Windows Analysis Report
ePAY-Advice_Rf[UC7749879100].exe

Overview

General Information

Sample Name:	ePAY-Advice_Rf[UC7749879100].exe
Analysis ID:	828721
MD5:	06bf8620598b674fc3506a2844d42d65
SHA1:	00e28bd96e338f7bfff9c41d985de05f010d8ea7
SHA256:	98883d7d2678fd8cbdad8b8c1ca7cf13a797b1074f081dee24aba14dcc346ffe
Tags:	exeguloaderlokibotsigned
Infos:

Detection

GuLoader

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Tries to detect virtualization through RDTSC time measurements

Uses 32bit PE files

Sample file is different than original file name gathered from version info

Drops PE files

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

PE / OLE file has an invalid certificate

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: ePAY-Advice_Rf[UC7749879100].exe	ReversingLabs: Detection: 28%
Source: ePAY-Advice_Rf[UC7749879100].exe	Virustotal: Detection: 32%			Perma Link

Uses 32bit PE files

Source: ePAY-Advice_Rf[UC7749879100].exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: ePAY-Advice_Rf[UC7749879100].exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\AEGISIIIRadeonHelper.pdb source: ePAY-Advice_Rf[UC7749879100].exe, 00000000.00000003.302601111.000000000283C000.00000004.00000020.00020000.00000000.sdmp, AEGISIIIRadeonHelper.dll.0.dr

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe	Code function: 0_2_0040626D FindFirstFileA,FindClose,	0_2_0040626D
Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe	Code function: 0_2_00405732 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405732
Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe	Code function: 0_2_004026FE FindFirstFileA,	0_2_004026FE

Source: ePAY-Advice_Rf[UC7749879100].exe, 00000000.00000003.302601111.000000000283C000.00000004.00000020.00020000.00000000.sdmp, AEGISIIIRadeonHelper.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: ePAY-Advice_Rf[UC7749879100].exe, 00000000.00000003.302601111.000000000283C000.00000004.00000020.00020000.00000000.sdmp, AEGISIIIRadeonHelper.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: ePAY-Advice_Rf[UC7749879100].exe, 00000000.00000003.302601111.000000000283C000.00000004.00000020.00020000.00000000.sdmp, AEGISIIIRadeonHelper.dll.0.dr	String found in binary or memory: http://crl.globalsign.com/gsextendcodesignsha2g3.crl0
Source: ePAY-Advice_Rf[UC7749879100].exe, 00000000.00000003.302601111.000000000283C000.00000004.00000020.00020000.00000000.sdmp, AEGISIIIRadeonHelper.dll.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0b
Source: ePAY-Advice_Rf[UC7749879100].exe, 00000000.00000003.302601111.000000000283C000.00000004.00000020.00020000.00000000.sdmp, AEGISIIIRadeonHelper.dll.0.dr	String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: ePAY-Advice_Rf[UC7749879100].exe, 00000000.00000003.302601111.000000000283C000.00000004.00000020.00020000.00000000.sdmp, AEGISIIIRadeonHelper.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: ePAY-Advice_Rf[UC7749879100].exe, 00000000.00000003.302601111.000000000283C000.00000004.00000020.00020000.00000000.sdmp, AEGISIIIRadeonHelper.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: ePAY-Advice_Rf[UC7749879100].exe, 00000000.00000003.302601111.000000000283C000.00000004.00000020.00020000.00000000.sdmp, AEGISIIIRadeonHelper.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: ePAY-Advice_Rf[UC7749879100].exe, 00000000.00000003.302601111.000000000283C000.00000004.00000020.00020000.00000000.sdmp, AEGISIIIRadeonHelper.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: ePAY-Advice_Rf[UC7749879100].exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: ePAY-Advice_Rf[UC7749879100].exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ePAY-Advice_Rf[UC7749879100].exe, 00000000.00000003.302601111.000000000283C000.00000004.00000020.00020000.00000000.sdmp, AEGISIIIRadeonHelper.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: ePAY-Advice_Rf[UC7749879100].exe, 00000000.00000003.302601111.000000000283C000.00000004.00000020.00020000.00000000.sdmp, AEGISIIIRadeonHelper.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: ePAY-Advice_Rf[UC7749879100].exe, 00000000.00000003.302601111.000000000283C000.00000004.00000020.00020000.00000000.sdmp, AEGISIIIRadeonHelper.dll.0.dr	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: ePAY-Advice_Rf[UC7749879100].exe, 00000000.00000003.302601111.000000000283C000.00000004.00000020.00020000.00000000.sdmp, AEGISIIIRadeonHelper.dll.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/gsextendcodesignsha2g30U
Source: ePAY-Advice_Rf[UC7749879100].exe, 00000000.00000003.302601111.000000000283C000.00000004.00000020.00020000.00000000.sdmp, AEGISIIIRadeonHelper.dll.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: ePAY-Advice_Rf[UC7749879100].exe, 00000000.00000003.302601111.000000000283C000.00000004.00000020.00020000.00000000.sdmp, AEGISIIIRadeonHelper.dll.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsextendcodesignsha2g3ocsp.crt0
Source: ePAY-Advice_Rf[UC7749879100].exe, 00000000.00000003.302601111.000000000283C000.00000004.00000020.00020000.00000000.sdmp, AEGISIIIRadeonHelper.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: ePAY-Advice_Rf[UC7749879100].exe, 00000000.00000003.302601111.000000000283C000.00000004.00000020.00020000.00000000.sdmp, AEGISIIIRadeonHelper.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: ePAY-Advice_Rf[UC7749879100].exe, 00000000.00000003.302601111.000000000283C000.00000004.00000020.00020000.00000000.sdmp, AEGISIIIRadeonHelper.dll.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Contains functionality for read data from the clipboard

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe

Code function: 0_2_004051CF GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004051CF

Uses 32bit PE files

Source: ePAY-Advice_Rf[UC7749879100].exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Sample file is different than original file name gathered from version info

Source: ePAY-Advice_Rf[UC7749879100].exe, 00000000.00000003.302601111.000000000283C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameAEGISIIIRadeonHelper< vs ePAY-Advice_Rf[UC7749879100].exe

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe

Code function: 0_2_004031D6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004031D6

Detected potential crypto function

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe	Code function: 0_2_00404A0E	0_2_00404A0E
Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe	Code function: 0_2_004065F6	0_2_004065F6
Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe	Code function: 0_2_6E161A9C	0_2_6E161A9C

PE / OLE file has an invalid certificate

Source: ePAY-Advice_Rf[UC7749879100].exe

Static PE information: invalid certificate

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe

Process Stats: CPU usage > 98%

Source: ePAY-Advice_Rf[UC7749879100].exe	ReversingLabs: Detection: 28%
Source: ePAY-Advice_Rf[UC7749879100].exe	Virustotal: Detection: 32%

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe

File read: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe

Jump to behavior

Source: ePAY-Advice_Rf[UC7749879100].exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe

0_2_004031D6

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe

File created: C:\Users\user\AppData\Roaming\fumigatorium

Jump to behavior

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe

File created: C:\Users\user\AppData\Local\Temp\nsoCDB4.tmp

Jump to behavior

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe

File written: C:\Users\user\AppData\Local\Temp\Kontos.ini

Jump to behavior

Source: classification engine

Classification label: mal68.troj.evad.winEXE@1/17@0/0

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe

Code function: 0_2_004020D1 CoCreateInstance,MultiByteToWideChar,

0_2_004020D1

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe

Code function: 0_2_0040449B GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_0040449B

Source: ePAY-Advice_Rf[UC7749879100].exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: Process Memory Space: ePAY-Advice_Rf[UC7749879100].exe PID: 6136, type: MEMORYSTR
Source: Yara match	File source: 00000000.00000002.824199107.0000000004568000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe

Code function: 0_2_6E162F20 push eax; ret

0_2_6E162F4E

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe

Code function: 0_2_6E161A9C GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_6E161A9C

Drops PE files

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe	File created: C:\Users\user\AppData\Roaming\fumigatorium\Tertser\Omstrukturdnr\AEGISIIIRadeonHelper.dll			Jump to dropped file
Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe	File created: C:\Users\user\AppData\Local\Temp\nslD140.tmp\System.dll			Jump to dropped file

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe

RDTSC instruction interceptor: First address: 0000000004CAC6E4 second address: 0000000004CAC6E4 instructions: 0x00000000 rdtsc 0x00000002 test cx, cx 0x00000005 cmp dx, cx 0x00000008 cmp ebx, ecx 0x0000000a jc 00007FA1BC50078Dh 0x0000000c cmp ecx, edx 0x0000000e cmp al, dl 0x00000010 inc ebp 0x00000011 cmp bx, ax 0x00000014 inc ebx 0x00000015 rdtsc

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe

Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\fumigatorium\Tertser\Omstrukturdnr\AEGISIIIRadeonHelper.dll

Jump to dropped file

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe	Code function: 0_2_0040626D FindFirstFileA,FindClose,	0_2_0040626D
Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe	Code function: 0_2_00405732 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405732
Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe	Code function: 0_2_004026FE FindFirstFileA,	0_2_004026FE

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe	API call chain: ExitProcess graph end node

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe

Code function: 0_2_6E161A9C GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_6E161A9C

Source: C:\Users\user\Desktop\ePAY-Advice_Rf[UC7749879100].exe

0_2_004031D6

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

ID:	828721
Product:	CloudBasic
Start time:	13:56:47
Start date:	17.03.2023
Sample:	ePAY-Advice_Rf[UC7749879100].exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	06bf8620598b674fc3506a2844d42d65
SHA1:	00e28bd96e338f7bfff9c41d985de05f010d8ea7
SHA256:	98883d7d2678fd8cbdad8b8c1ca7cf13a797b1074f081dee24aba14dcc346ffe
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Temp\Kontos.ini	ASCII text, with CRLF line terminators	FB5EE2C0CAC332EC8390F50016EF0769	11D9FB52FE5289140B9D52A38B56F99512B3A3A7	C557AFE51AB22916E3423820A09D3805BF9DCDCECBEC4FE8DE2C67FB023BA631
C:\Users\user\AppData\Local\Temp\nslD140.tmp\System.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	B0C77267F13B2F87C084FD86EF51CCFC	F7543F9E9B4F04386DFBF33C38CBED1BF205AFB3	A0CAC4CF4852895619BC7743EBEB89F9E4927CCDB9E66B1BCD92A4136D0F9C77
C:\Users\user\AppData\Roaming\fumigatorium\Tertser\Omstrukturdnr\AEGISIIIRadeonHelper.dll	PE32+ executable (DLL) (GUI) x86-64, for MS Windows	4FC7FC174E80C178225C2509027DF961	9FF62413EC0DD462F5F016EBC804F1D736D24796	866B31DD39B97DEDAFD0FBD5672639EE91B47AD319C47816B4F6D01BFF93FF8C
C:\Users\user\AppData\Roaming\fumigatorium\Tertser\Omstrukturdnr\Fatalismen.Int	data	4D698E219A6C687613078B94085D51FE	52A9BD9EF707F72A14006D4FDA0989F11A5616B9	5E0F6244C6A33528CFCEC4C23F45F6238EA57818484B602086D26562F498EF49
C:\Users\user\AppData\Roaming\fumigatorium\Tertser\Omstrukturdnr\Provokations.Fje	data	69FFEE981CA33B2B99A58323AE19A198	C9B1C33C92AE9BAE354B11A9F8F09639B7A8D493	6623E3157B8615EBC31FE362C9058FFA9682A033822ED7A5E965A086D5F069A3
C:\Users\user\AppData\Roaming\fumigatorium\Tertser\Omstrukturdnr\Rekapitulerer\Inseminerede79\avatar-default-symbolic.svg	SVG Scalable Vector Graphics image	8B727826F9D8C0C7C954EDE912CB0DEB	1518AA80747326B5353C22D32E57A33D61285119	0783A7F518D3879C8F0F50B45FBD779A98652469E9B7C659CE41F14D1629D334
C:\Users\user\AppData\Roaming\fumigatorium\Tertser\Omstrukturdnr\Rekapitulerer\Inseminerede79\be.txt	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	3C21135144AC7452E7DB66F0214F9D68	B1EC0589D769EAB5E4E8F0F8C21B157EF5EBB47D	D095879B8BBC67A1C9875C5E9896942BACF730BD76155C06105544408068C59E
C:\Users\user\AppData\Roaming\fumigatorium\Tertser\Omstrukturdnr\Rekapitulerer\Inseminerede79\changes-allow-symbolic.svg	SVG Scalable Vector Graphics image	CB1EEE7BDB582B756D0F68EF02D6D96D	9E9B0F25BC472EF1C1C13EEAC12FD11C4CC0D2D9	20EA767E852A8EBF2C5BA16D56CBAE10BD09D6CBA89B372A57EAA973AD3281B4
C:\Users\user\AppData\Roaming\fumigatorium\Tertser\Omstrukturdnr\Rekapitulerer\Inseminerede79\dotnet.api	HTML document, ASCII text, with CRLF line terminators	5343C1A8B203C162A3BF3870D9F50FD4	04B5B886C20D88B57EEA6D8FF882624A4AC1E51D	DC1D54DAB6EC8C00F70137927504E4F222C8395F10760B6BEECFCFA94E08249F
C:\Users\user\AppData\Roaming\fumigatorium\Tertser\Omstrukturdnr\Rekapitulerer\Inseminerede79\ebook-reader.png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	BFF011148B773FA44B9A9BB029E8CC52	F2B838927E320D12649CEFDEA3AFE383C6650D7C	B21DE7B432A7A67544D007ECC0FDD95F8E8C6129AF558A32102EE04C08635653
C:\Users\user\AppData\Roaming\fumigatorium\Tertser\Omstrukturdnr\Rekapitulerer\Inseminerede79\emblem-photos-symbolic.svg	SVG Scalable Vector Graphics image	379690952AAA576521D51249D404CBCD	61A8A95B0454422AA47379CF983B99FFDD839439	EAD402FB0B85DB153356EC695016FD4F2C4031367D8ED6D1C1EF5FF4F28A8DE8
C:\Users\user\AppData\Roaming\fumigatorium\Tertser\Omstrukturdnr\Rekapitulerer\Inseminerede79\font-select-symbolic.symbolic.png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	C84EE7522C124892455BB09DEBCF9340	AF87A2A5688346A3902762DD250328B7EF224620	E0A3BD6FE1A1BAEFFE04BCA2980ADF755F888E31DCE3686B16C5DAC4202A38C8
C:\Users\user\AppData\Roaming\fumigatorium\Tertser\Omstrukturdnr\Rekapitulerer\Inseminerede79\network-wired-symbolic.symbolic.png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	1ED278AD206D6EA33FF787DD326E0FC5	8CFF7AD12FC0E5545E71D05879A0245BEDAF4D46	CC88E76F7C7D2E5B07E49D1F2AD88F8BAFC0542EB11CEB2B2FFF235C87AB4417
C:\Users\user\AppData\Roaming\fumigatorium\Tertser\Omstrukturdnr\Rekapitulerer\Inseminerede79\pan-start-symbolic.symbolic.png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	4308BBBAB1DB146494AE5ABB07B8E6DB	58121574EEB070E26DDD75A964F3548E176E58A4	EFB732049C674EB25BFCB2FA0CBCC45D24190BF1479C054647F424B31E34C828
C:\Users\user\AppData\Roaming\fumigatorium\Tertser\Omstrukturdnr\Rekapitulerer\Inseminerede79\printer-symbolic.symbolic.png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	38D787F55E22FB591135F9250CD259D4	0E135B0E1CA49A6E43DB4CB7596FAEA022E23924	1ED839B015A67CAB9948469975411D982A96314CE82851EA2F9F6BB8D733A002
C:\Users\user\AppData\Roaming\fumigatorium\Tertser\Omstrukturdnr\Rekapitulerer\Inseminerede79\pt-br.txt	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	7B02E1AE16E2E709D7C97DE560B4DBE9	191A54644417F7D36F5CB4182DCDB3737D74BE51	DA0B58F52BBC131F967942D1D8E9DE1B5721AE864BC21852A0AD4062332297CB
C:\Users\user\AppData\Roaming\fumigatorium\Tertser\Omstrukturdnr\omfartsvejene\Reberbanernes\Muhamedaneres\Sminknings\LogoCanary.png	PNG image data, 600 x 600, 8-bit/color RGBA, non-interlaced	F80867A421C85C6E2865CF85FF7C4B02	C3EAB6B7E92646FE3407B2B3C5AFFE13A7873C48	BCAA3B1333919176137D4DE4B1E3F31126159B12F959D7277BD8537B95139BD3

Windows Analysis Report
ePAY-Advice_Rf[UC7749879100].exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report ePAY-Advice_Rf[UC7749879100].exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
ePAY-Advice_Rf[UC7749879100].exe