2.8
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.68
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | Malware:Win32/Dorpal.ali1000029 | 20190527 | 0.3.0.5 |
| Avast | Win32:Malware-gen | 20200317 | 18.4.3895.0 |
| Baidu | Win32.Trojan.Kryptik.jr | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (W) | 20190702 | 1.0 |
| Kingsoft | None | 20200317 | 2013.8.14.323 |
| McAfee | GenericRXHC-UW!EFB36109873E | 20200317 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b159df | 20200317 | 1.0.0.1 |
静态指标
查询计算机名称
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545303.875 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
|
1727545304.23525 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
检查进程是否被调试器调试
(2 个事件)
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(2 个事件)
查找外部 IP 地址
(1 个事件)
| domain | icanhazip.com |
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\mibidot.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\mibidot.exe |
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '.text', 'virtual_address': '0x00001000', 'virtual_size': '0x00002190', 'size_of_data': '0x00002200', 'entropy': 7.113841567704418} | entropy | 7.113841567704418 | description | 发现高熵的节 | |||||||||
| entropy | 0.27419354838709675 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(4 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
| host | 64.111.36.52 | |||
| host | 178.222.250.35 | |||
文件已被 VirusTotal 上 64 个反病毒引擎识别为恶意
(50 out of 64 个事件)
| ALYac | Gen:Trojan.Ipatre.1 |
| APEX | Malicious |
| AVG | Win32:Malware-gen |
| Acronis | suspicious |
| Ad-Aware | Gen:Trojan.Ipatre.1 |
| AhnLab-V3 | Trojan/Win32.Upatre.R157839 |
| Alibaba | Malware:Win32/Dorpal.ali1000029 |
| Antiy-AVL | Trojan/Win32.AGeneric |
| Arcabit | Trojan.Ipatre.1 |
| Avast | Win32:Malware-gen |
| Avira | TR/Spy.Zbot.sbboqv |
| Baidu | Win32.Trojan.Kryptik.jr |
| BitDefender | Gen:Trojan.Ipatre.1 |
| BitDefenderTheta | Gen:NN.ZexaF.34100.cqX@aaFMKocG |
| Bkav | W32.AIDetectVM.malware |
| CAT-QuickHeal | Trojan.Generic |
| ClamAV | Win.Downloader.Upatre-5744092-0 |
| Comodo | TrojWare.Win32.TrojanDownloader.Upatre.DOM@5st38w |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.9873ed |
| Cylance | Unsafe |
| Cyren | W32/Upatre.JU.gen!Eldorado |
| DrWeb | Trojan.DownLoader19.17074 |
| ESET-NOD32 | a variant of Win32/Kryptik.GUNB |
| Emsisoft | Gen:Trojan.Ipatre.1 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Upatre.JU.gen!Eldorado |
| F-Secure | Trojan.TR/Spy.Zbot.sbboqv |
| FireEye | Generic.mg.efb36109873ed155 |
| Fortinet | W32/Kryptik.DQAA!tr |
| GData | Win32.Trojan.Kryptik.CA |
| Ikarus | Trojan.Win32.Crypt |
| Invincea | heuristic |
| Jiangmin | Trojan.Generic.lynu |
| K7AntiVirus | Trojan-Downloader ( 0055c6c71 ) |
| K7GW | Trojan-Downloader ( 0055c6c71 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| Lionic | Trojan.Win32.Generic.mruL |
| MAX | malware (ai score=80) |
| Malwarebytes | Trojan.Upatre |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | GenericRXHC-UW!EFB36109873E |
| McAfee-GW-Edition | BehavesLike.Win32.Upatre.nm |
| MicroWorld-eScan | Gen:Trojan.Ipatre.1 |
| Microsoft | TrojanDownloader:Win32/Upatre.BN!bit |
| NANO-Antivirus | Trojan.Win32.ZBot.dzvjqd |
| Paloalto | generic.ml |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | Generic/HEUR/QVM02.0.E947.Malware.Gen |
| Rising | Trojan.Waski!1.A489 (CLOUD) |
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(2 个事件)
| dead_host | 64.111.36.52:443 |
| dead_host | 178.222.250.35:443 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-03-10 09:24:50
PE Imphash
79c1d81e07422988120df5ca870828ca
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00002190 | 0x00002200 | 7.113841567704418 |
| .data | 0x00004000 | 0x00000bbc | 0x00000c00 | 4.16045543569239 |
| .rsrc | 0x00005000 | 0x00004a18 | 0x00004c00 | 5.164189942825291 |
| .reloc | 0x0000a000 | 0x000001ea | 0x00000200 | 0.0 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_CURSOR | 0x00005470 | 0x00000134 | LANG_POLISH | SUBLANG_DEFAULT | None |
| RT_BITMAP | 0x00005320 | 0x000000e8 | LANG_POLISH | SUBLANG_DEFAULT | None |
| RT_BITMAP | 0x00005320 | 0x000000e8 | LANG_POLISH | SUBLANG_DEFAULT | None |
| RT_ICON | 0x000055c0 | 0x00004228 | LANG_POLISH | SUBLANG_DEFAULT | None |
| RT_DIALOG | 0x00005408 | 0x00000062 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_CURSOR | 0x000055a8 | 0x00000014 | LANG_POLISH | SUBLANG_DEFAULT | None |
| RT_GROUP_ICON | 0x000097e8 | 0x00000014 | LANG_POLISH | SUBLANG_DEFAULT | None |
| RT_MANIFEST | 0x00009800 | 0x00000216 | LANG_POLISH | SUBLANG_DEFAULT | None |
Imports
Library KERNEL32.DLL:
• 0x404008 Sleep
• 0x40400c GetLastError
• 0x404010 lstrcpynA
• 0x404014 GetModuleHandleA
• 0x404018 LoadLibraryA
• 0x40401c FindClose
• 0x404020 FindFirstFileW
• 0x404024 CreateDirectoryW
• 0x404028 GetStartupInfoA
• 0x40402c FindNextFileW
• 0x404030 GlobalAlloc
• 0x404034 WaitForSingleObject
• 0x404038 CreateThread
• 0x40403c TerminateThread
• 0x404040 CreateMutexW
• 0x404044 GlobalSize
• 0x404048 ReleaseMutex
Library COMCTL32.dll:
• 0x404000 None
Library MSVCRT.dll:
• 0x404050 _controlfp
• 0x404054 _except_handler3
• 0x404058 __set_app_type
• 0x40405c __p__fmode
• 0x404060 __p__commode
• 0x404064 _adjust_fdiv
• 0x404068 __setusermatherr
• 0x40406c _initterm
• 0x404070 __getmainargs
• 0x404074 __p__acmdln
• 0x404078 exit
• 0x40407c _XcptFilter
• 0x404080 _exit
• 0x404084 ??2@YAPAXI@Z
• 0x404088 ??3@YAXPAX@Z
Library USER32.dll:
• 0x404090 GetMessageA
• 0x404094 TranslateMessage
• 0x404098 RegisterClassExA
• 0x40409c LoadCursorA
• 0x4040a0 LoadIconA
• 0x4040a4 LoadStringA
• 0x4040a8 LoadAcceleratorsA
• 0x4040ac CreateWindowExA
• 0x4040b0 PostQuitMessage
• 0x4040b4 EndPaint
• 0x4040b8 BeginPaint
• 0x4040bc DefWindowProcA
• 0x4040c0 DialogBoxParamA
• 0x4040c4 DestroyWindow
• 0x4040c8 PostMessageA
• 0x4040cc SendMessageA
• 0x4040d0 SetWindowTextA
• 0x4040d4 EndDialog
• 0x4040d8 TranslateAcceleratorA
• 0x4040dc DispatchMessageA
L!This program cannot be run in DOS mode.
7"aich
`.data
@.reloc
"6[1P'?
#2M[kFzhVxCDxu
eSudxMU@PnPSrG
#XuPfN
eXf"EvDxKXuR
pBmpoAYlDxGErv
#]dFdGZ2
$FZm4\KDuAkNpsQo"`hF~WWmdxMBdW~"Zr@xA[qc
eSuweOFt@oPx`You6FQ~tSsGcMXDL]"qd@GMRtXod_mQDC[dc
eSu`oOFQU~Ja
soVbhWaaYtZ~"usQkVSG]fGa
foCRG]fG6VFcVSG]fG6EQfGBdrcNSV4MGBBAxPSo@NKDdW~MDxc
NEuFfGXV4INYrQBCXeXo"qd@LKZdgcXS
bcPBtUfcZm[i"emQoRsy4IPS`@orDnWoQEV4OZ_udxMUdGy"7v]dKXd@$FZm4CLBdFdGBRQ~mFu]eLa
}dVSsZoVyqQdu6HZ~GDoQ~aYoZoABV4BVBq{zGXSQ{WSr@]"~u@zqSoPXGGtQyVa
}dVSsZoVum[yG~`ZnNS
}dVSsZoVddUnd_mQ
kXuQxLSugoVyq@cMXV4BVBqe
GDx}dDYV4
$G/Q6$GV
CFqXcAWu]eL
yeX_mXk
ahZnMAr
phFoDYy
14gKThPeV
34n@Gt]fG
dLo"_bUdJW{]z
04%PB0
$RXf48
04%PB0
$RXf48
74%PB0
$RXf4;
84%PB0
$RXf4<
/DdE60
/DdE67
/DdE68
/DdE67
14%PB0
$RXf4;
84%PB0
$RXf42
84%PB0
$RXf42
14%PB0
$RXf4=
/DdE69
/DdE69
64%PB0
$RXf42
/DdE69
/DdE67
/DdE68
La:9R<
"?qtK"6
"?q~A"6
"?q`_"6
"?qjU"6
"?q\c"6
V9~6xW
\<6q'fo
"t$`V_R
u0qP$xglu,
~Q!bvgv\Q|lngRjP
rT\WWgwR3
4`!fk5b"6
]c]BO\
dwvqraaBbOo
Dgk4oP
4` ak6b"6
Oays`ArT`WaNC_ftb">
IuAuaVc]Ccw
POT09_*RD@
DW2lP~&PtSR
9'|lutl
P%6gWRt9gi4
b` tw&_
rfQd\c
bw._kg
4]cQW;k5b5
Ztfk4`$oa
{T<J?4
t L3w,L
sV52Js_&~DB
dw.Q"L*ga
"62`&`k6Wa
4[jA.bT4
W7AODw2w>Q
W$-"62`&`k6]c
H5Xe\s
"PZZt`q7a
oDBg~7t"7
b`=tw&AV4
0k0\H0Ac
m[t`Wb]c
"?<4g2g
Pe`!gP_B7
dWa.slT4
O5GeAH2,Ld6PdpCq2y}HAcwqcwZdg*ZC7tDZKwai6
l zZ@;s
T4`#^3
_&_*faV2ZsdWAuT`]cE
`P_nD&T0T<Zt
KcuaVc]u`V_
_"Dw2[s
k5Zc9m
kCo19.k4w
Pj jdh
Pj jdh
RjiXC@
EjdhE@
Hu3!Eu
UU3H_@
E6jFuP
GHuGHHGH
Au^H9Et:YEP6e
jdhhF@
t,EPMQUR
UWQ%\C@
"6UjhE@
QUREPMQ
<"u>"u
fFu%@@
A2"J8-^` ^
@u4"F@6
Mu^FF#
NMIIII
JFFRXu
_^]PuVF8%
Civmin
Goappbest
Bidanol Maseh
button
richedit
1;,) +4
8')!/(
21 &,3
)7;:<"
RICHED32.DLL
Hokeuj
think probably it was quite an attractive
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA
RegisterClassExA
LoadCursorA
LoadIconA
LoadStringA
LoadAcceleratorsA
CreateWindowExA
PostQuitMessage
EndPaint
BeginPaint
DefWindowProcA
DialogBoxParamA
DestroyWindow
PostMessageA
SendMessageA
SetWindowTextA
EndDialog
USER32.dll
ReleaseMutex
GlobalSize
CreateMutexW
TerminateThread
CreateThread
WaitForSingleObject
GlobalAlloc
FindNextFileW
CreateDirectoryW
FindFirstFileW
FindClose
LoadLibraryA
GetModuleHandleA
lstrcpynA
GetLastError
KERNEL32.DLL
COMCTL32.dll
??3@YAXPAX@Z
??2@YAPAXI@Z
_XcptFilter
__p__acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
MSVCRT.dll
_controlfp
GetStartupInfoA
ffffff
aGGDDV
tttDP`
twGD``awwGtu
PawwwGE
PffffffWP
GtwwwP
33333333
7Cjv*)
6DMR24
dh{emwku{ip~knjjhjjlmq}isxiwxit{io~knhiknlq
kp}lp~kq~lr
nslklk
[Z~|/-
}{{xwxwuuvttxtu|zz
xvvpnnkjikiijhhiihyww
ropecceccxwu
{{wx..
" ) ) ' ' )
% 015(.
lt *!(!-"/ ' ' ( ' ' ( ' '
" *!+ * * )
(!- * * + * * + * +
$ &!+ + *"* * )
#. * *"+ *"+ * *!* (!*
"!")",!*#+!*!+
!*!*"*!*"*!*!*#+"- )
%"#+$.")!)!)#* %$.
"Yd]hZZZT++
&")FM]h\^]_42 & ,"'
^h]gahagbeBG
#!)!*!)!)!+!)!)")"+",
'%%,%.$*")")#)#*'1!) & &&0#*'1",'1&.&0%+!)!+ (!*$1)4")(4"*"+#/$.'0%/")#+")")"*")")#*#+!*
(#%*&0#,"("($)%.'/#( %-;,9%0(3%+!'!''1.<,9*6+5$, !"'$,(2.;(0)4'0%,&-$*%*$*$*&+$*&+$*%,$-
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.2.8"
processorArchitecture="X86"
name="GoappbestInstaller"
type="win32"/>
<description>GoappbestInst</description>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges>
<requestedExecutionLevel
level="asInvoker"
uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
G o a p p b e s t
M S S a n s S e r i f
C : \ 0 p J j o R X u . e x e
C : \ u n I J V 6 J m . e x e
C : \ 7 i z Q e 4 L F . e x e
C : \ U N d 9 n q G B . e x e
C : \ Y l L s n r D Y . e x e
C : \ d I i G v 1 Q o . e x e
C : \ r F c h P p K K . e x e
C : \ N k 9 R 9 A J j . e x e
C : \ x J O 5 0 U x c . e x e
C : \ 9 g a U n R H 4 . e x e
C : \ J w X j r P 7 n . e x e
C : \ 1 _ p y Q m p _ . e x e
C : \ i X f D t O e Q . e x e
C : \ L A a 5 V 4 m d . e x e
C : \ P 7 K L x C O m . e x e
C : \ m T K S I 5 9 a . e x e
C : \ o T 5 R n d P 5 . e x e
C : \ F F 5 u j R t D . e x e
C : \ B K S l n 0 l h . e x e
C : \ 3 G 2 m z T O b . e x e
C : \ B d 2 Y Q E M X . e x e
C : \ 2 2 0 w x k V d . e x e
C : \ F z x 4 U e R U . e x e
C : \ M 6 b S O a X S . e x e
C : \ W P w q e Q k 8 . e x e
C : \ d v L P 2 9 j R . e x e
C : \ o X o P 1 L g E . e x e
C : \ L C c u O m r 5 . e x e
C : \ 7 n m O y m f W . e x e
C : \ h D x J X P s k . e x e
C : \ G C r h i V h _ . e x e
C : \ S T m 3 P C 4 X . e x e
C : \ Q _ S 1 o 4 8 r . e x e
C : \ k 7 y k N 6 O F . e x e
C : \ g 1 B g L 8 O 1 . e x e
C : \ 2 v r v J 3 Z y . e x e
C : \ Z x E F g P p P . e x e
C : \ S C y i 7 B n S . e x e
C : \ r o 5 K Z n b h . e x e
C : \ S 9 k a j N 7 X . e x e
C : \ 6 6 b c 1 0 6 4 6 4 5 8 9 8 b 9 b 8 2 b b 3 e 0 0 d d 6 6 8 9 7 d d 6 3 c a a b . e x e
C : \ L 7 X 5 j T S C . e x e
C : \ P r W a v d M 8 . e x e
C : \ V w c G 0 a 1 6 . e x e
C : \ 2 9 f 9 7 3 3 1 5 5 e 7 3 d 8 b 0 0 1 1 6 0 2 7 9 4 0 d 8 7 8 5 9 1 5 2 c 5 d 2 e 0 1 5 b 0 e d 2 4 8 2 8 b 6 b 6 e 9 e e 3 d 3
C : \ 2 c e 0 b 6 5 5 5 a a 0 4 4 e f 0 a 8 c e 4 e a 9 0 b 5 e 2 7 b 3 b 7 5 e e a 7 7 d 7 a 4 7 6 7 8 1 f 7 9 5 b d 6 3 8 e c 2 5 c
C : \ e c e 3 a 0 d 7 9 c f 2 6 f f c 8 9 c 7 9 7 a 9 9 4 2 0 1 6 e 5 6 3 c 4 f 7 4 d a a 5 0 f f 2 0 d b 0 1 0 d c 1 2 9 4 a 0 0 e a
C : \ U s e r s \ L i s a \ D e s k t o p \ 2 M B b t J Y n . e x e
C : \ b 2 0 5 c b e 5 d a 0 5 a 9 9 7 b 5 1 c 4 5 d 3 d 4 4 c f 1 a 0 7 1 5 f 8 e 1 9 a 3 a c 7 5 4 4 a 6 8 3 e 3 e 3 a 1 d 1 a 6 1 1
C : \ c e 5 a 3 0 7 f 3 4 c 6 c a 6 e d e 0 0 f 6 3 c 7 4 6 6 c 3 8 0 0 1 4 3 2 4 9 1 3 e 8 c 6 9 8 2 7 4 8 8 2 1 7 9 4 f 2 8 5 a a c
C : \ 2 c e f 7 4 a 4 d 3 0 4 9 2 8 6 3 1 9 2 8 b 1 d a 7 7 f 1 e a 2 7 a 4 f e 9 a 9 2 7 a e d 2 8 f 4 3 6 8 9 8 e 2 3 3 4 8 8 3 3 0
C : \ 6 7 0 4 f c c 6 9 c 2 e 7 b d 4 e c d e 0 4 3 1 b d 1 a 2 5 c 4 7 a 7 7 9 6 0 9 0 7 3 c f a d 5 c 3 6 a 7 d 7 b 3 f b a 5 c e 3
C : \ U s e r s \ L i s a \ D e s k t o p \ H v V Y j K x H . e x e
C : \ z 1 b 3 y g j j . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ Q x l j i B H s . e x e
C : \ 5 4 d 9 4 7 e c 7 c a 8 b 9 7 c 1 2 b c 8 2 a e b 4 0 4 5 7 8 7 0 3 d 7 f c a b 1 2 8 4 4 7 f d e 2 1 0 9 e 2 d f 5 c 7 7 c 2 a
C : \ U s e r s \ L i s a \ D e s k t o p \ K R d x N S a n . e x e
C : \ 5 e 7 9 5 d e f 8 c a 9 b b f 5 5 5 5 a b c 0 d 8 6 1 8 c 7 3 a 9 6 3 1 1 8 2 f 1 9 3 a e a e 3 3 c 7 b 9 e 4 f 3 8 d a a 4 3 7
C : \ U s e r s \ L i s a \ D e s k t o p \ f E w y K r n F . e x e
C : \ 3 N g u 6 D h P . e x e
C : \ U s e r s \ J o h n n y C a g e \ D e s k t o p \ r E j w 7 1 Z f N R . e x e
C : \ 9 d 2 2 0 4 f a 0 1 d 1 c 4 2 a a 3 8 e e c a 8 7 c 9 4 e 1 7 c 4 1 d e 0 2 a a 8 f a 7 0 8 5 2 9 f 6 b 7 0 f 5 4 7 2 c 9 b 8 c
C : \ d 7 1 d a 2 b 3 3 8 2 8 4 2 6 a 8 c d 2 b 6 b 7 f a b d 6 b c 6 6 d 7 7 e 4 8 5 9 c d d 6 a 9 b c 3 8 6 2 7 6 7 3 1 b 3 e 6 f 0
C : \ U s e r s \ L i s a \ D e s k t o p \ i p 4 t d W r b . e x e
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ C x Y D y Y A F N n . e x e
C : \ f 7 b 9 5 1 4 e 9 a 7 0 f 6 7 8 7 2 a 9 e 8 4 1 3 8 3 d c a 6 e 8 e c 4 2 b d a 2 3 0 8 e 5 2 5 e 1 d a a 2 e 8 a 7 3 f 0 9 f f
C : \ e e 0 2 5 f 7 d a 7 3 9 a 2 3 a b 2 a 8 b 5 f c a a e 0 0 5 a 9 8 9 c 5 e 3 2 b 7 2 5 3 f 6 7 c 9 4 d c 2 0 a b 4 2 2 9 f 5 4 7
C : \ 0 e 3 1 8 e 7 3 2 4 d f 0 9 a 4 2 5 7 a 0 3 2 f f b 8 8 d 5 a a f 7 c a b 5 0 8 2 1 c 9 9 d 5 5 4 b 0 6 f f 9 c 2 f c e 1 b 9 1
C : \ f 9 f 4 2 b 6 a c 4 b e 5 8 8 8 3 b 9 0 e 1 7 b 9 b 4 d e 6 b 8 7 3 6 8 4 5 2 2 d e 6 0 a 7 c b 9 e 6 6 1 2 d 0 7 f 1 9 3 9 0 5
C : \ U s e r s \ L i s a \ D e s k t o p \ G m U r B E c l . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 5 4 8 a 1 a 0 e 4 2 4 5 8 4 7 _ m i b i d o t . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ z A Y M u v o 1 . e x e
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ S Z X x j S t 0 0 9 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 4 f 4 5 8 7 7 9 c 1 8 c 7 0 e 6 f 0 b a 3 2 a f 0 e 9 3 1 7 9 . v i r u s . e x e
C : \ f 6 3 a d f 9 e d c 4 e 5 b f 6 e b b f 9 4 f a e 7 d e 8 5 1 e 4 3 7 a 2 e 0 9 8 4 b 1 f 7 4 9 4 2 d 0 d 7 a 5 0 0 9 0 3 a 6 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ m i b i d o t . e x e
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ 0 f 6 b 9 4 1 2 6 8 c 0 1 b 2 b 1 f a a 6 e 7 0 9 8 c 9 a f 0 0 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ m i b i d o t . e x e
C : \ 2 7 1 b 9 8 8 e 4 d 6 b 9 4 2 a c b 4 d 6 4 c 3 8 b 0 a 4 6 4 e 5 9 b 7 a d 7 4 c 8 3 5 9 6 1 f f a b e 4 1 5 1 e 8 2 5 3 a c 1
C : \ 8 a a d 8 2 c 3 5 b e b f c 5 4 6 5 e c 0 9 4 7 9 0 f 5 7 4 f 9 3 e 9 1 3 8 5 a c a a 9 b c 2 d c f a a d 1 3 e 4 d f c 0 6 6 0
C : \ 6 8 9 c b 0 f f 0 2 8 d 3 4 8 d 3 f b c 0 3 6 b 7 9 4 a a 8 0 1 a 3 d 2 6 2 f 3 c 3 7 2 c 9 3 f 7 c 1 3 e e 9 d d a 1 3 8 f d a
C : \ 8 5 b 5 7 0 5 7 6 f 3 b 6 d 1 5 1 8 d 9 2 b 9 8 8 c e 4 9 3 3 c 4 e a 7 e 4 5 0 0 5 7 f e 1 3 a 1 d c d f 8 b 4 7 8 6 3 d 6 b a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ m i b i d o t . e x e
C : \ e 7 a c 2 e 4 0 e f 0 d 5 5 8 e 1 6 f f c a f 3 5 4 1 7 2 a f d 2 a b f 4 d 8 0 b 5 7 4 0 3 e c 6 d 4 3 7 8 e 0 4 0 3 5 c 6 4 0
C : \ 4 d 1 9 3 c 6 9 8 2 2 6 5 f 5 b e e 9 c 4 a f 2 6 7 5 f 2 c 6 3 1 3 6 d a 1 b 0 2 3 0 f 7 6 1 d e 2 1 9 8 9 0 4 a a 4 5 8 6 d 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ m i b i d o t . e x e
C : \ 3 5 7 a 2 5 b 1 7 6 0 d b 3 9 5 3 4 b 7 9 7 9 7 a 6 6 3 0 3 3 f 4 9 f 2 e d f 5 c 4 0 7 6 d 9 b 4 f f 8 5 1 1 1 d e 1 1 d 7 f 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ m i b i d o t . e x e
C : \ 2 f 8 4 f 5 5 2 7 8 f 8 a 5 6 f f f 4 d 2 8 c 6 1 5 a 2 c e c b 7 4 6 5 e b 8 2 1 f a d c b 1 7 4 a a b f 0 1 e c 8 c 5 5 3 9 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ m i b i d o t . e x e
C : \ b 6 1 7 0 f 8 b e 2 c 2 d f 0 f d c 7 b 8 5 1 9 0 5 b 3 6 d f 7 b 0 4 8 9 f c 9 0 d e 1 4 3 7 3 9 4 e 4 9 f e 5 4 c f 3 a a 4 1
C : \ 0 3 7 3 d f 6 6 0 e 3 5 1 6 f 4 0 9 f 5 b 2 8 9 8 1 b f 6 a 7 8 1 e f a 5 3 2 3 9 1 1 7 d 9 c 9 7 d b e 1 e c f 0 6 a 6 e 6 2 1
C : \ c d e 9 2 5 1 3 2 4 f 9 1 e f f 2 1 b 6 3 f 3 7 b 4 d 7 f 1 0 2 6 0 5 1 7 8 0 d 3 3 e 9 a 2 8 c 0 9 e b 5 7 8 b 0 a a 8 7 2 9 6
C : \ 6 5 3 8 9 d a e a 7 1 6 8 9 a b 6 4 6 a 9 5 a d 7 4 d c b d d b c 8 6 b e a 6 f 3 b b 8 c 9 1 2 3 0 f 0 5 3 1 5 4 f 3 f 6 0 3 1
C : \ 3 3 5 e 9 8 3 3 7 6 4 5 2 0 a a c 5 f d d 0 d 5 b 8 e 3 6 5 8 0 a 0 d a 4 0 c 2 2 0 5 e 7 3 3 d 3 f d a 5 5 2 0 4 a f 3 a 3 7 9
C : \ 3 3 0 9 8 0 8 b 4 9 9 2 d 2 9 f 9 5 a 3 e b 1 d f 4 6 6 d 8 4 1 f 9 f f 2 c c c 9 2 5 0 9 c 2 7 2 1 a e 0 2 0 2 f e 9 5 2 b 8 4
Process Tree
-
064c43ca869808046f5012a87aa36a4e60f6102b269a39402295ca3e64350341.exe (844)
"C:\Users\Administrator\AppData\Local\Temp\064c43ca869808046f5012a87aa36a4e60f6102b269a39402295ca3e64350341.exe"
- mibidot.exe (2160) C:\Users\ADMINI~1\AppData\Local\Temp\mibidot.exe
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com |
A 131.107.255.255
A 131.107.255.255 |
131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
| icanhazip.com |
A 104.16.185.241
A 104.16.184.241 |
104.16.184.241 |
TCP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49166 | 104.16.184.241 icanhazip.com | 80 |
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
| 192.168.56.101 | 51758 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52215 | 8.8.8.8 | 53 |
| 192.168.56.101 | 52215 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 14583e7220987f3c_mibidot.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\mibidot.exe |
| Size | 39.4KB |
| Processes | 844 (064c43ca869808046f5012a87aa36a4e60f6102b269a39402295ca3e64350341.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | ce91ea51af7fe3ab3dd5575dfa47f7e5 |
| SHA1 | 25105443edea800615e2437a8e465530f37b86ee |
| SHA256 | 14583e7220987f3c1eee52161c778edc77f121ecdf28285da8bb8a2437be648b |
| CRC32 | 2886017F |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.