2.5
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.63
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-AULS [Trj] | 20200109 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Waski.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200109 | 2013.8.14.323 |
| McAfee | GenericRXHD-ML!FF2B8BFEB63A | 20200109 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b0c3a5 | 20200109 | 1.0.0.1 |
静态指标
查询计算机名称
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545300.40575 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
|
1727545300.780625 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
检查进程是否被调试器调试
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545300.31175 IsDebuggerPresent |
failed | 0 | 0 | |
|
1727545300.733625 IsDebuggerPresent |
failed | 0 | 0 |
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(3 个事件)
| section | .MPRESS1 |
| section | .MPRESS2 |
| section | .imports |
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(2 个事件)
在 PE 资源中识别到外语
(4 个事件)
| name | RT_ICON | language | LANG_PORTUGUESE | filetype | None | sublanguage | SUBLANG_PORTUGUESE_BRAZILIAN | offset | 0x00009078 | size | 0x000025a8 | ||||||||||||||||||
| name | RT_GROUP_ICON | language | LANG_PORTUGUESE | filetype | None | sublanguage | SUBLANG_PORTUGUESE_BRAZILIAN | offset | 0x0000b6a0 | size | 0x00000014 | ||||||||||||||||||
| name | RT_VERSION | language | LANG_PORTUGUESE | filetype | None | sublanguage | SUBLANG_PORTUGUESE_BRAZILIAN | offset | 0x0000b6f4 | size | 0x00000280 | ||||||||||||||||||
| name | RT_MANIFEST | language | LANG_PORTUGUESE | filetype | None | sublanguage | SUBLANG_PORTUGUESE_BRAZILIAN | offset | 0x0000b9b4 | size | 0x000001eb | ||||||||||||||||||
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\aybir.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\aybir.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
在用户文件夹中创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\aybir.exe |
文件已被 VirusTotal 上 59 个反病毒引擎识别为恶意
(50 out of 59 个事件)
| ALYac | Trojan.Ppatre.Gen.1 |
| APEX | Malicious |
| AVG | Win32:Agent-AULS [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Ppatre.Gen.1 |
| AhnLab-V3 | Trojan/Win32.Upatre.R259600 |
| Antiy-AVL | Trojan/Win32.TSGeneric |
| Arcabit | Trojan.Ppatre.Gen.1 |
| Avast | Win32:Agent-AULS [Trj] |
| Avira | TR/AD.Yarwi.rxqcm |
| Baidu | Win32.Trojan-Downloader.Waski.a |
| BitDefender | Trojan.Ppatre.Gen.1 |
| BitDefenderTheta | Gen:NN.ZexaF.33558.cq2@ayO!L9eO |
| Bkav | W32.FamVT.GeND.Trojan |
| ClamAV | Win.Trojan.Downloader-66467 |
| Comodo | TrojWare.Win32.Crypt.CMYT@83xzw5 |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.eb63aa |
| Cylance | Unsafe |
| Cyren | W32/Upatre.IF.gen!Eldorado |
| DrWeb | Trojan.Upatre.87 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Emsisoft | Trojan.Ppatre.Gen.1 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Upatre.IF.gen!Eldorado |
| F-Secure | Trojan.TR/AD.Yarwi.rxqcm |
| FireEye | Generic.mg.ff2b8bfeb63aa941 |
| Fortinet | W32/Kryptik.CMRK!tr |
| GData | Trojan.Ppatre.Gen.1 |
| Ikarus | Packer.Win32.Krap |
| Invincea | heuristic |
| Jiangmin | Trojan.Generic.dagud |
| K7AntiVirus | Trojan ( 0052964f1 ) |
| K7GW | Trojan ( 0052964f1 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=86) |
| Malwarebytes | Trojan.Upatre.Generic |
| McAfee | GenericRXHD-ML!FF2B8BFEB63A |
| McAfee-GW-Edition | BehavesLike.Win32.Sytro.pt |
| MicroWorld-eScan | Trojan.Ppatre.Gen.1 |
| Microsoft | TrojanDownloader:Win32/Upatre |
| NANO-Antivirus | Trojan.Win32.Agent.dghylf |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM19.1.71F7.Malware.Gen |
| Rising | Downloader.Upatre!8.B5 (RDMK:cmRtazp/oG1Vwa2U2giLLnDYhcWj) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/HkMain-AZ |
| Symantec | Infostealer.Dyre |
| Tencent | Malware.Win32.Gencirc.10b0c3a5 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2071-10-12 11:01:49
PE Imphash
976317ef2631fffe63f890bf10820c9e
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .MPRESS1 | 0x00001000 | 0x00007000 | 0x00003c00 | 4.610063892958559 |
| .MPRESS2 | 0x00008000 | 0x00001000 | 0x00000400 | 5.933023296817202 |
| .rsrc | 0x00009000 | 0x00003000 | 0x00002c00 | 3.932179928623806 |
| .imports | 0x0000c000 | 0x00001000 | 0x00000400 | 3.8004098289196406 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00009078 | 0x000025a8 | LANG_PORTUGUESE | SUBLANG_PORTUGUESE_BRAZILIAN | None |
| RT_DIALOG | 0x000045f0 | 0x00000550 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x0000b6a0 | 0x00000014 | LANG_PORTUGUESE | SUBLANG_PORTUGUESE_BRAZILIAN | None |
| RT_VERSION | 0x0000b6f4 | 0x00000280 | LANG_PORTUGUESE | SUBLANG_PORTUGUESE_BRAZILIAN | None |
| RT_MANIFEST | 0x0000b9b4 | 0x000001eb | LANG_PORTUGUESE | SUBLANG_PORTUGUESE_BRAZILIAN | None |
Imports
Library MSVCRT.dll:
• 0x403040 _XcptFilter
• 0x403044 _controlfp
• 0x403048 _except_handler3
• 0x40304c __set_app_type
• 0x403050 _exit
• 0x403054 __p__fmode
• 0x403058 __p__commode
• 0x40305c _adjust_fdiv
• 0x403060 __setusermatherr
• 0x403064 _initterm
• 0x403068 __getmainargs
• 0x40306c _acmdln
• 0x403070 exit
Library USER32.dll:
• 0x403078 SendMessageA
• 0x40307c GetLastActivePopup
• 0x403080 PostQuitMessage
• 0x403084 BeginPaint
• 0x403088 EndPaint
• 0x40308c DefWindowProcA
• 0x403090 RegisterClassExA
• 0x403094 LoadAcceleratorsA
• 0x403098 LoadStringA
• 0x40309c GetMessageA
• 0x4030a0 TranslateAcceleratorA
• 0x4030a4 TranslateMessage
• 0x4030a8 DispatchMessageA
• 0x4030ac CreateWindowExA
Library KERNEL32.dll:
• 0x403010 lstrcpyA
• 0x403014 LoadLibraryA
• 0x403018 SetLastError
• 0x40301c CreateFileW
• 0x403020 lstrcatA
• 0x403024 GetFileType
• 0x403028 CloseHandle
• 0x40302c GetFileSize
• 0x403030 GetStartupInfoA
• 0x403034 DeleteFileW
• 0x403038 GetModuleHandleA
Library GDI32.dll:
• 0x403008 CreateFontIndirectA
Library COMCTL32.dll:
• 0x403000 InitCommonControlsEx
L!Win32 .EXE.
.MPRESS1
.MPRESS2
.imports
EE%@0@
Ljdh 5@
t;PQlRPP
0E@@E0j0E
Ej00PP
@EEP0jE
Ej@00EjEj
@PE@Pj@
P@jP@P
jjPj0E
E@0@jP
jEjE5p
E0EE@@E
EEP@PY{1@
Iu_A[Z^H
j@PP@0EPEPj@
EEEP@P@P0P0jj
@j0j0@
E0jEjE@
E@00PE
@@00jE
@P0EP0j@j
hSVWe3
EEP5 7@
EPEPEP
0u>"u:Fu
<"u>"u
> vFuj
P@0@E00Ej00PE
PE@jPEjPj
QxHt6YRGXj0PjP@
00EP@E@E
jE0000@
j@0P@P0j%H0@
3.PPjE
E0PPj@0@P@0
P@@E0P
PPj@0PP0P@
wgmvp-vw5c
@uHj@jj0
PP@PEj0Pj@0E0Ej@
wg6$Rt;T
}I>p@;^(o<(
C7ZPz+
aOCqx\
5$Z5%^h^
vA+_Ao
NOW41c:XZo<-4@EPJ|
jP6P{h
aZ-BjH"0S6C\e$D?]YL\Y
j.UbgO
0#[eLPk7
hoS{rV
eX0XK1-m
= %NNK\kqH
;v~A7^DufK
`O+ A,
YMe)&`
%X1#^2
VYB^^&t[#g(
[+g)Lv
s)&z;4
;;qoXjY-MMQQ2Gj
!^LsgY
.3H']b^*%k+P2
{n=RF8^
0VeqWkOW
]BfU"(+|
=/A'mv
IW_*E4ck
5z9}A@
g;=0zF
G a6;Q[&
om%y1
ZnpbQ hGH
~*1BmKm
?1@gFO
"~r.zEv2D9
*&!#e}
xpZw67/?*$
In}Dl+{BND
&&%D~(
qG1#yp
vOXqKj+D%XCz#
LEuybF
OxA6/+o
lD1I~5r*&
pu[O3o
'Gtou6
G&''5j73|B
wgRlkSPA63
(s0E1gs{r
6~Z!I?97&5
g"7}8&
v'Sj_4
b~>bmvxE3Y("9\
RSdw3:
Ejj0Pj
@@PEE0
jE@0@Ej
PEj0P@
EEE0EPPjP@0
fZuSdAVWAf9
K)IM3E
GGEGGEM;r
@jPEj@
j@@P0P
E@PUS]@
0P@0E0P%d0@
YY3%D0@
MSVCRT.dll
_XcptFilter
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
USER32.dll
SendMessageA
GetLastActivePopup
PostQuitMessage
BeginPaint
EndPaint
DefWindowProcA
RegisterClassExA
LoadAcceleratorsA
LoadStringA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
CreateWindowExA
`KERNEL32.dll
lstrcpyA
LoadLibraryA
SetLastError
CreateFileW
lstrcatA
GetFileType
CloseHandle
GetFileSize
GetStartupInfoA
DeleteFileW
GetModuleHandleA
GDI32.dll
CreateFontIndirectA
COMCTL32.dll
InitCommonControlsEx
8Muex<
KERNEL32
VirtualProtect
G(XPTPjxWXt=
Totota
Landrover
very good
fion pion pack
sutori wauu
Dochland Pochland
Times New
RichEdit
Riched32.dll
As I noted above,
the existing have not been updated in the
last 14 years. I have been working on other
projects, and I think it is unlikely that will
see any further changes, except error corrections.
However does not remain, and will contain
some either did not exist, or were not important enough to.
GetModuleHandleA
GetProcAddress
KERNEL32.DLL
MSVCRT.dll
USER32.dll
EndPaint
GDI32.dll
CreateFontIndirectA
COMCTL32.dll
InitCommonControlsEx
t7Kt'Kt
3 3 3 3 3 3 3 3 hZ3 3 2
3 3 3 3 3 3 3 3 0
6 6 6 6 6 6 G06 6 5 6 6 yl6 6 6 6 6 6 6 2
3 7!7!7!7!7!7!7!ZJ7!7!k\7!7!7!7!7!7!7!7!7!7!7!7!3
6 8"8"8"8"8"8"YK8"YK8"8"6 6 7"8"8"8"8"8"8"8"6
8";";";";";";";"qc;";"}q;";";";";";";"8"
;">%>%>%>%>%>%>%>%>%>%>%>%>%>%>%>%>%>%>%>%>%>%>%>%>%>%>%>%;"
@(E+>%E+E+E+E+E+E+E+E+E+E+E+E+E+E+E+E+E+>%>%>%>%>%>%E+E+E+@(
@(E+mXmXmXmXmXhRjThRhRhRhRhRhRhRhRhRhRhRhRhRhRhRhRhRhRhRE+G/
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity
version="1.1.1.16"
name="HutVabBin"
/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel
level="asInvoker"
uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
MSVCRT.dll
_XcptFilter
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
USER32.dll
SendMessageA
GetLastActivePopup
PostQuitMessage
BeginPaint
EndPaint
DefWindowProcA
RegisterClassExA
LoadAcceleratorsA
LoadStringA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
CreateWindowExA
KERNEL32.dll
lstrcpyA
LoadLibraryA
SetLastError
CreateFileW
lstrcatA
GetFileType
CloseHandle
GetFileSize
GetStartupInfoA
DeleteFileW
GetModuleHandleA
GDI32.dll
CreateFontIndirectA
COMCTL32.dll
InitCommonControlsEx
M S S h e l l D l g
D e f a u l t V i e w
D e f a u l t Z O O G :
S h o w t h e b o o k m a r k s s i d e b a r w h e n a v a i l a b l e
& R e m e m b e r t h e s e s e t t i n g s f o r e a c h d o c u m e n t
R e p l a c e d o c u m e n t & c o l o r s w i t h W i n d o w s c o l o r s c h e m e
A d v a n c e d
A u t o m a t i c a l l y c h e c k f o r & u p d a t e s
R e m e m b e r & o p e n e d f i l e s
M a k e G o V i e w a d e f a u l t v i e w e r
S e t i n v e r s e s e a r c h c o m m a n d - l i n e
E n t e r t h e c o m m a n d - l i n e t o i n v o k e w h e n y o u d o u b l e - c l i c k o n t h e P D F d o c u m e n t :
C a n c e l
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 2 7 C 3 2 A 3
A V G O O D
C o m p a n y N a m e
H u t V a b B i n
F i l e D e s c r i p t i o n
H u t V a b B i n I n d .
F i l e V e r s i o n
V e r s i o n 1 . 1 6
I n t e r n a l N a m e
H u t V a b B i n
L e g a l C o p y r i g h t
C o p y r i g h t b y H u t V a b B i n I n d .
O r i g i n a l F i l e n a m e
H u t V a b B i n
V a r F i l e I n f o
T r a n s l a t i o n
C : \ 7 a 7 f c 8 c 2 f 2 c b f 3 a 8 3 b d 7 7 1 8 c b f 0 3 a a 2 2 8 0 7 e 4 8 4 1 d 2 f a 8 7 4 7 9 0 8 c f c 6 d f 6 6 a 9 7 0 4
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Z o v n Y i X I . e x e
C : \ b b 5 6 e f d 8 4 4 0 4 3 b 7 7 b 4 e 3 3 4 d 7 c 5 d 6 c b 4 d 4 d 6 5 3 0 7 9 b 1 8 4 a 2 e 4 2 e 6 2 2 1 e 9 5 0 a 9 9 b 2 3
C : \ e 0 e 3 9 a a a 5 5 4 b a d 7 a 1 9 b 6 c 1 1 2 9 6 8 d 5 6 9 0 0 7 d 1 6 9 a d 2 c 8 7 d 2 a 1 4 2 4 d 0 9 5 3 f 5 b b 7 d 6 7
C : \ U s e r s \ L i s a \ D e s k t o p \ N F i J W 9 S g . e x e
C : \ 4 5 c 5 5 d 3 f 6 7 9 3 b 6 e 2 2 2 9 b 8 0 5 1 2 6 0 7 c 1 9 4 5 5 2 9 b 4 2 d 0 b 1 2 4 c 9 2 6 4 b 3 c 0 3 6 5 f 3 9 2 5 7 9
C : \ 9 5 5 8 3 2 c 9 2 c e 9 e b 4 e e 8 b 5 b a f f 2 d f 5 8 b 7 f 2 7 f d 8 e c e e 9 8 6 d 6 5 d 6 b 3 b f d a 0 d 6 e 9 9 6 5 0
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ e 5 a 8 d d a 0 7 d 2 d 2 8 c 0 8 e 8 f 6 a 2 a 8 8 1 2 5 1 7 6 8 b a 9 a 7 d d a 2 0 4 1 b 7 6 3 b 1 c b 5 1 2 5 0 8 d 4 7 2 2 . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ 8 L J O H f D B . e x e
C : \ U c V A D 0 2 O . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 7 5 V m r m h a . e x e
C : \ Q J W Z y m Z j . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ 4 E f B r H q w . e x e
C : \ 5 p f e O p x l . e x e
C : \ 0 b 2 2 e 0 9 2 2 1 a 9 2 d 7 4 b 1 7 a 5 d 7 d e 1 7 6 2 1 a 1 e 7 2 1 4 7 a c b e 2 3 4 f 8 b b 2 8 e c c 9 9 e d 1 4 6 c b d
C : \ 8 b d a 9 2 a 8 0 6 9 e 0 6 a 4 5 b 3 4 9 7 9 1 5 3 a 7 9 f 6 5 7 4 4 b 2 f c b 3 b 7 1 d d 5 3 e a 5 6 6 a 6 2 3 1 5 b 1 0 2 7
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a y b i r . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a y b i r . p e 3 2
C : \ 6 6 f 9 b 4 f b 9 2 9 3 3 3 3 7 5 8 f 8 f 6 2 4 0 8 7 6 9 b 1 0 4 0 6 e f a 8 4 4 0 6 0 2 e b b c 3 a 8 9 f a b 2 1 1 6 9 3 6 4
C : \ 5 a 1 e f 5 7 c a d c c 0 c e f 2 d d 1 4 f a 4 e f 4 1 8 8 d 2 4 0 c 2 9 d 5 6 7 5 c b 5 f 4 e d 0 d b 8 f 0 2 6 f 7 e 3 f 6 3
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a y b i r . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 0 8 e f d 8 5 3 a d f 9 6 8 0 _ a y b i r . e x e
C : \ a c 5 4 c 2 b 2 a 8 b 7 6 0 6 f f 2 4 9 a a c b f 2 8 c 7 5 6 a 2 f 8 8 d 0 b e c 6 d 3 1 1 f 8 e 9 c 8 3 5 4 1 b e c f 8 2 8 1
C : \ 7 d 0 8 3 e b 5 6 6 7 f 1 9 2 1 b 7 d c b 2 d d a a 3 7 e 8 0 1 b 3 4 6 2 3 d 8 3 e 1 a 3 5 b 0 0 b 0 8 4 9 9 1 3 0 3 c f d 3 e
C : \ 1 3 2 9 e f 2 1 1 d d 8 7 c d 8 d 6 a a 3 a b 1 5 c e b 6 b c 8 8 6 d a 1 b 6 c 4 8 4 9 5 7 6 5 e 5 6 6 1 0 1 2 a 7 4 b e f 9 b
C : \ 6 a 9 c 7 d 6 7 d 5 f 0 e 1 7 c 5 c e f 2 1 8 4 b 2 d a e 4 6 2 8 f a 6 f b 9 7 2 1 4 1 8 f 8 c 7 4 b d a b d 5 8 0 6 2 c 9 6 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a y b i r . e x e
C : \ 3 6 0 c f 0 3 3 9 b 7 6 6 a 0 5 8 0 c e 4 8 2 d 6 4 f 1 3 4 a d 9 0 3 f e f b 6 e b 2 1 d 0 7 e 2 7 b e 2 2 2 3 e c 2 7 e a 6 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a y b i r . e x e
C : \ f 2 1 6 4 b c b 8 f 7 d d 2 f 4 7 7 a 5 6 1 e 1 9 6 6 d f 1 a 8 3 e 8 4 a 1 b 9 d a 1 5 7 6 1 8 3 b 6 6 5 3 d 7 4 4 b c 6 1 9 3
C : \ 1 0 b 0 2 a 8 b b 2 6 2 7 1 c 8 6 6 8 2 7 4 2 9 7 3 d 0 2 9 8 0 c d 5 0 4 3 b 7 c 2 8 0 a d 8 1 8 1 d d 4 4 e 7 0 7 a 5 4 4 e 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a y b i r . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a 5 a 9 7 0 4 a 4 f c 1 1 2 e c _ a y b i r . e x e
C : \ 4 1 2 1 5 f f b d c b 1 6 2 1 c 5 8 9 5 9 c a 7 b 8 7 c 0 4 d 2 1 4 e 6 7 f 0 e 0 5 0 e 9 b e b 6 f a 7 f 8 5 e c 1 0 9 c 6 8 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a y b i r . e x e
C : \ e 8 1 6 a b 2 4 a 3 0 0 c 0 a e b 2 a 0 3 5 6 4 c e 5 9 e 3 b b e 3 7 5 a 4 f 6 0 4 e 1 7 e 0 e 9 e 6 b d a e 4 c 9 5 5 d b 1 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a y b i r . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a y b i r . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 9 8 5 0 1 9 d e 4 1 8 9 a b a _ a y b i r . e x e
C : \ e 4 0 c 6 f b 6 1 0 8 6 f 3 e e a d e d 1 6 0 6 2 2 d 5 b 9 7 c 2 0 e a 8 6 c 8 5 8 5 6 4 6 1 4 1 f 1 0 4 0 9 f a a 4 0 a b f 1
C : \ e 9 c a a 4 1 8 9 e 2 2 1 1 1 4 8 6 5 f 1 6 b f f 7 3 9 f 8 4 a b 6 7 c 2 f 8 6 9 e 4 b 5 4 d 0 7 8 e c d 6 1 a 3 5 c 9 0 4 8 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a y b i r . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a y b i r . p e 3 2
C : \ a 0 d 0 5 7 a 4 4 4 8 b e a c 8 7 9 5 f f 9 9 3 5 e 3 7 0 5 9 8 c e e c 3 f e 7 5 0 5 e e a 5 2 5 d a 3 9 b f c 7 0 a b 4 e c b
C : \ 7 a 4 4 a e d 1 6 c 8 0 1 7 6 f 3 1 b f f 1 c 0 8 0 e d 7 8 e 0 7 f 2 7 2 a c 7 5 4 3 a f c a 5 f 9 1 f 2 4 9 0 a a 2 f 8 e 5 e
C : \ 5 c 5 f 3 4 3 6 9 6 2 1 7 c 1 2 3 1 0 7 8 8 7 7 6 d a f 8 5 4 a b 0 6 6 0 9 f 6 c 4 2 b 1 e 8 7 6 8 e 1 2 8 4 c 3 f 8 2 e e 2 3
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a y b i r . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ T o c f N i D r . e x e
C : \ c 5 a b 4 8 0 c b 3 e 4 2 b 5 1 6 f 5 b 9 0 d 4 8 c 3 9 6 d 1 2 1 e 3 b f c d 8 5 a 1 9 8 b 2 b d 2 e 9 e 3 9 c d 1 2 c c f a 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a y b i r . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ W M f O r g t q . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 f 2 5 f 0 e c 2 9 9 b 5 0 9 3 _ a y b i r . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a y b i r . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 2 2 9 6 a 0 d 8 5 8 8 e 2 4 f 8 _ a y b i r . e x e
C : \ 0 c a d 1 9 4 9 b b 8 4 b 9 a e 3 8 4 7 8 5 1 a f 4 5 4 3 8 5 4 3 b 3 4 3 a e b a a 0 f f f c 0 2 e 1 d a 1 7 8 5 7 7 e 8 9 2 c
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a y b i r . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a y b i r . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 6 2 e 1 7 3 f d f c 1 0 7 5 3 3 _ a y b i r . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a y b i r . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 3 f 8 6 2 8 2 7 b 1 b 8 c 2 9 3 _ a y b i r . e x e
C : \ d 0 b b 2 1 1 4 4 7 f 1 c 0 e d 9 b b a 0 6 5 d a 0 3 4 9 0 d d b 0 7 c 5 4 e f 5 e 2 c 1 e 9 6 8 f 6 5 0 d 3 7 6 5 5 9 b b f f
C : \ 6 f 7 3 6 8 d 5 4 2 8 4 d 0 6 d a 4 4 6 8 0 a 0 4 f 6 3 5 b 8 1 c e 0 b 5 6 4 4 6 e b a 0 6 6 a 6 3 f a f b 8 a 9 c f 1 1 7 b 5
C : \ 5 6 b 7 f e c 2 3 9 0 9 6 c f 4 1 8 3 5 7 a 2 e 9 a b e 8 a 9 0 9 6 7 e 3 0 3 0 d f d b 1 f 7 d 0 0 d e 0 8 e 4 b b 6 2 4 1 1 7
C : \ c 1 4 2 f 3 4 a d 0 e 3 1 2 8 f 8 7 1 e 0 f 4 7 e e 0 d f 5 9 2 d 5 7 3 e a 4 f 8 d 4 e e 9 2 5 0 f 7 9 0 4 c c c f 0 2 2 c c b
C : \ 3 5 2 d e c 7 6 2 0 a 2 2 1 2 a c 2 b 5 7 1 6 f 7 e 6 d 5 c 6 9 9 4 7 8 5 a 6 4 f e 4 a 5 c 9 f 8 9 7 6 6 5 6 8 8 1 4 b 8 e 0 f
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ s V P s l C T P . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 4 c b f 5 3 2 9 8 a d e e f 7 7 1 1 e 0 b 7 e 3 7 f d 3 7 8 e 6 . v i r u s . e x e
C : \ a 5 b 9 6 7 5 6 f 9 0 e 0 9 1 7 0 9 8 d c 7 d a 7 7 0 c 6 8 4 1 7 d 3 8 c 7 2 0 5 4 d 3 9 4 a d 4 6 5 f 2 1 0 9 5 d 2 b 9 9 b b
C : \ 2 b 2 4 2 8 d 1 2 f 3 e 6 c 5 b 9 1 7 7 0 b a 0 4 c b c 3 e 9 9 e 5 d 4 b 5 0 e f 0 1 f c e 9 7 c 9 d d 6 3 8 f 1 c 2 9 e 9 a 8
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 6 2 d 7 8 0 8 d c 1 2 d b a d 4 1 2 e 0 6 e c a c c 7 0 f 2 f 0 5 6 f 7 b e c 5 3 7 b a a 2 8 4 3 5 c 0 9 b b 4 a b 1 4 3 a d 6 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a y b i r . e x e
C : \ a 0 7 9 a 2 0 4 4 3 8 d f 6 2 e 3 f 4 b 7 2 a 9 1 7 f c 6 9 7 6 6 d 9 3 c b 5 9 a c 6 e 0 1 1 0 f c 2 0 8 a 0 9 9 2 a f c 0 a 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a y b i r . e x e
C : \ e 1 5 9 3 d d 9 f 6 8 9 0 8 e 9 1 0 d 1 4 0 3 0 7 7 8 b 8 2 a f 9 2 c 9 5 5 3 f 7 c 5 f 4 5 6 7 e 1 d 1 b 2 e 3 2 1 4 e 4 7 0 f
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a y b i r . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 f f 2 2 3 e 0 5 3 4 5 0 2 9 1 _ a y b i r . e x e
C : \ 3 a b 9 e 7 a 7 e f e c f 8 f 8 f a a 7 7 7 6 e 3 5 2 c f e 0 5 2 4 2 d 7 3 f 5 c 0 9 0 5 2 b 4 0 9 f 7 9 8 5 0 4 d 3 8 1 e a b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a y b i r . e x e
C : \ 6 0 d d 6 9 2 e e d 5 2 c f d 6 7 2 8 d 7 6 1 b e c 9 d f b 6 4 4 d e 7 0 9 1 e f b 3 3 b 4 6 1 f 3 0 f 2 8 2 8 c d e 6 d 5 0 d
C : \ 1 4 1 e 6 d 0 a 5 0 a 2 e 4 a 4 8 3 d 6 5 9 6 9 b 6 c d c 6 2 5 f 1 a 4 5 9 5 9 7 8 8 e 8 3 0 b c d c c d 9 0 1 8 b 2 4 6 8 0 7
C : \ b c c 1 7 5 e 0 c 7 2 7 7 f f 6 9 c 5 e 2 2 f c 6 7 c a 2 2 c 0 0 4 c 2 d 7 d b f d 1 f c c 0 c 4 a d d 7 d 7 b c d a a f 7 d b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a y b i r . e x e
C : \ 8 e a 0 2 2 0 0 4 c f a 1 3 c 4 7 9 d 7 5 9 a 0 c 4 9 c d 7 5 7 5 4 f 5 d c 2 d 0 3 b 8 e 8 2 1 7 3 6 e d 8 2 5 a 0 8 d 1 b 6 e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a y b i r . e x e
c : \ t a s k \ C D C 1 5 5 4 7 4 2 A 8 D D 5 5 E B 6 8 6 2 B 0 F B 8 8 A 6 5 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 0 6 e b e d f 2 3 e a b e b 6 2 e 8 a 2 9 2 1 b 7 e 3 b 4 4 f . v i r u s . e x e
C : \ 4 d a b a 2 4 2 1 9 e 3 2 5 2 c 3 3 9 f 0 7 d e 9 a f 1 3 c c 0 e 5 7 c 1 4 0 4 0 4 e 2 4 e 5 2 e 4 8 0 3 2 f 7 a a 7 1 5 2 e 4
C : \ a 5 8 3 a 5 a 4 e 1 e 6 0 f 7 4 5 1 7 3 b b 4 2 8 f 5 d 8 a a 5 8 0 1 c 0 9 8 d d f a d 3 6 7 2 6 c 8 1 b 3 5 b f a 8 7 7 5 7 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a y b i r . e x e
C : \ 8 2 0 4 e f b a 8 d d 2 2 1 e f 3 e 3 a 1 6 c 9 7 b 7 3 b 2 7 a f f c b 5 3 d e a a f a 0 0 b 3 7 1 2 d c 4 4 7 0 1 e 4 a 6 7 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a y b i r . e x e
C : \ 5 c 2 7 d b 7 3 7 5 7 0 9 d 3 5 4 8 2 9 b 8 1 6 6 6 b c 1 1 9 d e a c e f a 2 d 8 c 5 5 2 e 5 2 b e 9 a 6 1 0 e 7 5 c b 2 6 b d
C : \ e b 6 f c 0 2 e 2 9 b 8 a 1 0 4 f 8 8 5 b 8 b c 4 9 f b 0 e 2 2 b d 3 9 c 0 6 4 7 6 c c 7 c c 3 b 1 5 a 7 9 8 5 9 4 f e 6 e 6 6
C : \ 5 c 6 5 9 3 9 8 0 2 6 6 d 5 2 9 5 9 8 a 2 9 a c a 9 0 2 6 1 d 6 9 3 1 c a 4 4 f 8 f 5 1 0 8 8 b 1 a 1 0 1 e 2 f 8 b 2 8 7 7 6 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a y b i r . e x e
C : \ 6 8 2 0 f b 9 e 0 8 d 4 2 c 4 8 1 3 a 5 e e 4 a f 5 b 6 8 b c 8 3 6 b b b 7 f 7 5 6 2 2 e a 1 8 f d 2 6 8 9 9 c 0 d 0 8 f f 1 b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a y b i r . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a y b i r . p e 3 2
C : \ 7 5 e 7 5 5 e 5 0 e 0 7 7 4 0 c a 3 f 2 9 7 8 3 1 f 8 3 6 c 2 5 b d 8 f c 9 7 c d 2 e 8 2 5 a 1 0 4 6 2 7 9 9 c a 9 a b e b 6 c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a y b i r . e x e
C : \ b 0 8 1 6 5 1 1 1 e 8 c d c 1 3 e 8 b e d 1 d b 9 a 3 b 5 f 6 c 0 6 4 2 1 0 0 f 7 4 a b d 6 f e 5 2 1 7 e 0 a f 4 0 4 3 9 e 4 9
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a y b i r . p e 3 2
C : \ 0 c d a 4 9 7 a 3 0 f 4 2 0 6 7 c 0 9 2 5 1 e 3 6 e 7 5 3 f a a d 2 8 9 0 3 4 d f 5 c 8 b 1 6 7 8 9 3 0 d 6 2 4 4 8 a 6 9 6 9 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a y b i r . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a y b i r . p e 3 2
C : \ 6 8 8 2 0 6 b 2 0 5 3 a e 8 5 b 9 e 4 8 9 f 5 8 6 1 7 5 a f 0 b c f d 0 c f 5 f 9 f f b 7 d 7 1 a f 8 e f 8 f 7 2 c 6 9 1 2 5 c
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a y b i r . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 4 6 a 4 f e 1 7 1 2 2 8 1 7 8 _ a y b i r . e x e
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ a e 2 5 9 7 0 8 8 9 0 e c 6 b 3 d 5 b c 3 9 6 0 7 8 2 0 a f 8 7 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a y b i r . e x e
C : \ 1 4 b d 4 3 d d 8 5 7 7 7 5 2 0 e 3 a 9 c 2 3 4 5 5 3 d d 3 3 c f 1 0 6 e 2 0 c d 7 e 9 d 2 e f 3 e 2 6 8 3 6 e a 6 7 9 8 0 3 c
C : \ e d d a 7 7 6 e 2 c 7 8 5 7 e 6 d 5 7 1 b 2 d f 9 b 9 6 c f d e e e 0 7 8 4 3 a 6 5 6 7 1 3 f 7 0 4 a 3 9 e 1 0 7 b b 8 a 0 1 f
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a y b i r . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d f 8 b 0 a d c 6 7 b 3 9 4 1 0 _ a y b i r . e x e
C : \ 5 f 9 b 7 b 2 0 1 0 a 5 a 1 b 0 e b a 8 c 4 7 e a e d 9 0 5 7 1 6 2 2 1 7 f c 9 b 0 1 b a 0 9 4 5 6 e 8 8 9 a 9 b 7 0 c a 7 9 b
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 7 f b 3 b 4 6 7 b 1 e 0 3 4 c 2 5 9 5 d 3 4 a 7 4 6 2 c c b 9 9 f e f a d e c 0 e 1 a e 4 8 5 3 4 0 6 d 4 8 9 c c 7 5 e c c f e . e x e
C : \ b 5 2 2 1 3 2 8 c b 3 e f 7 5 0 0 8 e 8 b b 5 5 8 4 5 7 6 e 6 1 1 7 2 2 b d a d 1 9 d 2 b a 2 5 4 6 0 3 1 9 e d c f 8 6 8 d 5 d
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a y b i r . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 1 c 1 8 e 8 7 f e f a 8 d 5 8 _ a y b i r . e x e
C : \ 0 3 5 b 0 2 f b 8 c 5 1 6 9 9 a d 2 5 8 c a 5 5 8 b a a c 1 e 3 e 6 d f 6 7 8 a a 4 0 0 9 c f 9 5 a 1 a d e 5 b e 3 8 2 9 8 f c
C : \ e 7 6 e 1 5 2 f 0 1 9 8 0 0 f f e b 9 4 f 8 7 f a a d b 1 8 2 4 b d 7 9 3 0 2 0 9 5 4 4 0 0 7 7 6 f 2 f 3 5 5 f 7 e c e 0 e b 4
C : \ f 1 9 9 d 6 f 7 7 0 8 5 6 c 4 3 5 2 7 5 8 1 f 9 4 7 9 f 8 0 7 c b e 0 3 1 d a d a 1 f 9 4 b d 0 c e c d 5 c c 0 4 3 b 4 7 8 f 2
C : \ f 5 a 9 6 1 7 1 8 8 7 8 d c a d 3 7 3 a 4 e f a 5 2 5 c 2 3 c f c 0 7 a 9 8 b f 7 9 d 5 8 8 3 b 8 3 e c 9 a 0 7 9 9 6 2 d 6 c 4
C : \ a c 0 f 6 3 d 1 1 d d 2 7 6 3 6 1 4 0 b 7 2 d 6 5 9 8 d 5 d a 8 c f 2 8 1 1 f 8 c 5 e 9 b 3 2 3 d 5 6 b 6 8 9 f 6 f b 6 9 2 8 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a y b i r . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a y b i r . p e 3 2
C : \ 2 f 7 6 5 1 f 2 a 5 f b 5 0 d b 8 c 7 8 d 9 7 8 0 a 5 c 9 7 c e b 2 7 f e 3 2 0 9 b 4 4 8 f f b 0 2 8 9 9 4 4 6 3 f 3 1 8 f 6 b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a y b i r . p e 3 2
C : \ a d e d e b 3 9 f d e b 3 5 5 8 0 d 6 e 6 7 c d f f 0 0 0 5 a 8 e 9 3 3 4 7 8 5 3 f 7 5 1 9 9 d 1 7 a 5 8 6 d 2 5 3 c 2 a 8 8 6
C : \ 5 6 9 7 1 6 e f 4 f 1 d 7 f 0 0 a f b 6 4 5 0 9 2 f 5 f 2 5 1 a 3 0 e b 5 2 a b e 4 0 8 c 7 6 a 8 8 e 9 1 7 0 c c a 5 4 4 c 5 3
C : \ 8 5 2 c d f a d 1 3 e 8 6 6 1 3 8 4 6 0 b 8 6 b e a 6 9 8 b a f d 2 8 2 9 7 d 0 3 c f 8 3 c 9 c 6 5 c 8 d 7 8 d 8 f 8 2 1 e 7 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a y b i r . e x e
C : \ f f a 6 c 4 2 5 9 8 8 3 0 6 7 4 a 3 1 d f 5 0 b e b 1 f 7 9 8 2 a 0 e 8 b e f 3 1 a 8 8 8 b 4 0 7 9 6 3 d 3 8 5 7 0 4 e e f 3 c
C : \ a 3 d d 1 b b f 3 f 9 0 c 9 3 1 6 7 d a 4 6 d 8 9 6 0 7 4 3 3 9 1 5 c 4 2 9 6 c b e 7 3 7 e 5 c 1 9 f 4 5 b b b 0 0 9 c 0 0 d b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a y b i r . e x e
Process Tree
-
057dae1b41cab1567a374a45ff13095b20452a07bb870f632a066072fb445727.exe (2336)
"C:\Users\Administrator\AppData\Local\Temp\057dae1b41cab1567a374a45ff13095b20452a07bb870f632a066072fb445727.exe"
- aybir.exe (3008) "C:\Users\ADMINI~1\AppData\Local\Temp\aybir.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 15e12700c88bf33e_aybir.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\aybir.exe |
| Size | 43.8KB |
| Processes | 2336 (057dae1b41cab1567a374a45ff13095b20452a07bb870f632a066072fb445727.exe) |
| Type | MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS |
| MD5 | e6f7a376bed7abeae31cf2d84c5fd3a3 |
| SHA1 | 0ce493ff9bb90b57a275a76811e7d606406bf2dd |
| SHA256 | 15e12700c88bf33e09cdeb9762d46fa656b2b126a96b51b86be5e208643aa569 |
| CRC32 | 612E1F57 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.