Analysis Report http://api.btloader.com

Overview

General Information

Sample URL:	http://api.btloader.com
Analysis ID:	320662
Most interesting Screenshot:
Errors URL not reachable

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

No high impact signatures.

Classification

Signatures

There are no high impact signatures.

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: api.btloader.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: api.btloader.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Thu, 19 Nov 2020 15:49:24 GMTContent-Length: 19Via: 1.1 googleData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Source: ~DF418C9E573E468D37.TMP.1.dr	String found in binary or memory: http://api.btloader.com/
Source: {3A2CE5FB-2ACA-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: http://api.btloader.com/Root

Source: classification engine

Classification label: unknown0.win@3/14@1/1

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFC54352A0EDBDD3A0.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5684 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5684 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior

Click here to start
Slideshow Behavior Animation

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
130.211.23.194	unknown	United States		15169	GOOGLEUS	false

Contacted Domains

Name	IP	Active
api.btloader.com	130.211.23.194	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://api.btloader.com/	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

ID:	320662
Product:	CloudBasic
Start time:	16:48:34
Start date:	19.11.2020
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3A2CE5F9-2ACA-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	150133B051E79470E973A6F389BAC50E	8AC67D2510ADEB23A9D583F5B4516B4BCB511CE4	AD4F7AB6676402C5A7F8C9CAB5B4BE18E05C096A1F706643BB996F8CDAF0C8A1
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{3A2CE5FB-2ACA-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	B507A14DED114AB1FA43BEBE284D56F3	B3210AB7DA5A0B94D65DA1D79F2937551948F3A5	E783A88A8A9FC64FAB8D462EEDDC6255AE482F03D8EB0B2ECC84A49F8ED8BBCE
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{3A2CE5FC-2ACA-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	FD845490F94BF0969ABFE7FED7A82636	59EBC87B8EE7F4378BF26AFC573FD9297DC30E6A	8E11499BDD99F7526F207D8F119108EA384591E9356EC6BD634EA1FEAE79FC9C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\down[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	C4F558C4C8B56858F15C09037CD6625A	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\errorPageStrings[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	D65EC06F21C379C87040B83CC1ABAC6B	208D0A0BB775661758394BE7E4AFB18357E46C8B	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\ErrorPageTemplate[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	F4FE1CB77E758E1BA56B8A8EC20417C5	F4EDA06901EDB98633A686B11D02F4925F827BF0	8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\bullet[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	26F971D87CA00E23BD2D064524AEF838	7440BEFF2F4F8FABC9315608A13BF26CABAD27D9	1D8E5FD3C1FD384C0A7507E7283C7FE8F65015E521B84569132A7EABEDC9D41D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\background_gradient[1]	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1x800, frames 3	20F0110ED5E4E0D5384A496E4880139B	51F5FC61D8BF19100DF0F8AADAA57FCD9C086255	1471693BE91E53C2640FE7BAEECBC624530B088444222D93F2815DFCE1865D5B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\httpErrorPagesScripts[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9234071287E637F85D721463C488704C	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\http_404[1]	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	F65C729DC2D457B7A1093813F1253192	5006C9B50108CF582BE308411B157574E5A893FC	B82BFB6FA37FD5D56AC7C00536F150C0F244C81F1FC2D4FEFBBDC5E175C71B4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\info_48[1]	PNG image data, 47 x 48, 8-bit/color RGBA, non-interlaced	5565250FCC163AA3A79F0B746416CE69	B97CC66471FCDEE07D0EE36C7FB03F342C231F8F	51129C6C98A82EA491F89857C31146ECEC14C4AF184517450A7A20C699C84859
C:\Users\user\AppData\Local\Temp\~DF07A95EC794A52AB5.TMP	data	D12814C000A2554B5C5A1E0A2043A837	533A52361283EF5D3E118890F99A54F9217406C0	EBC479253C7EB361BC25E03716C041CC075C8956D998E7D20DCB570D70F6B263
C:\Users\user\AppData\Local\Temp\~DF418C9E573E468D37.TMP	data	313A993A84C8A8A80D900E6A17D07A49	8540014CA69684C4A64037A7E3CDE8F433C2EEBD	DD6583B8A6BF3101EA6B5E8AABC0F18296C9D60041069905AF6C951E9FC9E3A9
C:\Users\user\AppData\Local\Temp\~DFC54352A0EDBDD3A0.TMP	data	F53A14C5E178AA34EA49BB72483ECD49	3D67CE6B8AD0D1836527A2B520E9F5AA21F198DD	6437F97D90BE628CB35C113C0BF838CE9F548027787D1F50ACA75C232926FB00

Analysis Report http://api.btloader.com

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs