL.exe.ea57bf.9.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
4.2.healastounding.exe.4582ffa.11.unpack	100%	Avira	TR/Dropper.Gen	Download File
11.0.22.exe.43de6f.7.unpack	100%	Avira	HEUR/AGEN.1245024	Download File
0.0.RIP_YOUR_PC_LOL.exe.e387f7.8.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.0.RIP_YOUR_PC_LOL.exe.dda1e2.7.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
12.0.aaa.exe.2c0000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen	Download File
0.2.RIP_YOUR_PC_LOL.exe.56d4258.19.unpack	100%	Avira	TR/Crypt.XPACK.Gen7	Download File
17.0.mediaget.exe.ab0000.1.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
0.1.RIP_YOUR_PC_LOL.exe.d587a1.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen7	Download File
0.2.RIP_YOUR_PC_LOL.exe.dda1e2.6.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
4.0.healastounding.exe.900000.12.unpack	100%	Avira	TR/AD.RedLineSteal.cjshc	Download File
4.0.healastounding.exe.900000.12.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
0.3.RIP_YOUR_PC_LOL.exe.5956fd2.3.unpack	100%	Avira	TR/Dropper.Gen	Download File
7.0.0fd7de5367376231a788872005d7ed4f.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1242347	Download File
6.0.test.exe.da0000.2.unpack	100%	Avira	TR/Dropper.Gen	Download File
5.0.Pluto Panel.exe.f10000.4.unpack	100%	Avira	TR/AD.MExecute.lzrac	Download File
5.0.Pluto Panel.exe.f10000.4.unpack	100%	Avira	SPR/Tool.MailPassView.473	Download File
0.0.RIP_YOUR_PC_LOL.exe.d587a1.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen7	Download File
5.0.Pluto Panel.exe.f10000.12.unpack	100%	Avira	TR/AD.MExecute.lzrac	Download File
5.0.Pluto Panel.exe.f10000.12.unpack	100%	Avira	SPR/Tool.MailPassView.473	Download File
5.0.Pluto Panel.exe.f10000.0.unpack	100%	Avira	TR/AD.MExecute.lzrac	Download File
5.0.Pluto Panel.exe.f10000.0.unpack	100%	Avira	SPR/Tool.MailPassView.473	Download File
6.0.test.exe.da0000.3.unpack	100%	Avira	TR/Dropper.Gen	Download File
0.2.RIP_YOUR_PC_LOL.exe.5821276.21.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.1.RIP_YOUR_PC_LOL.exe.e387f7.7.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.0.RIP_YOUR_PC_LOL.exe.1f6c52e.15.unpack	100%	Avira	TR/Dropper.Gen	Download File
0.2.RIP_YOUR_PC_LOL.exe.1f6c52e.15.unpack	100%	Avira	TR/Dropper.Gen	Download File
7.2.0fd7de5367376231a788872005d7ed4f.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1242347	Download File
12.0.aaa.exe.2c0000.3.unpack	100%	Avira	TR/Dropper.MSIL.Gen	Download File
0.2.RIP_YOUR_PC_LOL.exe.9f22de.3.unpack	100%	Avira	TR/Inject.vcoldi	Download File
7.2.0fd7de5367376231a788872005d7ed4f.exe.24f15a0.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
14.0.8f1c8b40c7be588389a8d382040b23bb.exe.4bdf52.11.unpack	100%	Avira	TR/Dropper.Gen	Download File
0.1.RIP_YOUR_PC_LOL.exe.ea57bf.8.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
14.0.8f1c8b40c7be588389a8d382040b23bb.exe.400000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
4.2.healastounding.exe.44c50a8.8.unpack	100%	Avira	TR/Dropper.Gen	Download File
0.2.RIP_YOUR_PC_LOL.exe.57b42ae.20.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
7.0.0fd7de5367376231a788872005d7ed4f.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1242347	Download File
17.0.mediaget.exe.ab0000.2.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
9.0.Opus.exe.840000.2.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
8.0.gay.exe.d0000.3.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
4.0.healastounding.exe.900000.8.unpack	100%	Avira	TR/AD.RedLineSteal.cjshc	Download File
4.0.healastounding.exe.900000.8.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.tiro.com=	0%	Avira URL Cloud	safe
http://www.urwpp.derasg	0%	Avira URL Cloud	safe
http://www.fontbureau.comd&	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.sakkal.comm	0%	Avira URL Cloud	safe
http://www.fontbureau.comlicd	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/)	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.tiro.com&	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.microsof	0%	URL Reputation	safe
http://www.i.	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/X	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Q	0%	URL Reputation	safe
http://www.carterandcone.comY	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cno.W	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/J	0%	URL Reputation	safe
http://www.zhongyicts.com.cnm	0%	URL Reputation	safe
http://www.carterandcone.comt	0%	URL Reputation	safe
http://www.founder.com.cn/cncz	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.zhongyicts.co	0%	Avira URL Cloud	safe
http://www.fonts.comC	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/)	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/eu-e	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/n	0%	URL Reputation	safe
http://www.zhongyicts.com.cnY	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/i	0%	URL Reputation	safe
http://www.fontbureau.comitu	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/g	0%	URL Reputation	safe
http://www.freeeim.com/D	0%	Avira URL Cloud	safe
http://www.tiro.comic	0%	URL Reputation	safe
http://www.founder.com.cn/cncz$	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn$	0%	URL Reputation	safe
http://www.carterandcone.comkC	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/ls	0%	Avira URL Cloud	safe
http://www.fontbureau.comFX	0%	Avira URL Cloud	safe
http://www.urwpp.deMTq	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/C	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/J	0%	URL Reputation	safe
http://www.founder.com.cn/cnT	0%	URL Reputation	safe
http://www.zhongyicts.com.cnts	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.fontbureau.comoX	0%	Avira URL Cloud	safe
http://www.carterandcone.com.	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cnv	0%	URL Reputation	safe
http://www.fontbureau.comrsiv	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.carterandcone.como.W	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/X	0%	URL Reputation	safe
http://www.fontbureau.comonyn	0%	Avira URL Cloud	safe
http://www.fontbureau.comF	0%	URL Reputation	safe
http://www.fontbureau.comsiv/C	0%	Avira URL Cloud	safe
http://www.carterandcone.comTC	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://www.founder.com.cp	0%	Avira URL Cloud	safe
http://www.urwpp.deR	0%	Avira URL Cloud	safe
http://www.fontbureau.comtu	0%	Avira URL Cloud	safe
https://whatismyipaddress.comx&	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.comd	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
kazya1.hopto.org	41.249.51.34	true	false	high
yabynennet.xyz	45.129.99.212	true	false	high
api.ipify.org.herokudns.com	52.20.78.240	true	false	high
whatismyipaddress.com	104.16.154.36	true	false	high
pool.usa-138.com	220.86.85.75	true	false	high
hackerinvasion.f3322.net	127.0.0.1	true	false	high
us-east-1.route-1000.000webhost.awex.io	145.14.144.149	true	false	high
gfhhjgh.duckdns.org	179.13.1.253	true	false	high
files.000webhost.com	unknown	unknown	false	high
22ssh.com	unknown	unknown	false	high
123.105.12.0.in-addr.arpa	unknown	unknown	false	high
store-images.s-microsoft.com	unknown	unknown	false	high
pretorian.ac.ug	unknown	unknown	false	high
api.ip.sb	unknown	unknown	false	high
api.ipify.org	unknown	unknown	false	high
prepepe.ac.ug	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://api.ipify.org/?format=xml	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.tiro.com=	Pluto Panel.exe, 00000005.00000003.445903668.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.urwpp.derasg	Pluto Panel.exe, 00000005.00000003.494373371.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.493190429.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.497114575.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comd&	Pluto Panel.exe, 00000005.00000003.539432667.0000000005C5C000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.561809650.0000000005C54000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designers	Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.comm	Pluto Panel.exe, 00000005.00000003.461535327.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.462539198.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0	healastounding.exe, healastounding.exe, 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, healastounding.exe, 00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp, gay.exe, gay.exe, 00000008.00000000.411478373.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, mediaget.exe, 00000011.00000000.445953483.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, mediaget.exe, 00000011.00000003.646152049.0000000001338000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.comlicd	Pluto Panel.exe, 00000005.00000003.620876949.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.645268957.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.630356431.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.585753311.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.593605825.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://whatismyipaddress.com/-	RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	false		high
http://www.galapagosdesign.com/DPlease	Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/)	Pluto Panel.exe, 00000005.00000003.448193641.0000000005C53000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457715522.0000000005C56000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.452001254.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457092303.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.ascendercorp.com/typedesigners.html	Pluto Panel.exe, 00000005.00000003.462837238.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.463380932.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.461983546.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460984251.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.site.com/logs.php	Pluto Panel.exe, 00000005.00000002.705753147.0000000003691000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com&	Pluto Panel.exe, 00000005.00000003.434485944.0000000005C7E000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.434712918.0000000005C7F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.urwpp.deDPlease	Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://whatismyipaddress.com/	Pluto Panel.exe, Pluto Panel.exe, 00000005.00000002.705753147.0000000003691000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.nirsoft.net/	Pluto Panel.exe, 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp	false		high
http://www.zhongyicts.com.cn	Pluto Panel.exe, 00000005.00000003.437487558.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437239432.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.436798009.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.436695339.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437023378.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.microsof	healastounding.exe	false	URL Reputation: safe	unknown
http://www.i.	Pluto Panel.exe, 00000005.00000003.423909901.0000000005C85000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.425696650.0000000005C85000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/X	Pluto Panel.exe, 00000005.00000003.448193641.0000000005C53000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.459485550.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460010944.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.452001254.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.461983546.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460984251.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Q	Pluto Panel.exe, 00000005.00000003.459485550.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457715522.0000000005C56000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460010944.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.452001254.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457092303.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.461983546.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460984251.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comY	Pluto Panel.exe, 00000005.00000003.440045453.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.441297022.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cno.W	Pluto Panel.exe, 00000005.00000003.437487558.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437239432.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.436798009.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.436695339.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437773657.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437023378.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/J	Pluto Panel.exe, 00000005.00000003.448193641.0000000005C53000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cnm	Pluto Panel.exe, 00000005.00000003.436695339.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comt	Pluto Panel.exe, 00000005.00000003.437023378.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cncz	Pluto Panel.exe, 00000005.00000003.431908494.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 22.exe, 0000000B.00000000.422804028.000000000042B000.00000008.00000001.01000000.0000000B.sdmp	false		high
http://www.carterandcone.coml	Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.cloudflare.com/5xx-error-landing	Pluto Panel.exe, 00000005.00000002.706003291.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/	Pluto Panel.exe, 00000005.00000003.434083509.0000000005C7E000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.433444494.0000000005C7E000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.432944886.0000000005C7F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.co	Pluto Panel.exe, 00000005.00000003.437773657.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.438069908.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	Pluto Panel.exe, 00000005.00000003.546333465.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.537131070.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.588600543.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.556315402.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.580567393.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.570425092.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.541181738.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.551450060.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.573427389.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.569553799.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.comC	Pluto Panel.exe, 00000005.00000003.413330512.0000000005C85000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 22.exe, 0000000B.00000000.422804028.000000000042B000.00000008.00000001.01000000.0000000B.sdmp	false		high
http://www.jiyu-kobo.co.jp/jp/)	Pluto Panel.exe, 00000005.00000003.459485550.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460010944.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.461983546.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460984251.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/eu-e	Pluto Panel.exe, 00000005.00000003.452001254.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/n	Pluto Panel.exe, 00000005.00000003.448193641.0000000005C53000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.462837238.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.459485550.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457715522.0000000005C56000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.463380932.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460010944.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.464082407.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.452001254.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457092303.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.461983546.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.464883846.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460984251.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cnY	Pluto Panel.exe, 00000005.00000003.437487558.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.439099390.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437239432.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.436798009.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.436695339.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437773657.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437023378.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.439790741.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.438069908.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/C	Pluto Panel.exe, 00000005.00000003.620876949.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.645268957.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.630356431.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.585753311.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.593605825.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/i	Pluto Panel.exe, 00000005.00000003.448193641.0000000005C53000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.452001254.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comitu	Pluto Panel.exe, 00000005.00000003.585753311.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.593605825.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.578609523.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/g	Pluto Panel.exe, 00000005.00000003.459485550.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457715522.0000000005C56000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460010944.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457092303.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.461983546.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460984251.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/accounts/servicelogin	Pluto Panel.exe	false		high
http://www.freeeim.com/D	RIP_YOUR_PC_LOL.exe, 00000000.00000000.367521899.0000000000E31000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000002.696610265.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.comic	Pluto Panel.exe, 00000005.00000003.445903668.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cncz$	Pluto Panel.exe, 00000005.00000003.431908494.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn$	Pluto Panel.exe, 00000005.00000003.431908494.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comkC	Pluto Panel.exe, 00000005.00000003.442021245.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.441503544.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.441818008.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/ls	Pluto Panel.exe, 00000005.00000003.448193641.0000000005C53000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comFX	Pluto Panel.exe, 00000005.00000003.539432667.0000000005C5C000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.561809650.0000000005C54000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.570284939.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersG	Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deMTq	Pluto Panel.exe, 00000005.00000003.646787103.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/jp/C	Pluto Panel.exe, 00000005.00000003.459485550.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457715522.0000000005C56000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.452001254.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457092303.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/jp/J	Pluto Panel.exe, 00000005.00000003.459485550.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457715522.0000000005C56000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.452001254.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457092303.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnT	Pluto Panel.exe, 00000005.00000003.433444494.0000000005C7E000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.432459781.0000000005C7F000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.432944886.0000000005C7F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cnts	Pluto Panel.exe, 00000005.00000003.437487558.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437239432.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.436798009.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.436695339.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437023378.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com	Pluto Panel.exe, 00000005.00000003.445443819.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437487558.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.439099390.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437239432.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.436798009.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437773657.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437023378.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.440045453.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.441297022.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.439790741.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.442021245.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.438069908.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.445694166.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.445564416.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.441503544.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.441818008.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.445818252.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comoX	Pluto Panel.exe, 00000005.00000002.711887980.0000000005C50000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.com.	Pluto Panel.exe, 00000005.00000003.436798009.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437023378.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersh	Pluto Panel.exe, 00000005.00000003.585753311.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 22.exe, 0000000B.00000000.422804028.000000000042B000.00000008.00000001.01000000.0000000B.sdmp	false		high
http://www.founder.com.cn/cnv	Pluto Panel.exe, 00000005.00000003.431908494.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://login.yahoo.com/config/login	Pluto Panel.exe	false		high
http://www.fontbureau.comrsiv	Pluto Panel.exe, 00000005.00000003.645268957.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	Pluto Panel.exe, 00000005.00000003.413764911.0000000005C85000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.413943860.0000000005C85000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.413057625.0000000005C85000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.413330512.0000000005C85000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.de	Pluto Panel.exe, 00000005.00000003.646787103.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.494373371.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.493190429.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.497114575.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	Pluto Panel.exe, 00000005.00000003.461983546.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.como.W	Pluto Panel.exe, 00000005.00000003.439099390.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.439790741.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.438069908.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/X	Pluto Panel.exe, 00000005.00000003.457715522.0000000005C56000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457092303.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comonyn	Pluto Panel.exe, 00000005.00000003.539432667.0000000005C5C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://whatismyipaddress.com/	Pluto Panel.exe, 00000005.00000002.705753147.0000000003691000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.706003291.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	Pluto Panel.exe, 00000005.00000003.620876949.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.645268957.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.630356431.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.585753311.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.593605825.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.539432667.0000000005C5C000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.561809650.0000000005C54000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.570284939.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.578609523.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comF	Pluto Panel.exe, 00000005.00000003.645268957.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.539432667.0000000005C5C000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.561809650.0000000005C54000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comsiv/C	Pluto Panel.exe, 00000005.00000003.539432667.0000000005C5C000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.561809650.0000000005C54000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.570284939.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comTC	Pluto Panel.exe, 00000005.00000003.437487558.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437239432.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.437023378.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.thawte.com0	RIP_YOUR_PC_LOL.exe, 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, RIP_YOUR_PC_LOL.exe, 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 22.exe, 0000000B.00000000.422804028.000000000042B000.00000008.00000001.01000000.0000000B.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cp	Pluto Panel.exe, 00000005.00000003.431908494.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deR	Pluto Panel.exe, 00000005.00000003.494373371.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.493190429.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.497114575.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comtu	Pluto Panel.exe, 00000005.00000003.570284939.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://whatismyipaddress.comx&	Pluto Panel.exe, 00000005.00000002.706003291.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://whatismyipaddress.com	Pluto Panel.exe, 00000005.00000002.705753147.0000000003691000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/jp/	Pluto Panel.exe, 00000005.00000003.462837238.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.459485550.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457715522.0000000005C56000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.463380932.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460010944.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.464082407.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.457092303.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.461983546.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.464883846.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp, Pluto Panel.exe, 00000005.00000003.460984251.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlf	Pluto Panel.exe, 00000005.00000003.569553799.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.coma	Pluto Panel.exe, 00000005.00000002.711887980.0000000005C50000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comd	Pluto Panel.exe, 00000005.00000003.539432667.0000000005C5C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Pluto Panel.exe, 00000005.00000002.712090794.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
179.13.1.253	gfhhjgh.duckdns.org	Colombia	27831	ColombiaMovilCO	false
172.98.92.42	unknown	United States	46562	TOTAL-SERVER-SOLUTIONSUS	false
41.249.51.34	kazya1.hopto.org	Morocco	36903	MT-MPLSMA	false
52.20.78.240	api.ipify.org.herokudns.com	United States	14618	AMAZON-AESUS	false
80.87.192.115	unknown	Russian Federation	29182	THEFIRST-ASRU	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	585264
Start date:	08.03.2022
Start time:	17:59:22
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 15m 34s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	RIP_YOUR_PC_LOL.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	61
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.adwa.spyw.evad.winEXE@84/32@48/5
EGA Information:	Successful, ratio: 83.3%
HDC Information:	Successful, ratio: 15.8% (good quality ratio 14.3%) Quality average: 70.3% Quality standard deviation: 31.5%
HCA Information:	Successful, ratio: 83% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 23.211.6.115, 104.26.13.31, 172.67.75.172, 104.26.12.31, 20.190.160.129, 20.190.160.75, 20.190.160.6, 20.190.160.136, 20.190.160.73, 20.190.160.132, 20.190.160.69, 20.190.160.67, 20.42.65.92, 20.82.209.104, 80.67.82.211, 80.67.82.235
Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net, fs.microsoft.com, www.tm.lg.prod.aadmsa.akadns.net, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, www.tm.a.prd.aadg.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, login.msa.msidentity.com, iris-de-ppe-azsc-neu.northeurope.cloudapp.azure.com, e12564.dspb.akamaiedge.net, onedsblobprdeus17.eastus.cloudapp.azure.com, login.live.com, blobcollector.events.data.trafficmanager.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net
Execution Graph export aborted for target test.exe, PID 6236 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing behavior and disassembly information.
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
18:01:04	API Interceptor	1x Sleep call for process: aaa.exe modified
18:01:13	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run DHCP Monitor C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
18:01:14	Task Scheduler	Run new task: DHCP Monitor path: "C:\Users\user\AppData\Roaming\Opus.exe" s>$(Arg0)
18:01:22	Task Scheduler	Run new task: DHCP Monitor Task path: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" s>$(Arg0)
18:01:22	API Interceptor	88x Sleep call for process: Opus.exe modified
18:01:23	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run a797c6ca3f5e7aff8fa1149c47fe9466 "C:\Users\user\AppData\Roaming\mediaget.exe" ..
18:01:39	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run a797c6ca3f5e7aff8fa1149c47fe9466 "C:\Users\user\AppData\Roaming\mediaget.exe" ..
18:01:54	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a797c6ca3f5e7aff8fa1149c47fe9466.exe
18:02:13	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run a797c6ca3f5e7aff8fa1149c47fe9466 "C:\Users\user\AppData\Roaming\mediaget.exe" ..
18:02:48	Task Scheduler	Run new task: dwm path: "C:\Windows\System32\srvsvc\dwm.exe"
18:02:51	Task Scheduler	Run new task: conhost path: "C:\Windows\System32\mssip32\conhost.exe"
18:02:52	Task Scheduler	Run new task: RuntimeBroker path: "C:\Windows\System32\WindowsDefaultHeatProcessor\RuntimeBroker.exe"
18:02:52	Task Scheduler	Run new task: services path: "C:\Users\Public\Documents\My Music\services.exe"
18:02:52	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Windows Update C:\Users\user\AppData\Roaming\WindowsUpdate.exe
18:02:55	Task Scheduler	Run new task: 8f1c8b40c7be588389a8d382040b23bb path: "C:\Documents and Settings\Public\Desktop\8f1c8b40c7be588389a8d382040b23bb.exe"
18:02:55	Task Scheduler	Run new task: explorer path: "C:\Windows\winhlp32\explorer.exe"
18:02:55	Task Scheduler	Run new task: mediaget path: "C:\Windows\CbsTemp\mediaget.exe"
18:03:04	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Windows Update C:\Users\user\AppData\Roaming\WindowsUpdate.exe
18:03:12	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run dwm "C:\Windows\System32\srvsvc\dwm.exe"
18:03:22	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\Windows\System32\WindowsDefaultHeatProcessor\RuntimeBroker.exe"

Process:	C:\Users\user\AppData\Roaming\Opus.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	208384
Entropy (8bit):	7.449669736966968
Encrypted:	false
SSDEEP:	6144:cLV6Bta6dtJmakIM5zEN/wjwJsvle+o9f/N:cLV6Btpmk1Elepd
MD5:	759185EE3724D7563B709C888C696959
SHA1:	7C166CC3CBFEF08BB378BCF557B1F45396A22931
SHA-256:	9384798985672C356A8A41BF822443F8EB0D3747BFCA148CE814594C1A894641
SHA-512:	ED754357B1B995DE918AF21FECD9D1464BDEA6778F7AB450A34E3AAE22BA7EEBC02F2442AF13774ABFDF97954E419EC9E356B54506C7E3BF12E3B76EE882FA2C
Malicious:	true
Yara Hits:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, Author: Joe Security Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, Author: ditekSHen Rule: NanoCore, Description: unknown, Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, Author: Kevin Breen <kevin@techanarchy.net>
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 85%, Browse Antivirus: ReversingLabs, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....'.T.....................d........... ........@.. ......................................................................8...W.... ..$`........................................................................... ............... ..H............text........ ...................... ..`.reloc..............................@..B.rsrc...$`... ...b..................@..@................t.......H...........T............................................................0..Q........o5........o6....-.&......3+..+.... ....3......1..... 2.... ....3.... ............0..E.......s7....-(&s8....-&&s9....,$&s:........s;.............+.....+.....+.....0..........~....o<.....0..........~....o=.....0..........~....o>.....0..........~....o?.....0..........~....o@.....0.............-.&(A...&+...0..$.......~B........-.(...+.-.&+..B...+.~B....0.............-.&(A...&+...0..

C:\ProgramData\kaosdma.txt

Download File

Process:	C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.6464393446710157
Encrypted:	false
SSDEEP:	3:HLLv:fv
MD5:	7AE4BED9A9648A53C3508D11671EF714
SHA1:	C349F54BAAA203AB3DC98498C49851C0704DD217
SHA-256:	C355B022F11CFAD7126BBD035784DAB1E94C3604D1528A130465E823C6EC1149
SHA-512:	7E3C40C668FAA94C9C1420B70405F41181BAE21F906C48164828E5427F66950483C4056E48C1FFF56634A5CDD943E5B1E40B8BEC798F4349E46263B21D7E1C6E
Malicious:	false
Reputation:	unknown
Preview:	84.17.52.7

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RIP_YOUR_PC_LOL.exe.log

Download File

Process:	C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	5.185983766127119
Encrypted:	false
SSDEEP:	3:QHXMKaZImrnLCR2RAVIAQyz2QyDBLnDLFv:Q3LadLCR22IAQykdL1v
MD5:	1F5C279D069793BFDB15F6DAC63D5C39
SHA1:	EFA436296EE3BC196FFC4FBD48978A4A1BB6FD34
SHA-256:	007D94877B5C9048FDC238CF6E63516F2BF398588878947E1DC4A4E55553602D
SHA-512:	48270029CAB2C46093058BDB28795ECA137656C1B4EB9E1EFD2111EA42997B29312B7A0EBFD6EB411375F799754D2403C233D0FF6B65103AEFABDE68268ED747
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\aaa.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\aaa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.2874233355119316
Encrypted:	false
SSDEEP:	12:Q3LaJU20NaL10Ug+9Yz9t0U29hJ5g1B0U2ukyrFk7v:MLF20NaL3z2p29hJ5g522r0
MD5:	80EFBEC081D7836D240503C4C9465FEC
SHA1:	6AF398E08A359457083727BAF296445030A55AC3
SHA-256:	C73F730EB5E05D15FAD6BE10AB51FE4D8A80B5E88B89D8BC80CC1DF09ACE1523
SHA-512:	DEC3B1D9403894418AFD4433629CA6476C7BD359963328D17B93283B52EEC18B3725D2F02F0E9A142E705398DDDCE244D53829570E9DE1A87060A7DABFDCE5B3
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\cd7c74fce2a0eab72cd25cbe4bb61614\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\gay.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\gay.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.2874233355119316
Encrypted:	false
SSDEEP:	12:Q3LaJU20NaL10Ug+9Yz9t0U29hJ5g1B0U2ukyrFk7v:MLF20NaL3z2p29hJ5g522r0
MD5:	80EFBEC081D7836D240503C4C9465FEC
SHA1:	6AF398E08A359457083727BAF296445030A55AC3
SHA-256:	C73F730EB5E05D15FAD6BE10AB51FE4D8A80B5E88B89D8BC80CC1DF09ACE1523
SHA-512:	DEC3B1D9403894418AFD4433629CA6476C7BD359963328D17B93283B52EEC18B3725D2F02F0E9A142E705398DDDCE244D53829570E9DE1A87060A7DABFDCE5B3
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\cd7c74fce2a0eab72cd25cbe4bb61614\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\healastounding.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\healastounding.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	5.185983766127119
Encrypted:	false
SSDEEP:	3:QHXMKaZImrnLCR2RAVIAQyz2QyDBLnDLFv:Q3LadLCR22IAQykdL1v
MD5:	1F5C279D069793BFDB15F6DAC63D5C39
SHA1:	EFA436296EE3BC196FFC4FBD48978A4A1BB6FD34
SHA-256:	007D94877B5C9048FDC238CF6E63516F2BF398588878947E1DC4A4E55553602D
SHA-512:	48270029CAB2C46093058BDB28795ECA137656C1B4EB9E1EFD2111EA42997B29312B7A0EBFD6EB411375F799754D2403C233D0FF6B65103AEFABDE68268ED747
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\5JOCE52U.txt

Download File

Process:	C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.6464393446710157
Encrypted:	false
SSDEEP:	3:HLLv:fv
MD5:	7AE4BED9A9648A53C3508D11671EF714
SHA1:	C349F54BAAA203AB3DC98498C49851C0704DD217
SHA-256:	C355B022F11CFAD7126BBD035784DAB1E94C3604D1528A130465E823C6EC1149
SHA-512:	7E3C40C668FAA94C9C1420B70405F41181BAE21F906C48164828E5427F66950483C4056E48C1FFF56634A5CDD943E5B1E40B8BEC798F4349E46263B21D7E1C6E
Malicious:	false
Reputation:	unknown
Preview:	84.17.52.7

C:\Users\user\AppData\Local\Temp\Dcvxaamev.exe

Download File

Process:	C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	335872
Entropy (8bit):	7.696824069546379
Encrypted:	false
SSDEEP:	6144:WLR0mFZcyJuOwhXdZkWwQ5eRI44axa7AP5Mb:8RHTJuOwhNZkWwQURI4xxa70ab
MD5:	870D6E5AEF6DEA98CED388CCE87BFBD4
SHA1:	2D7EEE096D38D3C2A8F12FCBA0A44B4C4DA33D54
SHA-256:	6D50833895B2E3EB9D6F879A6436660127C270B6A516CDA0253E56A3D8B7FBA0
SHA-512:	0D55AB28B2F80136AF121B870B7503551D87BBEB2848CF9A32540006CAC9A5E346D9FCCE2BF1223A22927F72A147B81487533A10B91373D4FA4429D6159FD566
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 86%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>.a..................... .......Y............@..........................0.......F......................................T...P.... ..t...............................................................................d............................text............................... ..`.data...............................@....rsrc...t.... ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FFDvbcrdfqs.exe

Download File

Process:	C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	290816
Entropy (8bit):	7.605066056188275
Encrypted:	false
SSDEEP:	6144:7S0BFZcouRlCLNkbI7u2KrMmCI44axa7AR5Mp:7SkZolCLybI7xI4xxa7Wap
MD5:	78D40B12FFC837843FBF4DE2164002F6
SHA1:	985BDFFA69BB915831CD6B81783AEF3AE4418F53
SHA-256:	308A15DABDC4CE6B96DD54954A351D304F1FCB59E8C93221BA1C412BCDFD1C44
SHA-512:	C6575E1771D37DED4089D963BEA95DEAC78B329ED555C991D7C559EE1970DD0887A965E88C09981529ADC9C25DF5CFD3D57E3DCE6724DA1F01F1198F0F460B79
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 86%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w>.a.................@... ...............P....@..................................I.......................................D..P....p..t...............................................................................d............................text....:.......@.................. ..`.data........P.......P..............@....rsrc...t....p.......`..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4896.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\Opus.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	5.090556205433367
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0V75xtn:cbk4oL600QydbQxIYODOLedq3K5j
MD5:	1211D31E3B2DF2F76E97FEF49A693566
SHA1:	47DA0FC84FEF52FE80D25341A9A2DC97117841F3
SHA-256:	8DD44C774959C9CA5E2557721C4C09ACCC5C5307F426D4A015AEF61A8410F45C
SHA-512:	05DE66143F4D1FCAE7BB927CF508AFD02DFA910D2D244D0EDD7545A9BF9F4B478C3B00D387C84495A14865BCF565D3A25201E6E61C85DE7DB37E4EA4938C1E49
Malicious:	true
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Local\Temp\tmp5D87.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\Opus.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1310
Entropy (8bit):	5.109425792877704
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0R3xtn:cbk4oL600QydbQxIYODOLedq3S3j
MD5:	5C2F41CFC6F988C859DA7D727AC2B62A
SHA1:	68999C85FC7E37BAB9216E0099836D40D4545C1C
SHA-256:	98B6E66B6C2173B9B91FC97FE51805340EFDE978B695453742EBAB631018398B
SHA-512:	B5DA5DA378D038AFBF8A7738E47921ED39F9B726E2CAA2993D915D9291A3322F94EFE8CCA6E7AD678A670DB19926B22B20E5028460FCC89CEA7F6635E7557334
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe

Download File

Process:	C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	549556
Entropy (8bit):	6.964847007042997
Encrypted:	false
SSDEEP:	12288:eKmlz464jAfhe5pUC1jAXBoFACBfz6JMW0rwrsu:oz4d/5iCj0BoNBb6Jh3
MD5:	0FD7DE5367376231A788872005D7ED4F
SHA1:	658E4D5EFB8B14661967BE2183CC60E3E561B2B6
SHA-256:	9083992637E90E412E6F4E77331EB69EE8DB821C54BBC38533E0F889CC4CA9DD
SHA-512:	522D5BE2803FBCE0D12C325CC2EF1E3A92CEC03AEBA7D1164530093AD58CAECD827DD557CA3C182A66C6667150E731DE37BB552D19425F96CC78FE3423E1A863
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 92%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... .4.d.Z.d.Z.d.Z.z..u.Z.z....Z.z..S.Z.CC!.g.Z.d.[..Z.z..e.Z.z..e.Z.z..e.Z.Richd.Z.................PE..L....:._............................. ............@.................................d.......................................8Y..(....................*...8..........P................................O..@............................................text...0........................... ..`.rdata..............................@..@.data........p.......T..............@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\22.exe

Download File

Process:	C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2101248
Entropy (8bit):	7.055994450169564
Encrypted:	false
SSDEEP:	49152:XkSw2TRlsQ1k0+eDE/C9fLtGoDs9cXpJGy:0EHZ/rDjfLe9cy
MD5:	DBF9DAA1707B1037E28A6E0694B33A4B
SHA1:	DDC1FCEC1C25F2D97C372FFFA247969AA6CD35EF
SHA-256:	A604A3FF78644533FAC5EE9F198E9C5F2FA1AE2A5828186367A9E00935CFF6B6
SHA-512:	145B606FFD58554050FF8712DDB38C1C66DD5F33EA15FD48474E1C165B2C0348D2413E16C7AD07FF1C65CE71E2BE23E3758E6D48C4F2454D5407982119706BFD
Malicious:	true
Yara Hits:	Rule: MALWARE_Win_BlackMoon, Description: Detects executables using BlackMoon RunTime, Source: C:\Users\user\AppData\Roaming\22.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 38%, Browse Antivirus: ReversingLabs, Detection: 86%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(...I.U.I.U.I.U.U.U.I.U.F.U.I.U^U.U.I.U.o.U~I.U5V.U.I.U.F.U.I.U.I.U.K.U.o.U.I.U.I.U.I.U5V.U.I.URich.I.U................PE..L....{.].................@...................P....@..........................P".................................................@....@"..............................................................................................................text....4.......@.................. ..`.rdata..lP...P...`...P..............@..@.data...........P..................@....rsrc........@"....... .............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\3.exe

Download File

Process:	C:\Users\user\AppData\Roaming\4.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	577536
Entropy (8bit):	5.535850322343421
Encrypted:	false
SSDEEP:	12288:aWMT5dtGv3Kom+qn4e9PtlAc7+Q4hMY1FOhcV:bMT5Sw++4ilAZ1OhcV
MD5:	748A4BEA8C0624A4C7A69F67263E0839
SHA1:	6955B7D516DF38992AC6BFF9D0B0F5DF150DF859
SHA-256:	220D8F8FF82D413C81BD02DFA001E1C478E8FBEA44BAD24F21B3A5284E15632E
SHA-512:	5FCDFDDCE3CC2E636001ED08C5F2F7590AADAA37C091F7BA94E519D298E284362721F1859C6FFBF064AE23E05D4E0E9754B515396812FBE9F9028497396799FD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\user\AppData\Roaming\3.exe, Author: Joe Security Rule: MALWARE_Win_DCRat, Description: DCRat payload, Source: C:\Users\user\AppData\Roaming\3.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\3.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 47%, Browse Antivirus: ReversingLabs, Detection: 82%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....a............................N.... ........@.. .......................@............@.....................................K....... .................... ....................................................... ............... ..H............text...T.... ...................... ..`.rsrc... ...........................@..@.reloc....... ......................@..B................0.......H...........l............................................................&.(......J..(........(....."..}....^..}.....(........}.....0..{.............."5-...YE....5...1...N...N...5...+... ..+...".<+>..\5.../.,+...\.!++..{..+...}..+...+....+...+...+...+...+...+...+....0..#..............n..+...t..+....+....+...+..*..0..............R.....o....(........s.......8&.......o....(............9....+......+....;....8.........._,.....+......,.....XT.o......8i...........,..r...p..o..

C:\Users\user\AppData\Roaming\4.exe

Download File

Process:	C:\Users\user\AppData\Roaming\healastounding.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	579127
Entropy (8bit):	7.206124159305961
Encrypted:	false
SSDEEP:	12288:xzxzTDWikLSb4NS7IODX+KEe+gpSwcxRLe4:bDWHSb4Ngse+USTR64
MD5:	E6DACE3F577AC7A6F9747B4A0956C8D7
SHA1:	86C71169025B822A8DFBA679EA981035CE1ABFD1
SHA-256:	8B4B846FE1023FA173AB410E3A5862A4C09F16534E14926878E387092E7FFB63
SHA-512:	1C8554D3D9A1B1509BA1DF569EDE3FB7A081BEF84394C708C4F1A2FB8779F012C74FBF6DE085514E0C8DEBB5079CC23C6C6112B95BF2F0AB6A8F0BD156A3E268
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 17%, Browse Antivirus: ReversingLabs, Detection: 75%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b`..&...&...&.....h.+.....j.......k.>.....^.$...._..0...._..5...._....../y..,.../y..#...&...+...._......._..'...._f.'...._..'...Rich&...........PE..L....).`.....................2...............0....@.......................................@.........................0...4...d...<....0...R......................\|"......T............................U..@............0..`...... ....................text............................... ..`.rdata.."....0......................@..@.data...(7..........................@....didat....... ......................@....rsrc....R...0...T..................@..@.reloc..\|".......$...&..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe

Download File

Process:	C:\Users\user\AppData\Roaming\healastounding.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1241088
Entropy (8bit):	7.769765528202914
Encrypted:	false
SSDEEP:	24576:mMyMzC8+ovorlBtugg0uHqJkSkSZI7C8JaYRHwOwhNGWwQ58Xaj8rac:mMHF+lxuPHYkSfI77aYRQOayac
MD5:	8F1C8B40C7BE588389A8D382040B23BB
SHA1:	BEF5209AE90A3BD3171E1E0BE4E8148C4CCD8A6A
SHA-256:	ED58FFEE46A583C177C792B56C9FC20CCD9509D125F2E3FC90C4F48DE7E2C2A1
SHA-512:	9192B6F2F8320A728C445F9CD6E6D66495AD0EBEBD7FF193DC09EE8AE57B3933C1B75DC208E7D638DB273CB9D31B4CA24EE7BFD9729FF0CDBF432D72BB322B1F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 26%, Browse Antivirus: ReversingLabs, Detection: 86%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>.a..................... ......6(............@.................................k...........................................P.......t...............................................................................d............................text...P........................... ..`.data...............................@....rsrc...t...........................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Download File

Process:	C:\Users\user\AppData\Roaming\Opus.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:tiK:f
MD5:	A032CE284A49FD6CF341559395411B90
SHA1:	9A556CCC1AE76361E16EC13A4549BCEB79D6F383
SHA-256:	CE980B79958BE0B1DA2EFC904A80EFD8FA0B1E3607152100190A001AA399E1F5
SHA-512:	14D6696A4B21C6FBD461FED6F895E0FDAE6706F3DE897E4EE2E29EC9C90F129DE423F3D3476D6BABF4AE1EFAB365C92D697B1355A72CE308DBE2EED97F840E05
Malicious:	true
Reputation:	unknown
Preview:	!a:.p..H

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat

Download File

Process:	C:\Users\user\AppData\Roaming\Opus.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.15091348260215
Encrypted:	false
SSDEEP:	3:oNN+EaKC5fMN:oNN7aZ5fMN
MD5:	F00851831855D57C5FAB0A8B025C3ECE
SHA1:	B44A5459ED55DEF8D4F1283651C031B98BBD4F36
SHA-256:	A9CC872641CE9C8FA8134CB799FE95C76299F4202119B72F62129667DB38FC33
SHA-512:	4C9B0071735811D3E59E3E0115EECEF168AA3944D71F7C507AF3C046FA8234E020051E13DD5A2D0E4EE347A99263139697D8382AE1D465F9CED0A4315950D7AA
Malicious:	false
Reputation:	unknown
Preview:	C:\Users\user\AppData\Roaming\Opus.exe

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\21c8026919fd094ab07ec3c180a9f210_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Download File

Process:	C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe
File Type:	data
Category:	dropped
Size (bytes):	49
Entropy (8bit):	1.2701062923235522
Encrypted:	false
SSDEEP:	3:/l1PL3n:fPL3
MD5:	CD8FA61AD2906643348EEF98A988B873
SHA1:	0B10E2F323B5C73F3A6EA348633B62AE522DDF39
SHA-256:	49A11A24821F2504B8C91BA9D8A6BD6F421ED2F0212C1C771BF1CAC9DE32AD75
SHA-512:	1E6F44AB3231232221CF0F4268E96A13C82E3F96249D7963B78805B693B52D3EBDABF873DB240813DF606D8C207BD2859338D67BA94F33ECBA43EA9A4FEFA086
Malicious:	false
Reputation:	unknown
Preview:	........................................user.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a797c6ca3f5e7aff8fa1149c47fe9466.exe

Download File

Process:	C:\Users\user\AppData\Roaming\mediaget.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	5.575438262402469
Encrypted:	false
SSDEEP:	384:HLWZcaCisD/WRdL5kyc/Ss4fzrngNsIhOrAF+rMRTyN/0L+EcoinblneHQM3epzN:iZcID5nc/Ss4HysIsrM+rMRa8NuM0t
MD5:	8EEDC01C11B251481DEC59E5308DCCC3
SHA1:	24BF069E9F2A1F12AEFA391674ED82059386B0AA
SHA-256:	0184983A425FEF55D46B7E0EB729A245730EE26414EBE4B155917C0124A19C2D
SHA-512:	52388313B21F14AA69C8B37E0FE0B73F66AA92F08651A16C820AAE65D341DC1AF6B48F3C8D4F657AC990EEAF4B9A01AE769BCA4D3625550011708697D22B69CC
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a797c6ca3f5e7aff8fa1149c47fe9466.exe, Author: Joe Security Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a797c6ca3f5e7aff8fa1149c47fe9466.exe, Author: ditekSHen Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a797c6ca3f5e7aff8fa1149c47fe9466.exe, Author: Brian Wallace @botnet_hunter
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....a................................ ........@.. ....................................@.....................................W.......@............................................................................ ............... ..H............text....... ...................... ..`.rsrc...@...........................@..@.reloc..............................@..B........................H........e...E..........................................................&.(......*..(.......s.........s.........s.........s...........0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\Opus.exe

Download File

Process:	C:\Users\user\AppData\Roaming\healastounding.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	208384
Entropy (8bit):	7.449669736966968
Encrypted:	false
SSDEEP:	6144:cLV6Bta6dtJmakIM5zEN/wjwJsvle+o9f/N:cLV6Btpmk1Elepd
MD5:	759185EE3724D7563B709C888C696959
SHA1:	7C166CC3CBFEF08BB378BCF557B1F45396A22931
SHA-256:	9384798985672C356A8A41BF822443F8EB0D3747BFCA148CE814594C1A894641
SHA-512:	ED754357B1B995DE918AF21FECD9D1464BDEA6778F7AB450A34E3AAE22BA7EEBC02F2442AF13774ABFDF97954E419EC9E356B54506C7E3BF12E3B76EE882FA2C
Malicious:	true
Yara Hits:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: C:\Users\user\AppData\Roaming\Opus.exe, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: C:\Users\user\AppData\Roaming\Opus.exe, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: C:\Users\user\AppData\Roaming\Opus.exe, Author: Joe Security Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: C:\Users\user\AppData\Roaming\Opus.exe, Author: ditekSHen Rule: NanoCore, Description: unknown, Source: C:\Users\user\AppData\Roaming\Opus.exe, Author: Kevin Breen <kevin@techanarchy.net>
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....'.T.....................d........... ........@.. ......................................................................8...W.... ..$`........................................................................... ............... ..H............text........ ...................... ..`.reloc..............................@..B.rsrc...$`... ...b..................@..@................t.......H...........T............................................................0..Q........o5........o6....-.&......3+..+.... ....3......1..... 2.... ....3.... ............0..E.......s7....-(&s8....-&&s9....,$&s:........s;.............+.....+.....+.....0..........~....o<.....0..........~....o=.....0..........~....o>.....0..........~....o?.....0..........~....o@.....0.............-.&(A...&+...0..$.......~B........-.(...+.-.&+..B...+.~B....0.............-.&(A...&+...0..

C:\Users\user\AppData\Roaming\Pluto Panel.exe

Download File

Process:	C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	913920
Entropy (8bit):	7.376805169532317
Encrypted:	false
SSDEEP:	12288:ypEQtqB5urTIoYWBQk1E+VF9mOx9wi1T0hnbkOWAvyPx4+c/bUUCy:HQtqBorTlYWBhE+V3mO5vWgxE/nb
MD5:	ED666BF7F4A0766FCEC0E9C8074B089B
SHA1:	1B90F1A4CB6059D573FFF115B3598604825D76E6
SHA-256:	D1330D349BFBD3AEA545FA08EF63339E82A3F4D04E27216ECC4C45304F079264
SHA-512:	D0791EAA9859D751F946FD3252D2056C29328FC97E147A5234A52A3728588A3A1AAA003A8E32863D338EBDCA92305C48B6FA12CA1E620CF27460BF091C3B6D49
Malicious:	true
Yara Hits:	Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe, Author: Kevin Breen <kevin@techanarchy.net> Rule: HKTL_NET_GUID_Stealer, Description: Detects c# red/black-team tools via typelibguid, Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe, Author: Arnim Rupp Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe, Author: Joe Security Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe, Author: Joe Security Rule: Hawkeye, Description: detect HawkEye in memory, Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe, Author: JPCERT/CC Incident Response Group
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....C.a.....................4........... ........@.. ....................................@.....................................S.... ...2...................`....................................................... ............... ..H............text........ ...................... ..`.rsrc....2... ...2..................@..@.reloc.......`....... ..............@..B........................H.......0}..h..............X...........................................2s..............0...........~......(......~....o....~....o..........9.......~....o.........+G~.....o......o........,)...........,.~.....~.....o....o.......................1.~.....~....o......o.....~....~....o....o......~.....(....s....o..........(............................0.. .........(....(..........(.....o..........................(......(.......o.......o.......o.......o.......R..(....o....o......

C:\Users\user\AppData\Roaming\___11.19.exe

Download File

Process:	C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16322590
Entropy (8bit):	7.8569139750386485
Encrypted:	false
SSDEEP:	393216:G7BPkdKzrZciLxv8naSNtPr5rn57M84UTB9xO5/VWvJKJPkwdnfZ:uBPQwxMR7pn5qUTB9xOFVWvJKJPkwdnB
MD5:	A071727B72A8374FF79A695ECDE32594
SHA1:	B2ABA60B3332D6B8F0A56CEA310CDC2BDB4F9FFC
SHA-256:	8ECDFE60EACB5BF647AE69BCBC41DD727EA3089E92B4B08EBCA3A8D162E50745
SHA-512:	854B93FB6B9BF0FE4CAEF5572935852CE8BECF2BC7BD41B192A4B3CEFB7854A2405C6C0C06BBDD4E1026FF9440EC753911DCC935FE68118E322614C1B918E400
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........H..u...u...u...~...u.......u.......u.C.{...u...y...u...f...u...f...u...t.`.u.C.(...u...~...u.(.~...u.(.....u...u...u...s...u.Rich..u.........PE..L.....ca............................5.............@.........................................................................xi.......................................................................................................................text............................... ..`.rdata.............................@..@.data....@....... ..................@....rsrc............ ..................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\a.exe

Download File

Process:	C:\Users\user\AppData\Roaming\healastounding.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1484512
Entropy (8bit):	7.99205858382872
Encrypted:	true
SSDEEP:	24576:XsoFdKkWRoohlLUI9AMNo9p2mbfmqFycZm4lZD3Ya10Hue4MBSYcQkEaHNYK3Kyh:XrHW6ilLU1Eor3Fg4lBIM0Hue1BSYcQ4
MD5:	52CFD35F337CA837D31DF0A95CE2A55E
SHA1:	88EB919FA2761F739F02A025E4F9BF1FD340B6FF
SHA-256:	5975E737584DDF2601C02E5918A79DAD7531DF0E13DCA922F0525F66BEC4B448
SHA-512:	B584282F6F5396C3BBED7835BE67420AA14D11B9C42A88B0E3413A07A6164C22D6F50D845D05F48CB95D84FD9545D0B9E25E581324A08B3A95CED9F048D41D73
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....O...............0.............. ... ........@.. ....................... <.. ..-A6.....................................\|L7.........r........................................................................................................................ ......................@....rsrc.... ..........................@............ ..........................@............ ..........................@............ 5.. ...V..................@....uxD5Xzb.....@7.....................@....adata... ....<.....................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\aaa.exe

Download File

Process:	C:\Users\user\AppData\Roaming\healastounding.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	7.206630188700291
Encrypted:	false
SSDEEP:	3072:zMJQH6NvccnsXOf4qhi01sXT0RZTF27rcAXIlWMhBN2/MTDM:zMxsU9i0iXT0RZo7Iwhec/MTD
MD5:	860AA57FC3578F7037BB27FC79B2A62C
SHA1:	A14008FE5E1EB88BF46266DE3D5EE5DB2E0A722B
SHA-256:	5430565C4534B482C7216A0AE75D04E201EE0DB0386682C0C010243083C28D29
SHA-512:	6639B3E2594E554C7FA811F22E1C514474D34220155B4C989AD8716DB1A0AEA65894AA23D78C12A4618C57312DA00353A77DD8E6C6BDD927BF865F2E98AFF8F1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S............................n.... ........@.. .......................@............@................................. ...K............................ ....................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................P.......H.......t................5..x............................................ .........%.....(......... t........%.....(...........V~....(....~....o........(....R .l..q..(-............0..........~.........E........................-...~.... .... ....(...+..t....,... ......[.+..+......(....(!....t....('...........t..........(......u.... .... ....(...+(....~.... ....~.... .....~.... .....X.k_.......(.....(....t....~....o@...()....f..(...+.........0..........(*....I.U(...+..

C:\Users\user\AppData\Roaming\gay.exe

Download File

Process:	C:\Users\user\AppData\Roaming\healastounding.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	5.575438262402469
Encrypted:	false
SSDEEP:	384:HLWZcaCisD/WRdL5kyc/Ss4fzrngNsIhOrAF+rMRTyN/0L+EcoinblneHQM3epzN:iZcID5nc/Ss4HysIsrM+rMRa8NuM0t
MD5:	8EEDC01C11B251481DEC59E5308DCCC3
SHA1:	24BF069E9F2A1F12AEFA391674ED82059386B0AA
SHA-256:	0184983A425FEF55D46B7E0EB729A245730EE26414EBE4B155917C0124A19C2D
SHA-512:	52388313B21F14AA69C8B37E0FE0B73F66AA92F08651A16C820AAE65D341DC1AF6B48F3C8D4F657AC990EEAF4B9A01AE769BCA4D3625550011708697D22B69CC
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\gay.exe, Author: Joe Security Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\gay.exe, Author: ditekSHen Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Roaming\gay.exe, Author: Brian Wallace @botnet_hunter
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....a................................ ........@.. ....................................@.....................................W.......@............................................................................ ............... ..H............text....... ...................... ..`.rsrc...@...........................@..@.reloc..............................@..B........................H........e...E..........................................................&.(......*..(.......s.........s.........s.........s...........0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\healastounding.exe

Download File

Process:	C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3733504
Entropy (8bit):	7.794569867865562
Encrypted:	false
SSDEEP:	98304:pAdy2TU151ZIpH8YcItGTHF+iSfI77agdayaW/ej:gy5Ls8YcItWFXlWZVy
MD5:	6FB798F1090448CE26299C2B35ACF876
SHA1:	451423D5690CFFA02741D5DA6E7C45BC08AEFB55
SHA-256:	B4F86FF48C5F6B01E0AD4543FB78E0435E81F3EC2AACA89866862157C0DACF4F
SHA-512:	9CC2421A2F3AB01D15BE62A848947B03F1A8212CFD923573CF70F8C10BD8D124AEE3B251828834236AF291EA12450AC2580A712E53A022CE11B4D71B0357D8C3
Malicious:	true
Yara Hits:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: C:\Users\user\AppData\Roaming\healastounding.exe, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: C:\Users\user\AppData\Roaming\healastounding.exe, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Roaming\healastounding.exe, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\healastounding.exe, Author: Joe Security Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\healastounding.exe, Author: ditekSHen Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: C:\Users\user\AppData\Roaming\healastounding.exe, Author: ditekSHen Rule: NanoCore, Description: unknown, Source: C:\Users\user\AppData\Roaming\healastounding.exe, Author: Kevin Breen <kevin@techanarchy.net> Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Roaming\healastounding.exe, Author: Brian Wallace @botnet_hunter
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a..................8...........9.. ... 9...@.. .......................`9...........@...................................9.W.... 9......................@9...................................................... ............... ..H............text...4.8.. ....8................. ..`.rsrc........ 9.......8.............@..@.reloc.......@9.......8.............@..B..................9.....H.......@.9.............`!....8..........................................0..f.......r...pr#..p(....t.....r9..p(.......+..........i].a...X....i2..(....o....................(......(....&...0..q.......(.......o......s......o.....+.o....u....,..o....t.....(....,..o.......&.o....-....,..o........,..o.....s....z..*...........=R..........P^........8............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Res

C:\Users\user\AppData\Roaming\mediaget.exe

Download File

Process:	C:\Users\user\AppData\Roaming\gay.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	5.575438262402469
Encrypted:	false
SSDEEP:	384:HLWZcaCisD/WRdL5kyc/Ss4fzrngNsIhOrAF+rMRTyN/0L+EcoinblneHQM3epzN:iZcID5nc/Ss4HysIsrM+rMRa8NuM0t
MD5:	8EEDC01C11B251481DEC59E5308DCCC3
SHA1:	24BF069E9F2A1F12AEFA391674ED82059386B0AA
SHA-256:	0184983A425FEF55D46B7E0EB729A245730EE26414EBE4B155917C0124A19C2D
SHA-512:	52388313B21F14AA69C8B37E0FE0B73F66AA92F08651A16C820AAE65D341DC1AF6B48F3C8D4F657AC990EEAF4B9A01AE769BCA4D3625550011708697D22B69CC
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\mediaget.exe, Author: Joe Security Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\mediaget.exe, Author: ditekSHen Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Roaming\mediaget.exe, Author: Brian Wallace @botnet_hunter
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....a................................ ........@.. ....................................@.....................................W.......@............................................................................ ............... ..H............text....... ...................... ..`.rsrc...@...........................@..@.reloc..............................@..B........................H........e...E..........................................................&.(......*..(.......s.........s.........s.........s...........0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\test.exe

Download File

Process:	C:\Users\user\AppData\Roaming\healastounding.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46080
Entropy (8bit):	5.459376005695359
Encrypted:	false
SSDEEP:	768:EuwCNToEjaNLWU3zKZmo2q7C8V1vBTcPI1zjbkgX3ir64oRfdwQfybTWVABDZTx:EuwCNToqaS2z8VnTh13brXSr64oZSbZH
MD5:	7E50B292982932190179245C60C0B59B
SHA1:	25CF641DDCDC818F32837DB236A58060426B5571
SHA-256:	A8DDE4E60DB080DFC397D7E312E7E9F18D9C08D6088E8043FEEAE9AB32ABDBB8
SHA-512:	C6D422D9FB115E1B6B085285B1D3CA46ED541E390895D702710E82A336F4DE6CC5C9183F8E6EBE35475FCCE6DEF8CC5FFA8EE4A61B38D7E80A9F40789688B885
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Roaming\test.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\AppData\Roaming\test.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#..^............................N.... ........@.. ....................... ............@.....................................O.................................................................................... ............... ..H............text...T.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................0.......H........Y...m.............................................................V..;...$0.xC.=VD..b......9A../.\.....(.....~............~............~............~............~............~............~............~.....~............~............~............(>......2~.....o?....s..........()...:(...(...:....(+...:....('...:....((...9.....(v...V(....s.... ...o....n~....9....~....o..........~~....(....9....(0...9....(@...Vr.%.p~....(o....#....s...

C:\Windows\Cursors\WUDFhosts.exe

Download File

Process:	C:\Users\user\AppData\Roaming\22.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	806912
Entropy (8bit):	7.921653477744872
Encrypted:	false
SSDEEP:	24576:f7hffPYBJUtGpCXX3dquvU9ckRvYLpZjQaYM8l:NfLtGoDs9cXpJG
MD5:	4A72E30C0A582B082030ADFD8345014F
SHA1:	2F92CCF13F8DFC7EEFF49903A0D1EA8DD97A7353
SHA-256:	E1315C41F50A75C308CDB023F7E48C0AA62931D5771AD8BC4220018ED5D7F976
SHA-512:	8A75925B0695284105856823190531DC4CFCF32A8AE3226EF8C1F796185AA01F8C085B6457A63B1CF81842DA2C6BAAFD4CABF7565A8D96D3460054439BBFB798
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$...................E[Z....E[X.D..E[Y....ogl..................b......,8`..........b...'..b......b.T......<....b......Rich...........................PE..d...5..].........."...... ...0....K...W...K....@..............................X...........`...................................................W.......W..+....U...............W.............................`.W.(.....W.............................................UPX0......K.............................UPX1..... ....K.....................@....rsrc....0....W......"..............@......................................................................................................................................................................................................................................................................................................................3.93.UPX!.$..

C:\Windows\Help\Winlogon.exe

Download File

Process:	C:\Users\user\AppData\Roaming\22.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	76248
Entropy (8bit):	6.357076953831382
Encrypted:	false
SSDEEP:	1536:WH8tImFvh/tAoX/V1d/Xc81qsWjcdTxekxemB:WH8imz/H111TxfAmB
MD5:	A8DDACE9435FE395325FC45DDE8BD0A3
SHA1:	DCF9BAAA9E3A27450DEBF4F35112376ED005C800
SHA-256:	6E81D7C71B3E8D731E11AD75D3DAC02A4210C9F90FAC618AF5C00CBCE3718658
SHA-512:	2C6006E42ECF31DA02A4584E69C0E55390BE5A405353307582852728B2CEB65033F3F5CD0B6465B3A1541D19EAB95C61B394E3403DEE558196C2F2969D82B196
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x...<O..<O..<O..1..$O..1..3O..1..ZO..A6.?O..57..>O..<O..pO..A6..=O..1..=O..<O..=O..A6.=O..Rich<O..................PE..L...K..Y..........................................@..........................P............@.....................................<....0..`....................@..l...@...8...............................@............................................text............................... ..`.rdata..tF.......H..................@..@.data....0..........................@....rsrc...`....0......................@..@.reloc..l....@......................@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Help\active_desktop_render.dll

Download File

Process:	C:\Users\user\AppData\Roaming\22.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	995328
Entropy (8bit):	6.19848257170581
Encrypted:	false
SSDEEP:	12288:BT8s5nv9sQ1ViVNEPazI+eGGhFqxVOa+28WXvC:BT8MnlsQ1kVqPv+eDhGwdIvC
MD5:	07A36097730666FE9E5434D85A5AB989
SHA1:	780CA47C15932ED1F9640C17B9BB340410A52338
SHA-256:	1FB4CEE4D83D424E0BFCBFD97169EF717B3EBDCC5D01BA7C7C547AE606AD5C3C
SHA-512:	4A08080471C660856AF724E4480EC721C22C462346E293D93E2F9577E6D669C6B51CD81EF96DFAD943C791DFD7F7F0C2D5234A82D81CE5F1C01BB493CDA34085
Malicious:	true
Yara Hits:	Rule: MALWARE_Win_BlackMoon, Description: Detects executables using BlackMoon RunTime, Source: C:\Windows\Help\active_desktop_render.dll, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................. ......`............ .....................................Rich...................PE..L...Kw.]...........!.....@...........m.......P......................................................................p........y.......0.. ....................@.......................................................P..t............................text...J:.......@.................. ..`.rdata...=...P...@...P..............@..@.data............P..................@....rsrc... ....0......................@..@.reloc...3...@...@..................@..B........................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.788951719729708
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.63% Win32 Executable (generic) a (10002005/4) 49.58% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.41% InstallShield setup (43055/19) 0.21% UPX compressed Win32 Executable (30571/9) 0.15%
File name:	RIP_YOUR_PC_LOL.exe
File size:	23633920
MD5:	52867174362410d63215d78e708103ea
SHA1:	7ae4e1048e4463a4201bdeaf224c5b6face681bf
SHA256:	37d8e1ce3b6e6488942717aa78cb54785edc985143bcc8d9ba9f42d73a3dbd7a
SHA512:	89e17e147d3f073e479e85d0b0321f6264bbc2aa84c930ed645e8f5cde3f1e58812c3db1ba0f10bee6ce7ac0731e1e3de6747a9b3c4d63a564dd8d904bd726ab
SSDEEP:	393216:HJLgf7BPkdKzrZciLxv8naSNtPr5rn57M84UTB9xO5/VWvJKJPkwdnfZ4y5SDkFV:poBPQwxMR7pn5qUTB9xOFVWvJKJPkwd9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e..a..................h...........h.. ....h...@.. ........................i...........@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x1a8b4ae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61B51365 [Sat Dec 11 21:08:53 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v2.0.50727
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x168b454	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x168c000	0x598	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x168e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x16894b4	0x1689600	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x168c000	0x598	0x600	False	0.421223958333	data	4.08611300158	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x168e000	0xc	0x200	False	0.044921875	data	0.118369631259	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x168c0a0	0x304	data
RT_MANIFEST	0x168c3a8	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	emerge brutal
Assembly Version	14.5.48.86
InternalName	foampounding.exe
FileVersion	14.5.48.86
CompanyName	brawler
ProductName	open
ProductVersion	14.5.48.86
FileDescription	earfalserust
OriginalFilename	foampounding.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/08/22-18:01:02.530765	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	51748	8.8.8.8	192.168.2.6
03/08/22-18:01:29.841168	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	49695	8.8.8.8	192.168.2.6
03/08/22-18:01:52.276662	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	61607	8.8.8.8	192.168.2.6
03/08/22-18:02:29.169253	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	52858	8.8.8.8	192.168.2.6
03/08/22-18:02:48.436398	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	59871	8.8.8.8	192.168.2.6
03/08/22-18:02:48.491531	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	50029	8.8.8.8	192.168.2.6
03/08/22-18:02:48.738596	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	51194	8.8.8.8	192.168.2.6
03/08/22-18:02:53.688495	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	50081	8.8.8.8	192.168.2.6
03/08/22-18:02:56.227160	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	55083	8.8.8.8	192.168.2.6
03/08/22-18:02:58.743158	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	59106	8.8.8.8	192.168.2.6
03/08/22-18:03:09.787643	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	61152	8.8.8.8	192.168.2.6
03/08/22-18:03:11.689559	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	49679	8.8.8.8	192.168.2.6
03/08/22-18:03:22.042737	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	52225	8.8.8.8	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 8, 2022 18:01:02.549043894 CET	49768	8050	192.168.2.6	179.13.1.253
Mar 8, 2022 18:01:05.605629921 CET	49768	8050	192.168.2.6	179.13.1.253
Mar 8, 2022 18:01:11.606240988 CET	49768	8050	192.168.2.6	179.13.1.253
Mar 8, 2022 18:01:21.307589054 CET	49770	80	192.168.2.6	52.20.78.240
Mar 8, 2022 18:01:21.448190928 CET	80	49770	52.20.78.240	192.168.2.6
Mar 8, 2022 18:01:21.448342085 CET	49770	80	192.168.2.6	52.20.78.240
Mar 8, 2022 18:01:21.456914902 CET	49770	80	192.168.2.6	52.20.78.240
Mar 8, 2022 18:01:21.596329927 CET	80	49770	52.20.78.240	192.168.2.6
Mar 8, 2022 18:01:21.597302914 CET	80	49770	52.20.78.240	192.168.2.6
Mar 8, 2022 18:01:21.597403049 CET	49770	80	192.168.2.6	52.20.78.240
Mar 8, 2022 18:01:22.363976955 CET	49771	80	192.168.2.6	80.87.192.115
Mar 8, 2022 18:01:22.423902035 CET	80	49771	80.87.192.115	192.168.2.6
Mar 8, 2022 18:01:22.424120903 CET	49771	80	192.168.2.6	80.87.192.115
Mar 8, 2022 18:01:29.900438070 CET	49772	8050	192.168.2.6	179.13.1.253
Mar 8, 2022 18:01:32.904844999 CET	49772	8050	192.168.2.6	179.13.1.253
Mar 8, 2022 18:01:38.999099016 CET	49772	8050	192.168.2.6	179.13.1.253
Mar 8, 2022 18:01:50.012576103 CET	49773	58491	192.168.2.6	172.98.92.42
Mar 8, 2022 18:01:50.126136065 CET	58491	49773	172.98.92.42	192.168.2.6
Mar 8, 2022 18:01:50.812603951 CET	49773	58491	192.168.2.6	172.98.92.42
Mar 8, 2022 18:01:50.926179886 CET	58491	49773	172.98.92.42	192.168.2.6
Mar 8, 2022 18:01:51.429456949 CET	49773	58491	192.168.2.6	172.98.92.42
Mar 8, 2022 18:01:51.544755936 CET	58491	49773	172.98.92.42	192.168.2.6
Mar 8, 2022 18:01:52.529678106 CET	49774	1470	192.168.2.6	41.249.51.34
Mar 8, 2022 18:01:55.610013008 CET	49774	1470	192.168.2.6	41.249.51.34
Mar 8, 2022 18:01:56.268575907 CET	49775	8050	192.168.2.6	179.13.1.253
Mar 8, 2022 18:01:59.313349009 CET	49775	8050	192.168.2.6	179.13.1.253
Mar 8, 2022 18:02:01.610399961 CET	49774	1470	192.168.2.6	41.249.51.34
Mar 8, 2022 18:02:05.313823938 CET	49775	8050	192.168.2.6	179.13.1.253
Mar 8, 2022 18:02:05.928004980 CET	49776	58491	192.168.2.6	172.98.92.42
Mar 8, 2022 18:02:06.042727947 CET	58491	49776	172.98.92.42	192.168.2.6
Mar 8, 2022 18:02:06.642051935 CET	49776	58491	192.168.2.6	172.98.92.42
Mar 8, 2022 18:02:06.756652117 CET	58491	49776	172.98.92.42	192.168.2.6
Mar 8, 2022 18:02:07.345288038 CET	49776	58491	192.168.2.6	172.98.92.42
Mar 8, 2022 18:02:07.460087061 CET	58491	49776	172.98.92.42	192.168.2.6
Mar 8, 2022 18:02:21.598696947 CET	80	49770	52.20.78.240	192.168.2.6
Mar 8, 2022 18:02:21.623155117 CET	49770	80	192.168.2.6	52.20.78.240
Mar 8, 2022 18:02:22.540772915 CET	80	49771	80.87.192.115	192.168.2.6
Mar 8, 2022 18:02:22.544246912 CET	49771	80	192.168.2.6	80.87.192.115
Mar 8, 2022 18:02:29.260555983 CET	49777	8050	192.168.2.6	179.13.1.253
Mar 8, 2022 18:02:32.348848104 CET	49777	8050	192.168.2.6	179.13.1.253
Mar 8, 2022 18:02:38.443535089 CET	49777	8050	192.168.2.6	179.13.1.253
Mar 8, 2022 18:02:41.668142080 CET	49778	58491	192.168.2.6	172.98.92.42
Mar 8, 2022 18:02:41.783175945 CET	58491	49778	172.98.92.42	192.168.2.6
Mar 8, 2022 18:02:42.302769899 CET	49778	58491	192.168.2.6	172.98.92.42
Mar 8, 2022 18:02:42.417251110 CET	58491	49778	172.98.92.42	192.168.2.6
Mar 8, 2022 18:02:43.115386009 CET	49778	58491	192.168.2.6	172.98.92.42
Mar 8, 2022 18:02:43.230278015 CET	58491	49778	172.98.92.42	192.168.2.6
Mar 8, 2022 18:02:48.515594006 CET	49780	1470	192.168.2.6	41.249.51.34
Mar 8, 2022 18:02:51.537960052 CET	49780	1470	192.168.2.6	41.249.51.34
Mar 8, 2022 18:02:55.695036888 CET	49793	8050	192.168.2.6	179.13.1.253
Mar 8, 2022 18:02:57.647829056 CET	49780	1470	192.168.2.6	41.249.51.34
Mar 8, 2022 18:02:58.804176092 CET	49793	8050	192.168.2.6	179.13.1.253
Mar 8, 2022 18:03:02.885044098 CET	49804	58491	192.168.2.6	172.98.92.42
Mar 8, 2022 18:03:02.999629974 CET	58491	49804	172.98.92.42	192.168.2.6
Mar 8, 2022 18:03:03.617047071 CET	49804	58491	192.168.2.6	172.98.92.42
Mar 8, 2022 18:03:03.731703043 CET	58491	49804	172.98.92.42	192.168.2.6
Mar 8, 2022 18:03:04.304689884 CET	49804	58491	192.168.2.6	172.98.92.42
Mar 8, 2022 18:03:04.419482946 CET	58491	49804	172.98.92.42	192.168.2.6
Mar 8, 2022 18:03:04.804677963 CET	49793	8050	192.168.2.6	179.13.1.253
Mar 8, 2022 18:03:08.456417084 CET	49815	58491	192.168.2.6	172.98.92.42
Mar 8, 2022 18:03:08.571064949 CET	58491	49815	172.98.92.42	192.168.2.6
Mar 8, 2022 18:03:09.117554903 CET	49815	58491	192.168.2.6	172.98.92.42
Mar 8, 2022 18:03:09.232285976 CET	58491	49815	172.98.92.42	192.168.2.6
Mar 8, 2022 18:03:09.806243896 CET	49815	58491	192.168.2.6	172.98.92.42
Mar 8, 2022 18:03:09.920924902 CET	58491	49815	172.98.92.42	192.168.2.6
Mar 8, 2022 18:03:10.235430956 CET	49770	80	192.168.2.6	52.20.78.240
Mar 8, 2022 18:03:10.375109911 CET	80	49770	52.20.78.240	192.168.2.6
Mar 8, 2022 18:03:11.695297003 CET	49820	1470	192.168.2.6	41.249.51.34
Mar 8, 2022 18:03:13.931397915 CET	49825	58491	192.168.2.6	172.98.92.42
Mar 8, 2022 18:03:14.047744036 CET	58491	49825	172.98.92.42	192.168.2.6
Mar 8, 2022 18:03:14.618395090 CET	49825	58491	192.168.2.6	172.98.92.42
Mar 8, 2022 18:03:14.733145952 CET	58491	49825	172.98.92.42	192.168.2.6
Mar 8, 2022 18:03:14.805542946 CET	49820	1470	192.168.2.6	41.249.51.34
Mar 8, 2022 18:03:15.306822062 CET	49825	58491	192.168.2.6	172.98.92.42
Mar 8, 2022 18:03:15.421253920 CET	58491	49825	172.98.92.42	192.168.2.6
Mar 8, 2022 18:03:20.806010008 CET	49820	1470	192.168.2.6	41.249.51.34
Mar 8, 2022 18:03:22.143265009 CET	49838	8050	192.168.2.6	179.13.1.253

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 8, 2022 18:00:25.222332954 CET	56591	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:01:02.421529055 CET	51748	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:01:02.530765057 CET	53	51748	8.8.8.8	192.168.2.6
Mar 8, 2022 18:01:21.131813049 CET	50958	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:01:21.159094095 CET	53	50958	8.8.8.8	192.168.2.6
Mar 8, 2022 18:01:29.731457949 CET	49695	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:01:29.841167927 CET	53	49695	8.8.8.8	192.168.2.6
Mar 8, 2022 18:01:52.253196955 CET	61607	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:01:52.276662111 CET	53	61607	8.8.8.8	192.168.2.6
Mar 8, 2022 18:01:56.196608067 CET	56550	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:01:56.216669083 CET	53	56550	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:29.062084913 CET	52858	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:29.169253111 CET	53	52858	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:48.149482012 CET	50029	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:48.414717913 CET	59871	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:48.427118063 CET	51194	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:48.436398029 CET	53	59871	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:48.491530895 CET	53	50029	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:48.514926910 CET	51666	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:48.538808107 CET	53	51666	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:48.738595963 CET	53	51194	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:49.711517096 CET	57037	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:49.731496096 CET	53	57037	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:50.793032885 CET	60609	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:50.815732956 CET	53	60609	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:50.939651012 CET	54529	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:50.959239960 CET	53	54529	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:51.056174994 CET	62643	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:51.073822021 CET	53	62643	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:52.364578009 CET	54015	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:52.455807924 CET	53	54015	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:52.476210117 CET	52089	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:52.546967030 CET	53	52089	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:52.577049971 CET	54489	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:52.664900064 CET	53	54489	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:52.879266024 CET	52698	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:52.967892885 CET	53	52698	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:53.016813040 CET	53829	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:53.099018097 CET	53	53829	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:53.111742973 CET	61901	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:53.208043098 CET	53	61901	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:53.250925064 CET	58689	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:53.341078997 CET	53	58689	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:53.351939917 CET	50081	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:53.688494921 CET	53	50081	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:54.809392929 CET	49520	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:54.902901888 CET	65526	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:55.664746046 CET	53049	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:55.684472084 CET	53	53049	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:55.762953997 CET	52965	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:55.834017038 CET	53	52965	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:55.837884903 CET	52125	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:55.930027962 CET	55083	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:55.939817905 CET	53	52125	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:56.227159977 CET	53	55083	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:56.465817928 CET	58360	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:56.485572100 CET	53	58360	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:56.742223978 CET	56071	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:57.091926098 CET	53	56071	8.8.8.8	192.168.2.6
Mar 8, 2022 18:02:58.431301117 CET	59106	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:02:58.743158102 CET	53	59106	8.8.8.8	192.168.2.6
Mar 8, 2022 18:03:00.852693081 CET	61113	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:03:00.870723009 CET	53	61113	8.8.8.8	192.168.2.6
Mar 8, 2022 18:03:03.026786089 CET	60658	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:03:03.046681881 CET	53	60658	8.8.8.8	192.168.2.6
Mar 8, 2022 18:03:05.181277037 CET	60238	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:03:05.199376106 CET	53	60238	8.8.8.8	192.168.2.6
Mar 8, 2022 18:03:07.321696043 CET	65367	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:03:07.343290091 CET	53	65367	8.8.8.8	192.168.2.6
Mar 8, 2022 18:03:09.462516069 CET	61152	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:03:09.787642956 CET	53	61152	8.8.8.8	192.168.2.6
Mar 8, 2022 18:03:11.455007076 CET	64544	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:03:11.490103006 CET	53	64544	8.8.8.8	192.168.2.6
Mar 8, 2022 18:03:11.667885065 CET	49679	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:03:11.689558983 CET	53	49679	8.8.8.8	192.168.2.6
Mar 8, 2022 18:03:11.855283022 CET	60361	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:03:11.875169992 CET	53	60361	8.8.8.8	192.168.2.6
Mar 8, 2022 18:03:13.742429972 CET	63771	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:03:13.761302948 CET	53	63771	8.8.8.8	192.168.2.6
Mar 8, 2022 18:03:13.962951899 CET	64579	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:03:13.984797001 CET	53	64579	8.8.8.8	192.168.2.6
Mar 8, 2022 18:03:16.135138988 CET	58801	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:03:16.157701969 CET	53	58801	8.8.8.8	192.168.2.6
Mar 8, 2022 18:03:18.356760979 CET	61571	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:03:18.376470089 CET	53	61571	8.8.8.8	192.168.2.6
Mar 8, 2022 18:03:20.463649035 CET	49463	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:03:20.481589079 CET	53	49463	8.8.8.8	192.168.2.6
Mar 8, 2022 18:03:21.935733080 CET	52225	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:03:22.042737007 CET	53	52225	8.8.8.8	192.168.2.6
Mar 8, 2022 18:03:23.130189896 CET	55342	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:03:23.148067951 CET	53	55342	8.8.8.8	192.168.2.6
Mar 8, 2022 18:03:23.273044109 CET	49754	53	192.168.2.6	8.8.8.8
Mar 8, 2022 18:03:23.588294983 CET	53	49754	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Mar 8, 2022 18:00:25.222332954 CET	192.168.2.6	8.8.8.8	0x72ed	Standard query (0)	store-images.s-microsoft.com	A (IP address)	IN (0x0001)
Mar 8, 2022 18:01:02.421529055 CET	192.168.2.6	8.8.8.8	0xf287	Standard query (0)	gfhhjgh.duckdns.org	A (IP address)	IN (0x0001)
Mar 8, 2022 18:01:21.131813049 CET	192.168.2.6	8.8.8.8	0x6641	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)
Mar 8, 2022 18:01:29.731457949 CET	192.168.2.6	8.8.8.8	0xd006	Standard query (0)	gfhhjgh.duckdns.org	A (IP address)	IN (0x0001)
Mar 8, 2022 18:01:52.253196955 CET	192.168.2.6	8.8.8.8	0xa2d	Standard query (0)	kazya1.hopto.org	A (IP address)	IN (0x0001)
Mar 8, 2022 18:01:56.196608067 CET	192.168.2.6	8.8.8.8	0xf35b	Standard query (0)	gfhhjgh.duckdns.org	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:29.062084913 CET	192.168.2.6	8.8.8.8	0xb207	Standard query (0)	gfhhjgh.duckdns.org	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:48.149482012 CET	192.168.2.6	8.8.8.8	0x541d	Standard query (0)	hackerinvasion.f3322.net	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:48.414717913 CET	192.168.2.6	8.8.8.8	0x771c	Standard query (0)	kazya1.hopto.org	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:48.427118063 CET	192.168.2.6	8.8.8.8	0x1458	Standard query (0)	hackerinvasion.f3322.net	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:48.514926910 CET	192.168.2.6	8.8.8.8	0x249f	Standard query (0)	yabynennet.xyz	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:49.711517096 CET	192.168.2.6	8.8.8.8	0x1de0	Standard query (0)	123.105.12.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Mar 8, 2022 18:02:50.793032885 CET	192.168.2.6	8.8.8.8	0x2c	Standard query (0)	whatismyipaddress.com	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:50.939651012 CET	192.168.2.6	8.8.8.8	0x1b81	Standard query (0)	whatismyipaddress.com	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:51.056174994 CET	192.168.2.6	8.8.8.8	0xa95e	Standard query (0)	hackerinvasion.f3322.net	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:52.364578009 CET	192.168.2.6	8.8.8.8	0x658b	Standard query (0)	prepepe.ac.ug	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:52.476210117 CET	192.168.2.6	8.8.8.8	0xb173	Standard query (0)	prepepe.ac.ug	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:52.577049971 CET	192.168.2.6	8.8.8.8	0xc570	Standard query (0)	prepepe.ac.ug	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:52.879266024 CET	192.168.2.6	8.8.8.8	0x28df	Standard query (0)	prepepe.ac.ug	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:53.016813040 CET	192.168.2.6	8.8.8.8	0x7f0c	Standard query (0)	prepepe.ac.ug	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:53.111742973 CET	192.168.2.6	8.8.8.8	0x73f9	Standard query (0)	prepepe.ac.ug	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:53.250925064 CET	192.168.2.6	8.8.8.8	0x59e3	Standard query (0)	prepepe.ac.ug	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:53.351939917 CET	192.168.2.6	8.8.8.8	0x1e6	Standard query (0)	hackerinvasion.f3322.net	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:54.809392929 CET	192.168.2.6	8.8.8.8	0x5dd4	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:54.902901888 CET	192.168.2.6	8.8.8.8	0x4a0c	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:55.664746046 CET	192.168.2.6	8.8.8.8	0xd501	Standard query (0)	gfhhjgh.duckdns.org	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:55.762953997 CET	192.168.2.6	8.8.8.8	0x259d	Standard query (0)	pretorian.ac.ug	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:55.837884903 CET	192.168.2.6	8.8.8.8	0x66da	Standard query (0)	pretorian.ac.ug	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:55.930027962 CET	192.168.2.6	8.8.8.8	0x349d	Standard query (0)	hackerinvasion.f3322.net	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:56.465817928 CET	192.168.2.6	8.8.8.8	0xa4a5	Standard query (0)	22ssh.com	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:56.742223978 CET	192.168.2.6	8.8.8.8	0xeaa	Standard query (0)	pool.usa-138.com	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:58.431301117 CET	192.168.2.6	8.8.8.8	0x8329	Standard query (0)	hackerinvasion.f3322.net	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:00.852693081 CET	192.168.2.6	8.8.8.8	0x4b12	Standard query (0)	hackerinvasion.f3322.net	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:03.026786089 CET	192.168.2.6	8.8.8.8	0x131b	Standard query (0)	hackerinvasion.f3322.net	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:05.181277037 CET	192.168.2.6	8.8.8.8	0xff00	Standard query (0)	hackerinvasion.f3322.net	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:07.321696043 CET	192.168.2.6	8.8.8.8	0xd5e2	Standard query (0)	hackerinvasion.f3322.net	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:09.462516069 CET	192.168.2.6	8.8.8.8	0x8118	Standard query (0)	hackerinvasion.f3322.net	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:11.455007076 CET	192.168.2.6	8.8.8.8	0x9cb7	Standard query (0)	files.000webhost.com	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:11.667885065 CET	192.168.2.6	8.8.8.8	0x6983	Standard query (0)	kazya1.hopto.org	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:11.855283022 CET	192.168.2.6	8.8.8.8	0x9062	Standard query (0)	hackerinvasion.f3322.net	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:13.742429972 CET	192.168.2.6	8.8.8.8	0x204b	Standard query (0)	22ssh.com	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:13.962951899 CET	192.168.2.6	8.8.8.8	0xd1b5	Standard query (0)	hackerinvasion.f3322.net	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:16.135138988 CET	192.168.2.6	8.8.8.8	0xcac2	Standard query (0)	hackerinvasion.f3322.net	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:18.356760979 CET	192.168.2.6	8.8.8.8	0x9ff	Standard query (0)	hackerinvasion.f3322.net	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:20.463649035 CET	192.168.2.6	8.8.8.8	0xa314	Standard query (0)	hackerinvasion.f3322.net	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:21.935733080 CET	192.168.2.6	8.8.8.8	0x52d3	Standard query (0)	gfhhjgh.duckdns.org	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:23.130189896 CET	192.168.2.6	8.8.8.8	0xecc7	Standard query (0)	hackerinvasion.f3322.net	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:23.273044109 CET	192.168.2.6	8.8.8.8	0xc444	Standard query (0)	pool.usa-138.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Mar 8, 2022 18:00:25.247078896 CET	8.8.8.8	192.168.2.6	0x72ed	No error (0)	store-images.s-microsoft.com	store-images.s-microsoft.com-c.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Mar 8, 2022 18:01:02.530765057 CET	8.8.8.8	192.168.2.6	0xf287	No error (0)	gfhhjgh.duckdns.org		179.13.1.253	A (IP address)	IN (0x0001)
Mar 8, 2022 18:01:21.159094095 CET	8.8.8.8	192.168.2.6	0x6641	No error (0)	api.ipify.org	api.ipify.org.herokudns.com		CNAME (Canonical name)	IN (0x0001)
Mar 8, 2022 18:01:21.159094095 CET	8.8.8.8	192.168.2.6	0x6641	No error (0)	api.ipify.org.herokudns.com		52.20.78.240	A (IP address)	IN (0x0001)
Mar 8, 2022 18:01:21.159094095 CET	8.8.8.8	192.168.2.6	0x6641	No error (0)	api.ipify.org.herokudns.com		3.232.242.170	A (IP address)	IN (0x0001)
Mar 8, 2022 18:01:21.159094095 CET	8.8.8.8	192.168.2.6	0x6641	No error (0)	api.ipify.org.herokudns.com		3.220.57.224	A (IP address)	IN (0x0001)
Mar 8, 2022 18:01:21.159094095 CET	8.8.8.8	192.168.2.6	0x6641	No error (0)	api.ipify.org.herokudns.com		54.91.59.199	A (IP address)	IN (0x0001)
Mar 8, 2022 18:01:29.841167927 CET	8.8.8.8	192.168.2.6	0xd006	No error (0)	gfhhjgh.duckdns.org		179.13.1.253	A (IP address)	IN (0x0001)
Mar 8, 2022 18:01:52.276662111 CET	8.8.8.8	192.168.2.6	0xa2d	No error (0)	kazya1.hopto.org		41.249.51.34	A (IP address)	IN (0x0001)
Mar 8, 2022 18:01:56.216669083 CET	8.8.8.8	192.168.2.6	0xf35b	No error (0)	gfhhjgh.duckdns.org		179.13.1.253	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:29.169253111 CET	8.8.8.8	192.168.2.6	0xb207	No error (0)	gfhhjgh.duckdns.org		179.13.1.253	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:48.436398029 CET	8.8.8.8	192.168.2.6	0x771c	No error (0)	kazya1.hopto.org		41.249.51.34	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:48.491530895 CET	8.8.8.8	192.168.2.6	0x541d	No error (0)	hackerinvasion.f3322.net		127.0.0.1	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:48.538808107 CET	8.8.8.8	192.168.2.6	0x249f	No error (0)	yabynennet.xyz		45.129.99.212	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:48.738595963 CET	8.8.8.8	192.168.2.6	0x1458	No error (0)	hackerinvasion.f3322.net		127.0.0.1	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:49.731496096 CET	8.8.8.8	192.168.2.6	0x1de0	Name error (3)	123.105.12.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Mar 8, 2022 18:02:50.815732956 CET	8.8.8.8	192.168.2.6	0x2c	No error (0)	whatismyipaddress.com		104.16.154.36	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:50.815732956 CET	8.8.8.8	192.168.2.6	0x2c	No error (0)	whatismyipaddress.com		104.16.155.36	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:50.959239960 CET	8.8.8.8	192.168.2.6	0x1b81	No error (0)	whatismyipaddress.com		104.16.154.36	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:50.959239960 CET	8.8.8.8	192.168.2.6	0x1b81	No error (0)	whatismyipaddress.com		104.16.155.36	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:51.073822021 CET	8.8.8.8	192.168.2.6	0xa95e	No error (0)	hackerinvasion.f3322.net		127.0.0.1	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:52.455807924 CET	8.8.8.8	192.168.2.6	0x658b	Server failure (2)	prepepe.ac.ug	none	none	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:52.546967030 CET	8.8.8.8	192.168.2.6	0xb173	Server failure (2)	prepepe.ac.ug	none	none	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:52.664900064 CET	8.8.8.8	192.168.2.6	0xc570	Server failure (2)	prepepe.ac.ug	none	none	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:52.967892885 CET	8.8.8.8	192.168.2.6	0x28df	Server failure (2)	prepepe.ac.ug	none	none	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:53.099018097 CET	8.8.8.8	192.168.2.6	0x7f0c	Server failure (2)	prepepe.ac.ug	none	none	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:53.208043098 CET	8.8.8.8	192.168.2.6	0x73f9	Server failure (2)	prepepe.ac.ug	none	none	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:53.341078997 CET	8.8.8.8	192.168.2.6	0x59e3	Server failure (2)	prepepe.ac.ug	none	none	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:53.688494921 CET	8.8.8.8	192.168.2.6	0x1e6	No error (0)	hackerinvasion.f3322.net		127.0.0.1	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:54.832865000 CET	8.8.8.8	192.168.2.6	0x5dd4	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Mar 8, 2022 18:02:54.924410105 CET	8.8.8.8	192.168.2.6	0x4a0c	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Mar 8, 2022 18:02:55.684472084 CET	8.8.8.8	192.168.2.6	0xd501	No error (0)	gfhhjgh.duckdns.org		179.13.1.253	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:55.834017038 CET	8.8.8.8	192.168.2.6	0x259d	Server failure (2)	pretorian.ac.ug	none	none	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:55.903019905 CET	8.8.8.8	192.168.2.6	0x3236	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)
Mar 8, 2022 18:02:55.939817905 CET	8.8.8.8	192.168.2.6	0x66da	Server failure (2)	pretorian.ac.ug	none	none	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:56.227159977 CET	8.8.8.8	192.168.2.6	0x349d	No error (0)	hackerinvasion.f3322.net		127.0.0.1	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:57.091926098 CET	8.8.8.8	192.168.2.6	0xeaa	No error (0)	pool.usa-138.com		220.86.85.75	A (IP address)	IN (0x0001)
Mar 8, 2022 18:02:58.743158102 CET	8.8.8.8	192.168.2.6	0x8329	No error (0)	hackerinvasion.f3322.net		127.0.0.1	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:00.870723009 CET	8.8.8.8	192.168.2.6	0x4b12	No error (0)	hackerinvasion.f3322.net		127.0.0.1	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:03.046681881 CET	8.8.8.8	192.168.2.6	0x131b	No error (0)	hackerinvasion.f3322.net		127.0.0.1	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:05.199376106 CET	8.8.8.8	192.168.2.6	0xff00	No error (0)	hackerinvasion.f3322.net		127.0.0.1	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:07.343290091 CET	8.8.8.8	192.168.2.6	0xd5e2	No error (0)	hackerinvasion.f3322.net		127.0.0.1	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:09.787642956 CET	8.8.8.8	192.168.2.6	0x8118	No error (0)	hackerinvasion.f3322.net		127.0.0.1	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:11.490103006 CET	8.8.8.8	192.168.2.6	0x9cb7	No error (0)	files.000webhost.com	us-east-1.route-1000.000webhost.awex.io		CNAME (Canonical name)	IN (0x0001)
Mar 8, 2022 18:03:11.490103006 CET	8.8.8.8	192.168.2.6	0x9cb7	No error (0)	us-east-1.route-1000.000webhost.awex.io		145.14.144.149	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:11.689558983 CET	8.8.8.8	192.168.2.6	0x6983	No error (0)	kazya1.hopto.org		41.249.51.34	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:11.875169992 CET	8.8.8.8	192.168.2.6	0x9062	No error (0)	hackerinvasion.f3322.net		127.0.0.1	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:13.984797001 CET	8.8.8.8	192.168.2.6	0xd1b5	No error (0)	hackerinvasion.f3322.net		127.0.0.1	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:16.157701969 CET	8.8.8.8	192.168.2.6	0xcac2	No error (0)	hackerinvasion.f3322.net		127.0.0.1	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:18.376470089 CET	8.8.8.8	192.168.2.6	0x9ff	No error (0)	hackerinvasion.f3322.net		127.0.0.1	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:20.481589079 CET	8.8.8.8	192.168.2.6	0xa314	No error (0)	hackerinvasion.f3322.net		127.0.0.1	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:22.042737007 CET	8.8.8.8	192.168.2.6	0x52d3	No error (0)	gfhhjgh.duckdns.org		179.13.1.253	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:23.148067951 CET	8.8.8.8	192.168.2.6	0xecc7	No error (0)	hackerinvasion.f3322.net		127.0.0.1	A (IP address)	IN (0x0001)
Mar 8, 2022 18:03:23.588294983 CET	8.8.8.8	192.168.2.6	0xc444	No error (0)	pool.usa-138.com		220.86.85.75	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

api.ipify.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49770	52.20.78.240	80	C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe

Timestamp	kBytes transferred	Direction	Data
Mar 8, 2022 18:01:21.456914902 CET	1230	OUT	GET /?format=xml HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.ipify.org Connection: Keep-Alive
Mar 8, 2022 18:01:21.597302914 CET	1230	IN	HTTP/1.1 200 OK Server: Cowboy Connection: keep-alive Content-Type: text/plain Vary: Origin Date: Tue, 08 Mar 2022 17:01:21 GMT Content-Length: 10 Via: 1.1 vegur Data Raw: 38 34 2e 31 37 2e 35 32 2e 37 Data Ascii: 84.17.52.7

Target ID:	0
Start time:	18:00:31
Start date:	08/03/2022
Path:	C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RIP_YOUR_PC_LOL.exe"
Imagebase:	0x9f0000
File size:	23633920 bytes
MD5 hash:	52867174362410D63215D78E708103EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000003.388952115.00000000059C7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000003.388952115.00000000059C7000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: LokiBot_Dropper_Packed_R11_Feb18, Description: Auto-generated rule - file scan copy.pdf.r11, Source: 00000000.00000000.374606826.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, Author: Florian Roth Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000000.374606826.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000000.374606826.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: LokiBot_Dropper_Packed_R11_Feb18, Description: Auto-generated rule - file scan copy.pdf.r11, Source: 00000000.00000002.693319449.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, Author: Florian Roth Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.693319449.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000002.693319449.0000000001F6B000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000000.00000000.366341482.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000000.00000002.502131214.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000000.00000002.502131214.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000000.00000002.502131214.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000000.00000002.502131214.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000000.00000002.502131214.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000003.386628983.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: 00000000.00000003.386628983.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Author: Brian Wallace @botnet_hunter Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: njrat1, Description: Identify njRat, Source: 00000000.00000000.371829021.0000000001893000.00000002.00000001.01000000.00000003.sdmp, Author: Brian Wallace @botnet_hunter Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000000.00000003.437188672.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000000.00000001.375725825.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000000.00000001.375725825.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000000.00000001.375725825.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000000.00000001.375725825.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000000.00000001.375725825.00000000009F2000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.679442760.0000000001893000.00000002.00000001.01000000.00000003.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.679442760.0000000001893000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.679442760.0000000001893000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000002.679442760.0000000001893000.00000002.00000001.01000000.00000003.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: njrat1, Description: Identify njRat, Source: 00000000.00000002.679442760.0000000001893000.00000002.00000001.01000000.00000003.sdmp, Author: Brian Wallace @botnet_hunter
Reputation:	low

Analysis Process: healastounding.exePID: 3572, Parent PID: 6880

General

Target ID:	4
Start time:	18:00:38
Start date:	08/03/2022
Path:	C:\Users\user\AppData\Roaming\healastounding.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\healastounding.exe"
Imagebase:	0x900000
File size:	3733504 bytes
MD5 hash:	6FB798F1090448CE26299C2B35ACF876
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: njrat1, Description: Identify njRat, Source: 00000004.00000000.385235005.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Brian Wallace @botnet_hunter Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: njrat1, Description: Identify njRat, Source: 00000004.00000002.538356356.0000000003471000.00000004.00000800.00020000.00000000.sdmp, Author: Brian Wallace @botnet_hunter Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: njrat1, Description: Identify njRat, Source: 00000004.00000002.463698979.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Brian Wallace @botnet_hunter Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000004.00000002.546334194.0000000004474000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth Rule: LokiBot_Dropper_Packed_R11_Feb18, Description: Auto-generated rule - file scan copy.pdf.r11, Source: 00000004.00000002.546334194.0000000004474000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000004.00000002.546334194.0000000004474000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000004.00000002.546334194.0000000004474000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: njrat1, Description: Identify njRat, Source: 00000004.00000000.381351381.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Brian Wallace @botnet_hunter Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: njrat1, Description: Identify njRat, Source: 00000004.00000000.382829254.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Brian Wallace @botnet_hunter Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: njrat1, Description: Identify njRat, Source: 00000004.00000000.383946223.0000000000902000.00000002.00000001.01000000.00000005.sdmp, Author: Brian Wallace @botnet_hunter Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: C:\Users\user\AppData\Roaming\healastounding.exe, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: C:\Users\user\AppData\Roaming\healastounding.exe, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Roaming\healastounding.exe, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\healastounding.exe, Author: Joe Security Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\healastounding.exe, Author: ditekSHen Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: C:\Users\user\AppData\Roaming\healastounding.exe, Author: ditekSHen Rule: NanoCore, Description: unknown, Source: C:\Users\user\AppData\Roaming\healastounding.exe, Author: Kevin Breen <kevin@techanarchy.net> Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Roaming\healastounding.exe, Author: Brian Wallace @botnet_hunter
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Analysis Process: Pluto Panel.exePID: 4236, Parent PID: 6880

General

Target ID:	5
Start time:	18:00:43
Start date:	08/03/2022
Path:	C:\Users\user\AppData\Roaming\Pluto Panel.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Pluto Panel.exe"
Imagebase:	0xf10000
File size:	913920 bytes
MD5 hash:	ED666BF7F4A0766FCEC0E9C8074B089B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000005.00000002.711210574.0000000004691000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000005.00000002.711210574.0000000004691000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000005.00000000.393171200.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000005.00000002.706080641.00000000036DB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000005.00000002.706080641.00000000036DB000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: HKTL_NET_GUID_Stealer, Description: Detects c# red/black-team tools via typelibguid, Source: 00000005.00000002.712472379.0000000007710000.00000004.00000001.00040000.00000000.sdmp, Author: Arnim Rupp Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000005.00000000.394040229.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000005.00000000.394040229.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000005.00000000.394040229.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000005.00000000.394040229.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000005.00000000.394040229.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: JPCERT/CC Incident Response Group Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000005.00000000.394636472.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000005.00000000.394636472.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000005.00000000.394636472.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000005.00000000.394636472.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000005.00000000.394636472.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: JPCERT/CC Incident Response Group Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000005.00000002.701277187.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000005.00000002.701277187.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000005.00000002.701277187.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000005.00000002.701277187.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000005.00000002.701277187.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: JPCERT/CC Incident Response Group Rule: HKTL_NET_GUID_Stealer, Description: Detects c# red/black-team tools via typelibguid, Source: 00000005.00000002.712461562.0000000007700000.00000004.00000001.00040000.00000000.sdmp, Author: Arnim Rupp Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000005.00000000.397247474.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000005.00000000.397247474.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000005.00000000.397247474.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000005.00000000.397247474.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000005.00000000.397247474.0000000000F12000.00000002.00000001.01000000.00000006.sdmp, Author: JPCERT/CC Incident Response Group Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe, Author: Kevin Breen <kevin@techanarchy.net> Rule: HKTL_NET_GUID_Stealer, Description: Detects c# red/black-team tools via typelibguid, Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe, Author: Arnim Rupp Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe, Author: Joe Security Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe, Author: Joe Security Rule: Hawkeye, Description: detect HawkEye in memory, Source: C:\Users\user\AppData\Roaming\Pluto Panel.exe, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Analysis Process: test.exePID: 6236, Parent PID: 3572

General

Target ID:	6
Start time:	18:00:44
Start date:	08/03/2022
Path:	C:\Users\user\AppData\Roaming\test.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\test.exe"
Imagebase:	0xda0000
File size:	46080 bytes
MD5 hash:	7E50B292982932190179245C60C0B59B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000006.00000000.397644420.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000006.00000000.397644420.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000006.00000002.701971433.0000000001354000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000006.00000000.405813841.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000006.00000000.405813841.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000006.00000000.394727625.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000006.00000000.394727625.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000006.00000000.399704980.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000006.00000000.399704980.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000006.00000002.703770994.00000000030D1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000006.00000002.701012196.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000006.00000002.701012196.0000000000DA2000.00000002.00000001.01000000.00000007.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Roaming\test.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\AppData\Roaming\test.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Analysis Process: 0fd7de5367376231a788872005d7ed4f.exePID: 2024, Parent PID: 6880

General

Target ID:	7
Start time:	18:00:50
Start date:	08/03/2022
Path:	C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe"
Imagebase:	0x400000
File size:	549556 bytes
MD5 hash:	0FD7DE5367376231A788872005D7ED4F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ficker_stealer, Description: Yara detected Ficker Stealer, Source: 00000007.00000002.468272297.00000000024F0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 29%, Metadefender, Browse Detection: 92%, ReversingLabs
Reputation:	low

Analysis Process: gay.exePID: 1104, Parent PID: 3572

General

Target ID:	8
Start time:	18:00:51
Start date:	08/03/2022
Path:	C:\Users\user\AppData\Roaming\gay.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\gay.exe"
Imagebase:	0xd0000
File size:	37888 bytes
MD5 hash:	8EEDC01C11B251481DEC59E5308DCCC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000008.00000000.411478373.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: 00000008.00000000.411478373.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, Author: Brian Wallace @botnet_hunter Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000008.00000002.449565052.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: 00000008.00000002.449565052.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, Author: Brian Wallace @botnet_hunter Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000008.00000000.410285813.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: 00000008.00000000.410285813.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, Author: Brian Wallace @botnet_hunter Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000008.00000000.408615715.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: 00000008.00000000.408615715.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, Author: Brian Wallace @botnet_hunter Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000008.00000000.409570794.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: 00000008.00000000.409570794.00000000000D2000.00000002.00000001.01000000.00000009.sdmp, Author: Brian Wallace @botnet_hunter Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\gay.exe, Author: Joe Security Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\gay.exe, Author: ditekSHen Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Roaming\gay.exe, Author: Brian Wallace @botnet_hunter
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Analysis Process: Opus.exePID: 3244, Parent PID: 3572

General

Target ID:	9
Start time:	18:00:53
Start date:	08/03/2022
Path:	C:\Users\user\AppData\Roaming\Opus.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Opus.exe"
Imagebase:	0x840000
File size:	208384 bytes
MD5 hash:	759185EE3724D7563B709C888C696959
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000000.414257385.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000000.414257385.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000000.414257385.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000002.707363158.0000000003ECB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000002.707363158.0000000003ECB000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000000.414807841.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000000.414807841.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000000.414807841.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000000.416456851.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000000.416456851.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000000.416456851.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000002.700831183.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000002.700831183.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000002.700831183.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000000.415266906.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000000.415266906.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000000.415266906.0000000000842000.00000002.00000001.01000000.0000000A.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000002.708577022.0000000005870000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000009.00000002.708577022.0000000005870000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000009.00000002.708577022.0000000005870000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000002.708751563.0000000005B00000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000009.00000002.708751563.0000000005B00000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000002.708751563.0000000005B00000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000009.00000002.708751563.0000000005B00000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: C:\Users\user\AppData\Roaming\Opus.exe, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: C:\Users\user\AppData\Roaming\Opus.exe, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: C:\Users\user\AppData\Roaming\Opus.exe, Author: Joe Security Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: C:\Users\user\AppData\Roaming\Opus.exe, Author: ditekSHen Rule: NanoCore, Description: unknown, Source: C:\Users\user\AppData\Roaming\Opus.exe, Author: Kevin Breen <kevin@techanarchy.net>
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Analysis Process: 22.exePID: 1272, Parent PID: 6880

General

Target ID:	11
Start time:	18:00:57
Start date:	08/03/2022
Path:	C:\Users\user\AppData\Roaming\22.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\22.exe"
Imagebase:	0x400000
File size:	2101248 bytes
MD5 hash:	DBF9DAA1707B1037E28A6E0694B33A4B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_BlackMoon, Description: Detects executables using BlackMoon RunTime, Source: C:\Users\user\AppData\Roaming\22.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 38%, Metadefender, Browse Detection: 86%, ReversingLabs
Reputation:	low

Analysis Process: aaa.exePID: 3984, Parent PID: 3572

General

Target ID:	12
Start time:	18:00:57
Start date:	08/03/2022
Path:	C:\Users\user\AppData\Roaming\aaa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\aaa.exe"
Imagebase:	0x2c0000
File size:	122880 bytes
MD5 hash:	860AA57FC3578F7037BB27FC79B2A62C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Analysis Process: 8f1c8b40c7be588389a8d382040b23bb.exePID: 5376, Parent PID: 3572

General

Target ID:	14
Start time:	18:00:59
Start date:	08/03/2022
Path:	C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe"
Imagebase:	0x400000
File size:	1241088 bytes
MD5 hash:	8F1C8B40C7BE588389A8D382040B23BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 26%, Metadefender, Browse Detection: 86%, ReversingLabs
Reputation:	low

Analysis Process: 0fd7de5367376231a788872005d7ed4f.exePID: 5172, Parent PID: 2024

General

Target ID:	15
Start time:	18:00:59
Start date:	08/03/2022
Path:	C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe"
Imagebase:	0x400000
File size:	549556 bytes
MD5 hash:	0FD7DE5367376231A788872005D7ED4F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: 4.exePID: 2824, Parent PID: 3572

General

Target ID:	16
Start time:	18:01:04
Start date:	08/03/2022
Path:	C:\Users\user\AppData\Roaming\4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\4.exe"
Imagebase:	0x11d0000
File size:	579127 bytes
MD5 hash:	E6DACE3F577AC7A6F9747B4A0956C8D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 17%, Metadefender, Browse Detection: 75%, ReversingLabs
Reputation:	low

Analysis Process: mediaget.exePID: 4688, Parent PID: 1104

General

Target ID:	17
Start time:	18:01:07
Start date:	08/03/2022
Path:	C:\Users\user\AppData\Roaming\mediaget.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\mediaget.exe"
Imagebase:	0xab0000
File size:	37888 bytes
MD5 hash:	8EEDC01C11B251481DEC59E5308DCCC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000011.00000000.445953483.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: 00000011.00000000.445953483.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, Author: Brian Wallace @botnet_hunter Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000011.00000002.701265514.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: 00000011.00000002.701265514.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, Author: Brian Wallace @botnet_hunter Rule: njrat1, Description: Identify njRat, Source: 00000011.00000003.646152049.0000000001338000.00000004.00000020.00020000.00000000.sdmp, Author: Brian Wallace @botnet_hunter Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000011.00000000.445251023.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: 00000011.00000000.445251023.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, Author: Brian Wallace @botnet_hunter Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000011.00000000.447375879.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: 00000011.00000000.447375879.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, Author: Brian Wallace @botnet_hunter Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000011.00000000.446671445.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: 00000011.00000000.446671445.0000000000AB2000.00000002.00000001.01000000.0000000F.sdmp, Author: Brian Wallace @botnet_hunter Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\mediaget.exe, Author: Joe Security Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\mediaget.exe, Author: ditekSHen Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Roaming\mediaget.exe, Author: Brian Wallace @botnet_hunter
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Disassembly

⊘No disassembly

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RIP_YOUR_PC_LOL.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

AV Detection

E-Banking Fraud

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

C:\ProgramData\kaosdma.txt

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RIP_YOUR_PC_LOL.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\aaa.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\gay.exe.log

Windows Analysis Report
RIP_YOUR_PC_LOL.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre