download: | kas.exe |
Full analysis: | https://app.any.run/tasks/f664037f-f51f-4550-a665-6e0df9749831 |
Verdict: | Malicious activity |
Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
Analysis date: | November 15, 2018, 05:51:47 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | EF799CC812F9586EF29977A6790C1EF3 |
SHA1: | 4BCAC15F480A820FC309E16B28D6D60440A05A40 |
SHA256: | 477BDCB60720BD01CBE7BEBE8A0C2A30119613D19C4D6FC46FB011DBB7004DBF |
SSDEEP: | 12288:qniM77wBJ66ohZBRVfE0rm3JWl2RTaRhB4YGRNh:qniiwy6ohTRVfEJNh |
.exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
---|---|---|
.exe | | | Win32 Executable (generic) (4.9) |
.exe | | | Generic Win/DOS Executable (2.2) |
.exe | | | DOS Executable Generic (2.2) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2011:04:02 16:29:59+02:00 |
PEType: | PE32 |
LinkerVersion: | 6 |
CodeSize: | 581632 |
InitializedDataSize: | 24576 |
UninitializedDataSize: | - |
EntryPoint: | 0x14b8 |
OSVersion: | 4 |
ImageVersion: | 9.8 |
SubsystemVersion: | 4 |
Subsystem: | Windows GUI |
FileVersionNumber: | 9.8.0.0 |
ProductVersionNumber: | 9.8.0.0 |
FileFlagsMask: | 0x0000 |
FileFlags: | (none) |
FileOS: | Win32 |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | English (U.S.) |
CharacterSet: | Unicode |
Comments: | Scherzo8 |
CompanyName: | BASTIONARY6 |
FileDescription: | Jawfooted7 |
LegalCopyright: | Inrolling6 |
LegalTrademarks: | Ludama4 |
ProductName: | HASTINGS5 |
FileVersion: | 9.08 |
ProductVersion: | 9.08 |
InternalName: | Semite4 |
OriginalFileName: | Semite4.exe |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 02-Apr-2011 14:29:59 |
Detected languages: |
|
Comments: | Scherzo8 |
CompanyName: | BASTIONARY6 |
FileDescription: | Jawfooted7 |
LegalCopyright: | Inrolling6 |
LegalTrademarks: | Ludama4 |
ProductName: | HASTINGS5 |
FileVersion: | 9.08 |
ProductVersion: | 9.08 |
InternalName: | Semite4 |
OriginalFilename: | Semite4.exe |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x000000B8 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 3 |
Time date stamp: | 02-Apr-2011 14:29:59 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0008D12C | 0x0008E000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.89103 |
.data | 0x0008F000 | 0x00000B60 | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rsrc | 0x00090000 | 0x00004322 | 0x00005000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 3.62611 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 3.333 | 756 | Unicode (UTF 16LE) | English - United States | RT_VERSION |
30001 | 3.34955 | 5672 | Unicode (UTF 16LE) | UNKNOWN | RT_ICON |
30002 | 3.77295 | 6200 | Unicode (UTF 16LE) | UNKNOWN | RT_ICON |
30003 | 3.60246 | 3240 | Unicode (UTF 16LE) | UNKNOWN | RT_ICON |
30004 | 3.31799 | 872 | Unicode (UTF 16LE) | UNKNOWN | RT_ICON |
MSVBVM60.DLL |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2916 | "C:\Users\admin\AppData\Local\Temp\kas.exe" | C:\Users\admin\AppData\Local\Temp\kas.exe | — | explorer.exe |
User: admin Company: BASTIONARY6 Integrity Level: MEDIUM Description: Jawfooted7 Exit code: 0 Version: 9.08 | ||||
584 | C:\Users\admin\AppData\Local\Temp\kas.exe" | C:\Users\admin\AppData\Local\Temp\kas.exe | — | kas.exe |
User: admin Company: BASTIONARY6 Integrity Level: MEDIUM Description: Jawfooted7 Exit code: 0 Version: 9.08 | ||||
3220 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\system32\taskmgr.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3768 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\system32\taskmgr.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3280 | "C:\Windows\System32\chkdsk.exe" | C:\Windows\System32\chkdsk.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Check Disk Utility Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1488 | /c del "C:\Users\admin\AppData\Local\Temp\kas.exe" | C:\Windows\System32\cmd.exe | — | chkdsk.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1604 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2064 | "C:\Program Files\Mozilla Firefox\Firefox.exe" | C:\Program Files\Mozilla Firefox\Firefox.exe | chkdsk.exe | |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 61.0.2 |
(PID) Process: | (1604) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count |
Operation: | write | Name: | {Q65231O0-O2S1-4857-N4PR-N8R7P6RN7Q27}\gnfxzte.rkr |
Value: 00000000000000000E000000F7FC0400000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFF000000000000000000000000 | |||
(PID) Process: | (1604) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count |
Operation: | write | Name: | HRZR_PGYFRFFVBA |
Value: 000000002600000032000000FAC01000090000000B000000DCC402007B00370043003500410034003000450046002D0041003000460042002D0034004200460043002D0038003700340041002D004300300046003200450030004200390046004100380045007D005C00410064006F00620065005C004100630072006F0062006100740020005200650061006400650072002000440043005C005200650061006400650072005C004100630072006F0052006400330032002E0065007800650000000000D09866060000000034E82802C05D5A740200000002000000000C00940F000000E8E82802010000000400000001000000010000006B001001D098660605000000D098660602020000E20101AE2B51EA0088E7280239B58D76E20101AE24E82802130000000400000030000000120000001D000000130000001D0000000E00000012000000020000003200000014000000E387EE7A38E82802F3AE5B7400574100E20101AE010000000000000011000000F0443500E8443500A14A52740000000020E800001F51EA7AD0E728028291917520E828028CD800006B51EA7AE4E72802B69C917590D8D4035C0000000401000084F2280244F228026B4E317411000000F0443500E8443500A8EAD403FA4F31740000000074E80000AB5EEA7A24E828028291917574E8280228E8280227959175000000008CD8D40350E82802CD9491758CD8D403FCE8280200D4D403E19491750000000000D4D403FCE8280258E82802000000000E000000F7FC04007B00440036003500320033003100420030002D0042003200460031002D0034003800350037002D0041003400430045002D004100380045003700430036004500410037004400320037007D005C007400610073006B006D00670072002E0065007800650000000000940A540270E62802AD6AE77601000000D40101B688E628024674E676D00754020000000001000000D40101B6D0E628022842E776D40101B6F4085402EC085402F408540200000000D007540201000000CC0A5402EC0A5402C8E628025869E77600000000D0075402E8E628020B8CE6760100000000000000537AE676D40101B600200000000000000100000034E7280236177676D40101B6100854020500000000000000FFFFFFFFD00754020000000030E728025CE7280200000000000000000000000088E72802709FE00600000000409164770900800180E7280235597676D40101B6A856A0060500000068E72802506AE7761CC0EB7601000000EF7AE676D40101B61D0000000020000080E728026359767688E728020000000000000000D40101B64066607701000000ECE72802A1368E7600000000000000000057410011000000F0443500E8443500000000000000320020E800001F51EA7AD0E728028291917520E82802D4E7280227959175000000008CD8D403FCE72802CD9491758CD8D403A8E8280200D4D403E19491750000000000D4D403A8E8280204E82802090000000B000000DCC402007B00370043003500410034003000450046002D0041003000460042002D0034004200460043002D0038003700340041002D004300300046003200450030004200390046004100380045007D005C00410064006F00620065005C004100630072006F0062006100740020005200650061006400650072002000440043005C005200650061006400650072005C004100630072006F0052006400330032002E0065007800650000000000D09866060000000034E82802C05D5A740200000002000000000C00940F000000E8E82802010000000400000001000000010000006B001001D098660605000000D098660602020000E20101AE2B51EA0088E7280239B58D76E20101AE24E82802130000000400000030000000120000001D000000130000001D0000000E00000012000000020000003200000014000000E387EE7A38E82802F3AE5B7400574100E20101AE010000000000000011000000F0443500E8443500A14A52740000000020E800001F51EA7AD0E728028291917520E828028CD800006B51EA7AE4E72802B69C917590D8D4035C0000000401000084F2280244F228026B4E317411000000F0443500E8443500A8EAD403FA4F31740000000074E80000AB5EEA7A24E828028291917574E8280228E8280227959175000000008CD8D40350E82802CD9491758CD8D403FCE8280200D4D403E19491750000000000D4D403FCE8280258E82802 | |||
(PID) Process: | (1604) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count |
Operation: | write | Name: | {Q65231O0-O2S1-4857-N4PR-N8R7P6RN7Q27}\gnfxzte.rkr |
Value: 00000000000000000F000000F7FC0400000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFF000000000000000000000000 | |||
(PID) Process: | (1604) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count |
Operation: | write | Name: | HRZR_PGYFRFFVBA |
Value: 000000002600000033000000FAC01000090000000B000000DCC402007B00370043003500410034003000450046002D0041003000460042002D0034004200460043002D0038003700340041002D004300300046003200450030004200390046004100380045007D005C00410064006F00620065005C004100630072006F0062006100740020005200650061006400650072002000440043005C005200650061006400650072005C004100630072006F0052006400330032002E0065007800650000000000D09866060000000034E82802C05D5A740200000002000000000C00940F000000E8E82802010000000400000001000000010000006B001001D098660605000000D098660602020000E20101AE2B51EA0088E7280239B58D76E20101AE24E82802130000000400000030000000120000001D000000130000001D0000000E00000012000000020000003200000014000000E387EE7A38E82802F3AE5B7400574100E20101AE010000000000000011000000F0443500E8443500A14A52740000000020E800001F51EA7AD0E728028291917520E828028CD800006B51EA7AE4E72802B69C917590D8D4035C0000000401000084F2280244F228026B4E317411000000F0443500E8443500A8EAD403FA4F31740000000074E80000AB5EEA7A24E828028291917574E8280228E8280227959175000000008CD8D40350E82802CD9491758CD8D403FCE8280200D4D403E19491750000000000D4D403FCE8280258E82802000000000F000000F7FC04007B00440036003500320033003100420030002D0042003200460031002D0034003800350037002D0041003400430045002D004100380045003700430036004500410037004400320037007D005C007400610073006B006D00670072002E00650078006500000032000000320001000000D40101B6C0002A006C140000D00754020000000001000000D40101B6C10061006C140000A8E628022024517458053300807F41001E0000000000000003000000E877A2060066320020673200A82E9806D4E62802202451744833F906807F41004833F9060000000024E728024D245174F4E62802202451744833F906807F41004833F9060000000044E728024D2451744833F90674E72802807F410004245174807F4100C0002A00000000005800010028E728024387EE7A4CE728027B0E51744833F906000000008C804100807F4100000000002387EE7A807F410060E728023C0D51744833F906807F4100807F410079568C768EC250745800010074E728020100000099C2507402000000000000001A00000014000000EF87EE7AACE7280278AB50744833F906010000004CEC280211000000F0443500E8443500000000004CE82802AC0E51740100000024E800006751EA7AD8E728028291917524E82802DCE7280227959175000000008CD8D40304E82802CD9491758CD8D40300D4D403A8E82802E19491750000000000D4D403A8E828020CE82802090000000B000000DCC402007B00370043003500410034003000450046002D0041003000460042002D0034004200460043002D0038003700340041002D004300300046003200450030004200390046004100380045007D005C00410064006F00620065005C004100630072006F0062006100740020005200650061006400650072002000440043005C005200650061006400650072005C004100630072006F0052006400330032002E0065007800650000000000D09866060000000034E82802C05D5A740200000002000000000C00940F000000E8E82802010000000400000001000000010000006B001001D098660605000000D098660602020000E20101AE2B51EA0088E7280239B58D76E20101AE24E82802130000000400000030000000120000001D000000130000001D0000000E00000012000000020000003200000014000000E387EE7A38E82802F3AE5B7400574100E20101AE010000000000000011000000F0443500E8443500A14A52740000000020E800001F51EA7AD0E728028291917520E828028CD800006B51EA7AE4E72802B69C917590D8D4035C0000000401000084F2280244F228026B4E317411000000F0443500E8443500A8EAD403FA4F31740000000074E80000AB5EEA7A24E828028291917574E8280228E8280227959175000000008CD8D40350E82802CD9491758CD8D403FCE8280200D4D403E19491750000000000D4D403FCE8280258E82802 | |||
(PID) Process: | (1604) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count |
Operation: | write | Name: | {Q65231O0-O2S1-4857-N4PR-N8R7P6RN7Q27}\gnfxzte.rkr |
Value: 00000000000000000F000000B7FF0400000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFF000000000000000000000000 | |||
(PID) Process: | (1604) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count |
Operation: | write | Name: | HRZR_PGYFRFFVBA |
Value: 000000002600000033000000BAC31000090000000B000000DCC402007B00370043003500410034003000450046002D0041003000460042002D0034004200460043002D0038003700340041002D004300300046003200450030004200390046004100380045007D005C00410064006F00620065005C004100630072006F0062006100740020005200650061006400650072002000440043005C005200650061006400650072005C004100630072006F0052006400330032002E0065007800650000000000D09866060000000034E82802C05D5A740200000002000000000C00940F000000E8E82802010000000400000001000000010000006B001001D098660605000000D098660602020000E20101AE2B51EA0088E7280239B58D76E20101AE24E82802130000000400000030000000120000001D000000130000001D0000000E00000012000000020000003200000014000000E387EE7A38E82802F3AE5B7400574100E20101AE010000000000000011000000F0443500E8443500A14A52740000000020E800001F51EA7AD0E728028291917520E828028CD800006B51EA7AE4E72802B69C917590D8D4035C0000000401000084F2280244F228026B4E317411000000F0443500E8443500A8EAD403FA4F31740000000074E80000AB5EEA7A24E828028291917574E8280228E8280227959175000000008CD8D40350E82802CD9491758CD8D403FCE8280200D4D403E19491750000000000D4D403FCE8280258E82802000000000F000000B7FF04007B00440036003500320033003100420030002D0042003200460031002D0034003800350037002D0041003400430045002D004100380045003700430036004500410037004400320037007D005C007400610073006B006D00670072002E006500780065000000650078006500000032000000320001000000D40101B6C0002A006C140000D00754020000000001000000D40101B6C10061006C140000A8E628022024517458053300807F41001E0000000000000003000000E877A2060066320020673200A82E9806D4E62802202451744833F906807F41004833F9060000000024E728024D245174F4E62802202451744833F906807F41004833F9060000000044E728024D2451744833F90674E72802807F410004245174807F4100C0002A00000000005800010028E728024387EE7A4CE728027B0E51744833F906000000008C804100807F4100000000002387EE7A807F410060E728023C0D51744833F906807F4100807F410079568C768EC250745800010074E728020100000099C2507402000000000000001A00000014000000EF87EE7AACE7280278AB50744833F906010000004CEC280211000000F0443500E8443500000000004CE8280220E800001F51EA7AD0E728028291917520E82802D4E7280227959175000000008CD8D403FCE72802CD9491758CD8D403A8E8280200D4D403E19491750000000000D4D403A8E8280204E82802090000000B000000DCC402007B00370043003500410034003000450046002D0041003000460042002D0034004200460043002D0038003700340041002D004300300046003200450030004200390046004100380045007D005C00410064006F00620065005C004100630072006F0062006100740020005200650061006400650072002000440043005C005200650061006400650072005C004100630072006F0052006400330032002E0065007800650000000000D09866060000000034E82802C05D5A740200000002000000000C00940F000000E8E82802010000000400000001000000010000006B001001D098660605000000D098660602020000E20101AE2B51EA0088E7280239B58D76E20101AE24E82802130000000400000030000000120000001D000000130000001D0000000E00000012000000020000003200000014000000E387EE7A38E82802F3AE5B7400574100E20101AE010000000000000011000000F0443500E8443500A14A52740000000020E800001F51EA7AD0E728028291917520E828028CD800006B51EA7AE4E72802B69C917590D8D4035C0000000401000084F2280244F228026B4E317411000000F0443500E8443500A8EAD403FA4F31740000000074E80000AB5EEA7A24E828028291917574E8280228E8280227959175000000008CD8D40350E82802CD9491758CD8D403FCE8280200D4D403E19491750000000000D4D403FCE8280258E82802 | |||
(PID) Process: | (1604) explorer.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (1604) explorer.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
Operation: | write | Name: | @C:\Program Files\Common Files\System\wab32res.dll,-4602 |
Value: Contact file | |||
(PID) Process: | (1604) explorer.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
Operation: | write | Name: | @C:\Windows\System32\display.dll,-4 |
Value: S&creen resolution | |||
(PID) Process: | (1604) explorer.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
Operation: | write | Name: | @C:\Program Files\Windows Sidebar\sidebar.exe,-11100 |
Value: &Gadgets |
PID | Process | Filename | Type | |
---|---|---|---|---|
3280 | chkdsk.exe | C:\Users\admin\AppData\Roaming\23R95A0E\23Rlogrc.ini | binary | |
MD5:2855A82ECDD565B4D957EC2EE05AED26 | SHA256:88E38DA5B12DD96AFD9DC90C79929EC31D8604B1AFDEBDD5A02B19249C08C939 | |||
2916 | kas.exe | C:\Users\admin\AppData\Local\Temp\~DFCB9BA544FB9BFE02.TMP | binary | |
MD5:6D5FFFE1AD97E90E739153E91FF15B9F | SHA256:8B5798E2D12CFCA9E01DBA1408AC931F0F115F17D39A77810F7043B7E9029A35 | |||
3280 | chkdsk.exe | C:\Users\admin\AppData\Roaming\23R95A0E\23Rlogim.jpeg | image | |
MD5:0B9780D3C55311108846CB611FEFDE88 | SHA256:85B5BE5BCE4F283BAA6763EA00E0137BBE406262B1CB8AC0CE77407E90C8A9FA | |||
2064 | Firefox.exe | C:\Users\admin\AppData\Roaming\23R95A0E\23Rlogrf.ini | binary | |
MD5:53028481B5B5795F1501241CCC7ABFF6 | SHA256:75B5F3045E20C80F264568707E2D444DC7498DB119D9661AE51A91575960FC5A | |||
3280 | chkdsk.exe | C:\Users\admin\AppData\Roaming\23R95A0E\23Rlogri.ini | binary | |
MD5:D63A82E5D81E02E399090AF26DB0B9CB | SHA256:EAECE2EBA6310253249603033C744DD5914089B0BB26BDE6685EC9813611BAAE | |||
3280 | chkdsk.exe | C:\Users\admin\AppData\Roaming\23R95A0E\23Rlogrv.ini | binary | |
MD5:BA3B6BC807D4F76794C4B81B09BB9BA5 | SHA256:6EEBF968962745B2E9DE2CA969AF7C424916D4E3FE3CC0BB9B3D414ABFCE9507 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1604 | explorer.exe | GET | — | 184.168.221.45:80 | http://www.brianrosen.info/pa/?xPeDUfwp=vzGAOKcMFbcClSRGhH1CU0xNXYXwiZNd/PqUMulKGvvOD4LZjIMUQd7V5MbVRgUV+pgk/g==&9r8tQ=J4Nhp&sql=1 | US | — | — | malicious |
1604 | explorer.exe | POST | — | 188.164.131.200:80 | http://www.eternalmatrix.com/pa/ | IT | — | — | malicious |
1604 | explorer.exe | POST | — | 213.186.33.5:80 | http://www.creareunapp.gratis/pa/ | FR | — | — | malicious |
1604 | explorer.exe | POST | — | 188.164.131.200:80 | http://www.eternalmatrix.com/pa/ | IT | — | — | malicious |
1604 | explorer.exe | GET | 404 | 69.162.102.218:80 | http://www.sitesazpanel.com/pa/?xPeDUfwp=7PhvyDYnEdaVo00aVZRl5kzAt0reLDm4l0/2WKWkTiCvQxuLNeEApP/vSccQYDFnIljIHA==&9r8tQ=J4Nhp | US | html | 320 b | malicious |
1604 | explorer.exe | POST | — | 177.185.193.52:80 | http://www.rhemaexport.com/pa/ | BR | — | — | malicious |
1604 | explorer.exe | POST | — | 188.164.131.200:80 | http://www.eternalmatrix.com/pa/ | IT | — | — | malicious |
1604 | explorer.exe | POST | — | 213.186.33.5:80 | http://www.creareunapp.gratis/pa/ | FR | — | — | malicious |
1604 | explorer.exe | POST | — | 184.168.221.45:80 | http://www.brianrosen.info/pa/ | US | — | — | malicious |
1604 | explorer.exe | POST | — | 177.185.193.52:80 | http://www.rhemaexport.com/pa/ | BR | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1604 | explorer.exe | 69.162.102.218:80 | www.sitesazpanel.com | Limestone Networks, Inc. | US | malicious |
1604 | explorer.exe | 188.164.131.200:80 | www.eternalmatrix.com | Prometeus di Daniela Agro | IT | malicious |
1604 | explorer.exe | 213.186.33.5:80 | www.creareunapp.gratis | OVH SAS | FR | malicious |
1604 | explorer.exe | 177.185.193.52:80 | www.rhemaexport.com | IPV6 Internet Ltda | BR | malicious |
1604 | explorer.exe | 184.168.221.45:80 | www.brianrosen.info | GoDaddy.com, LLC | US | malicious |
Domain | IP | Reputation |
---|---|---|
www.sitesazpanel.com |
| malicious |
www.eternalmatrix.com |
| malicious |
www.creareunapp.gratis |
| malicious |
www.brianrosen.info |
| malicious |
www.432ope.com |
| unknown |
www.422ope.com |
| unknown |
www.rhemaexport.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
1604 | explorer.exe | A Network Trojan was detected | SC SPYWARE Trojan-Spy.Win32.Noon |
1604 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
1604 | explorer.exe | A Network Trojan was detected | SC SPYWARE Trojan-Spy.Win32.Noon |
1604 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
1604 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
1604 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
1604 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
1604 | explorer.exe | A Network Trojan was detected | SC SPYWARE Trojan-Spy.Win32.Noon |
1604 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
1604 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |