Windows Analysis Report
f6t9qa761D.exe

Overview

General Information

Sample name: f6t9qa761D.exe
renamed because original name is a hash value
Original sample name: cd85834b1ec88b2b4e065cb59cdbfbc4b77b10600fbfdc8501ec7fd1c0fbe948.exe
Analysis ID: 1515137
MD5: f66386730c3497ca644c7e77d5d793b0
SHA1: 5da659a3e0af11bc6202517eacca18f4014b705d
SHA256: cd85834b1ec88b2b4e065cb59cdbfbc4b77b10600fbfdc8501ec7fd1c0fbe948
Tags: exeuser-Chainskilabs
Infos:

Detection

Berbew, Njrat
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Berbew
Yara detected Njrat
AI detected suspicious sample
Creates an undocumented autostart registry key
Drops executables to the windows directory (C:\Windows) and starts them
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file has a writeable .text section
Creates files inside the system directory
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Entry point lies outside standard sections
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
PE file contains sections with non-standard names
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Berbew No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.berbew
Name Description Attribution Blogpost URLs Link
NjRAT RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.
  • AQUATIC PANDA
  • Earth Lusca
  • Operation C-Major
  • The Gorgon Group
 https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: f6t9qa761D.exe Avira: detected
Antivirus detection for URL or domain
Source: http://color-bank.ru/index.php Avira URL Cloud: Label: malware
Source: http://parex-bank.ru/index.htm Avira URL Cloud: Label: malware
Source: http://kidos-bank.ru/index.htm Avira URL Cloud: Label: malware
Source: http://ros-neftbank.ru/index.php Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Windows\SysWOW64\Folfac32.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Cboabb32.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Gfhipbln.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Caghjf32.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Abagca32.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Ihifngfk.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Efhade32.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Akecacdm.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Gkehlfaa.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Afeaee32.exe Avira: detection malicious, Label: TR/Crypt.XDR.Gen
Source: C:\Windows\SysWOW64\Cjemgabj.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Abnopf32.exe Avira: detection malicious, Label: TR/Crypt.XDR.Gen
Source: C:\Windows\SysWOW64\Bmfpbogh.exe Avira: detection malicious, Label: TR/Crypt.XDR.Gen
Source: C:\Windows\SysWOW64\Aiejgqbd.exe Avira: detection malicious, Label: TR/Crypt.XDR.Gen
Source: C:\Windows\SysWOW64\Boepdgoi.exe Avira: detection malicious, Label: TR/Crypt.XDR.Gen
Source: C:\Windows\SysWOW64\Clajoglf.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Flbkld32.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Eeflcm32.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Ekdhoi32.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Gdcmha32.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Abgiogom.exe Avira: detection malicious, Label: TR/Crypt.XDR.Gen
Source: C:\Windows\SysWOW64\Bkmjkjhd.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Imjgmahp.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Beadgadc.exe Avira: detection malicious, Label: TR/Crypt.XDR.Gen
Source: C:\Windows\SysWOW64\Apmfnklc.exe Avira: detection malicious, Label: TR/Crypt.XDR.Gen
Source: C:\Windows\SysWOW64\Fompebbg.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Doaepp32.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Eoifoe32.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Eakcoodc.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Efljmjpm.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Fkcpdl32.dll Avira: detection malicious, Label: TR/ATRAPS.Gen
Multi AV Scanner detection for domain / URL
Source: http://gaz-prom.ru/index.htm Virustotal: Detection: 8% Perma Link
Source: http://kidos-bank.ru/index.htm Virustotal: Detection: 12% Perma Link
Source: http://mazafaka.ru/index.htm Virustotal: Detection: 8% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Windows\SysWOW64\Abagca32.dll ReversingLabs: Detection: 86%
Source: C:\Windows\SysWOW64\Abnopf32.exe ReversingLabs: Detection: 92%
Source: C:\Windows\SysWOW64\Afeaee32.exe ReversingLabs: Detection: 92%
Source: C:\Windows\SysWOW64\Akecacdm.dll ReversingLabs: Detection: 86%
Source: C:\Windows\SysWOW64\Bkmjkjhd.dll ReversingLabs: Detection: 92%
Source: C:\Windows\SysWOW64\Caghjf32.dll ReversingLabs: Detection: 87%
Source: C:\Windows\SysWOW64\Cboabb32.dll ReversingLabs: Detection: 86%
Source: C:\Windows\SysWOW64\Cjemgabj.dll ReversingLabs: Detection: 95%
Source: C:\Windows\SysWOW64\Clajoglf.dll ReversingLabs: Detection: 85%
Source: C:\Windows\SysWOW64\Doaepp32.dll ReversingLabs: Detection: 90%
Source: C:\Windows\SysWOW64\Eakcoodc.dll ReversingLabs: Detection: 87%
Source: C:\Windows\SysWOW64\Eeflcm32.dll ReversingLabs: Detection: 91%
Source: C:\Windows\SysWOW64\Efhade32.dll ReversingLabs: Detection: 87%
Source: C:\Windows\SysWOW64\Efljmjpm.dll ReversingLabs: Detection: 88%
Source: C:\Windows\SysWOW64\Ekdhoi32.dll ReversingLabs: Detection: 86%
Source: C:\Windows\SysWOW64\Eoifoe32.dll ReversingLabs: Detection: 89%
Source: C:\Windows\SysWOW64\Fkcpdl32.dll ReversingLabs: Detection: 87%
Source: C:\Windows\SysWOW64\Flbkld32.dll ReversingLabs: Detection: 86%
Source: C:\Windows\SysWOW64\Folfac32.dll ReversingLabs: Detection: 90%
Source: C:\Windows\SysWOW64\Fompebbg.dll ReversingLabs: Detection: 88%
Source: C:\Windows\SysWOW64\Gdcmha32.dll ReversingLabs: Detection: 86%
Source: C:\Windows\SysWOW64\Gfhipbln.dll ReversingLabs: Detection: 86%
Source: C:\Windows\SysWOW64\Gkehlfaa.dll ReversingLabs: Detection: 89%
Source: C:\Windows\SysWOW64\Ihifngfk.dll ReversingLabs: Detection: 86%
Source: C:\Windows\SysWOW64\Imjgmahp.dll ReversingLabs: Detection: 87%
Source: C:\Windows\SysWOW64\Jdlgaj32.dll ReversingLabs: Detection: 90%
Source: C:\Windows\SysWOW64\Jflaad32.dll ReversingLabs: Detection: 91%
Source: C:\Windows\SysWOW64\Jhemcd32.dll ReversingLabs: Detection: 86%
Source: C:\Windows\SysWOW64\Jpegka32.dll ReversingLabs: Detection: 92%
Source: C:\Windows\SysWOW64\Kbelgk32.dll ReversingLabs: Detection: 87%
Source: C:\Windows\SysWOW64\Khhkcgiq.dll ReversingLabs: Detection: 90%
Multi AV Scanner detection for submitted file
Source: f6t9qa761D.exe Virustotal: Detection: 91% Perma Link
Source: f6t9qa761D.exe ReversingLabs: Detection: 100%
Yara detected Njrat
Source: Yara match File source: f6t9qa761D.exe, type: SAMPLE
Source: Yara match File source: 15.3.Mfhplllf.exe.4ea6cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.3.Mkqoicnb.exe.78a1dc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.3.Kkgclgep.exe.4fa5d4.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.3.Knccbbff.exe.57956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.3.Oiibddkd.exe.84a1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.3.Bmfpbogh.exe.7a956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.3.Plfjan32.exe.67956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.3.Abnopf32.exe.689284.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.3.Mlfimg32.exe.7aa1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.Jagibbdg.exe.53a6dc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.Jokilfca.exe.77a334.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.3.Oiibddkd.exe.84a1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.3.Loplncai.exe.5a9704.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.3.Kegnnphk.exe.7c956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 30.3.Pnkdgk32.exe.73956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.3.Onigbk32.exe.6aa354.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.3.Oiehie32.exe.74a33c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Mfhplllf.exe.4ea6cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 38.3.Boepdgoi.exe.5c956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.3.Knccbbff.exe.57956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.3.Plaafobm.exe.81956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.f6t9qa761D.exe.4d973c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.3.Ninbhfea.exe.7ea344.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.3.Loplncai.exe.5a9704.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.3.Mddjfiih.exe.5ca984.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.3.Plfjan32.exe.67956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.3.Mdicai32.exe.7fa354.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.3.Ofmbni32.exe.48a5d4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.3.Mhmiah32.exe.5ea1dc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.3.Nfacbjdk.exe.6197d4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.3.Nfmigk32.exe.63a1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.3.Mhmiah32.exe.5ea1dc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.3.Mbhkpnhb.exe.4e9744.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.3.Kkipaf32.exe.61956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.3.Oleakplj.exe.6b908c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.f6t9qa761D.exe.4d973c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.3.Aiejgqbd.exe.6aa334.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 35.3.Apmfnklc.exe.52967c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.3.Oleakplj.exe.6b908c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.3.Abgiogom.exe.519824.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.3.Afeaee32.exe.6aa1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 38.3.Boepdgoi.exe.5c956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 35.3.Apmfnklc.exe.52967c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.3.Mdicai32.exe.7fa354.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.3.Obmmbkej.exe.61956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.3.Nfmigk32.exe.63a1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.3.Abgiogom.exe.519824.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.3.Kkgclgep.exe.4fa5d4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.3.Ninbhfea.exe.7ea344.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.3.Kegnnphk.exe.7c956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.3.Npjgkp32.exe.52a33c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.3.Plaafobm.exe.81956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.3.Nmdeneap.exe.61a1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.3.Nmdeneap.exe.61a1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.3.Nncepn32.exe.61a33c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.3.Mddjfiih.exe.5ca984.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.3.Nnhnkmek.exe.4ea1c4.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.3.Afeaee32.exe.6aa1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.3.Opldpphi.exe.62a1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.3.Ofmbni32.exe.48a5d4.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.3.Npjgkp32.exe.52a33c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.3.Nfacbjdk.exe.6197d4.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.3.Bmfpbogh.exe.7a956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.Jokilfca.exe.77a334.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.3.Mlfimg32.exe.7aa1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.3.Mbhkpnhb.exe.4e9744.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.3.Aiejgqbd.exe.6aa334.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.3.Oiehie32.exe.74a33c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.3.Opldpphi.exe.62a1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 30.3.Pnkdgk32.exe.73956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.Jagibbdg.exe.53a6dc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.3.Mkqoicnb.exe.78a1dc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.3.Kkipaf32.exe.61956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.3.Abnopf32.exe.689284.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.3.Obmmbkej.exe.61956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.3.Nncepn32.exe.61a33c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.3.Onigbk32.exe.6aa354.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.3.Nnhnkmek.exe.4ea1c4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001A.00000003.1413094066.0000000000696000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.1401676955.0000000000745000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.1408558477.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.1388062598.0000000000556000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000003.1414686039.0000000000805000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000003.1419724385.0000000000716000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.1401384736.00000000004C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000003.1408231486.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.1384605197.0000000000517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000003.1414648666.0000000000827000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1382620236.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.1416962414.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.1398787103.0000000000787000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000003.1411146589.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.1385339329.0000000000736000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.1404507070.00000000005D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000003.1388400520.00000000004D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.1400431531.00000000005A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000003.1414919528.0000000000467000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1403643696.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.1430537589.0000000000666000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000003.1429745266.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.1416821350.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000003.1411099654.0000000000607000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000003.1397065400.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.1428633163.0000000000506000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000003.1406624266.0000000000617000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.1403408472.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000003.1411928431.0000000000727000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.1383486321.0000000000517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.1385969006.0000000000757000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.1427802477.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000003.1411397694.0000000000706000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000003.1407697621.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000003.1426128043.0000000000656000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000003.1407230240.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.1402396137.0000000000767000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.1399746300.00000000005C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000003.1390029708.00000000004D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.1427760940.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000003.1405915319.00000000005D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1383183359.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.1426482415.00000000004F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000003.1429702535.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.1404835697.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.1400042225.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.1424740554.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000003.1406660618.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.1398838683.0000000000765000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.1399107397.00000000005A5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000003.1397600415.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000003.1415881163.0000000000467000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.1396799040.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.1429984432.0000000000666000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000003.1431367294.00000000005A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.1386806651.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.1428040087.0000000000506000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000003.1405881703.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.1410331324.0000000000507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.1403263169.00000000007D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000003.1406890372.00000000004A5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.1409810870.00000000004E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000003.1412836135.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000003.1413699839.0000000000696000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000003.1431993392.0000000000786000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1404271803.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.1427016535.00000000004F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.1409534659.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: f6t9qa761D.exe PID: 7816, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Jagibbdg.exe PID: 7860, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Jokilfca.exe PID: 7876, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Kegnnphk.exe PID: 7892, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Knccbbff.exe PID: 7908, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Kkgclgep.exe PID: 7924, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Kkipaf32.exe PID: 7956, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Loplncai.exe PID: 7984, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mlfimg32.exe PID: 8000, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mhmiah32.exe PID: 8016, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mddjfiih.exe PID: 8032, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mbhkpnhb.exe PID: 8048, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mkqoicnb.exe PID: 8064, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mdicai32.exe PID: 8080, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mfhplllf.exe PID: 8100, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nncepn32.exe PID: 8116, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nmdeneap.exe PID: 8132, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nfmigk32.exe PID: 8148, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nnhnkmek.exe PID: 8168, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Ninbhfea.exe PID: 8184, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nfacbjdk.exe PID: 7192, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Npjgkp32.exe PID: 7244, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Opldpphi.exe PID: 7288, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Oiehie32.exe PID: 7340, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Obmmbkej.exe PID: 7384, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Oleakplj.exe PID: 7432, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Oiibddkd.exe PID: 7476, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Ofmbni32.exe PID: 7528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Onigbk32.exe PID: 7580, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Pnkdgk32.exe PID: 7628, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Plaafobm.exe PID: 1668, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Plfjan32.exe PID: 1672, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Abgiogom.exe PID: 2540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Afeaee32.exe PID: 6736, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Apmfnklc.exe PID: 5756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Aiejgqbd.exe PID: 5820, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Abnopf32.exe PID: 932, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Boepdgoi.exe PID: 5860, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Bmfpbogh.exe PID: 6704, type: MEMORYSTR
Source: Yara match File source: C:\Windows\SysWOW64\Pnkdgk32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Aiejgqbd.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Knccbbff.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mhmiah32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Nncepn32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Onigbk32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mdicai32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Npjgkp32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Opldpphi.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Kkgclgep.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Nnhnkmek.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Kegnnphk.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Afeaee32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Nfacbjdk.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Kkipaf32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Plaafobm.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Oleakplj.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mlfimg32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Oiibddkd.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Plfjan32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mfhplllf.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Bmfpbogh.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Obmmbkej.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Abnopf32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Beadgadc.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Jagibbdg.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mbhkpnhb.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Abgiogom.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mkqoicnb.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Nfmigk32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Loplncai.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Ofmbni32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Apmfnklc.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Jokilfca.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Nmdeneap.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Oiehie32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Boepdgoi.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mddjfiih.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Ninbhfea.exe, type: DROPPED
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Windows\SysWOW64\Folfac32.dll Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Cboabb32.dll Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Gfhipbln.dll Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Caghjf32.dll Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Abagca32.dll Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Ihifngfk.dll Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Efhade32.dll Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Akecacdm.dll Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Gkehlfaa.dll Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Afeaee32.exe Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Cjemgabj.dll Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Abnopf32.exe Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Bmfpbogh.exe Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Aiejgqbd.exe Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Boepdgoi.exe Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Clajoglf.dll Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Flbkld32.dll Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Eeflcm32.dll Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Ekdhoi32.dll Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Gdcmha32.dll Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Abgiogom.exe Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Bkmjkjhd.dll Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Imjgmahp.dll Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Beadgadc.exe Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Apmfnklc.exe Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Fompebbg.dll Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Doaepp32.dll Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Eoifoe32.dll Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Eakcoodc.dll Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Efljmjpm.dll Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Fkcpdl32.dll Joe Sandbox ML: detected
Machine Learning detection for sample
Source: f6t9qa761D.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: f6t9qa761D.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then jne 0043001Eh 1_2_0043000C
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then je 00403D01h 1_2_00403CB3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then xor dword ptr [eax], ecx 1_2_00403CB3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then inc eax 1_2_00403CB3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then jne 00403CD7h 1_2_00403CB3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then mov eax, 0042B000h 1_2_00403CB3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then je 00403D37h 1_2_00403CB3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then xor dword ptr [eax], ecx 1_2_00403CB3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then add eax, 04h 1_2_00403CB3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then jne 00403D1Fh 1_2_00403CB3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then popad 1_2_00403CB3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then mov ecx, dword ptr [eax+04h] 1_2_00403D50
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then add ebx, 04h 1_2_00403D50
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then jl 00403D74h 1_2_00403D50
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then add eax, 0Ch 1_2_00403D50
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then popad 1_2_00403D50
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then pop edi 1_2_00403DC3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then mov ebx, 00408F6Ch 1_2_00403DC3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then sub ecx, eax 1_2_00403DC3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then xor edx, edx 1_2_00403DC3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then push eax 1_2_00403DC3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then div edi 1_2_00403DC3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then xchg eax, ecx 1_2_00403DC3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then add eax, edi 1_2_00403DC3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then loop 00403E23h 1_2_00403DC3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then mov eax, 0042B000h 1_2_00403DC3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then mov ebx, 0042E3D0h 1_2_00403DC3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then sub ecx, eax 1_2_00403DC3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then xor edx, edx 1_2_00403DC3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then push eax 1_2_00403DC3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then div edi 1_2_00403DC3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then xchg eax, ecx 1_2_00403DC3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then add eax, edi 1_2_00403DC3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then loop 00403E83h 1_2_00403DC3
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: 4x nop then popad 1_2_00403DC3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then sub ecx, eax 2_2_00430000
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then push eax 2_2_00430000
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then div edi 2_2_00430000
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then add eax, edi 2_2_00430000
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then mov ebx, 0042E3D0h 2_2_00430000
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then sub ecx, eax 2_2_00430000
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then push eax 2_2_00430000
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then xor dword ptr [eax], esi 2_2_00430000
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then je 00403D01h 2_2_00403CB3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then xor dword ptr [eax], ecx 2_2_00403CB3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then inc eax 2_2_00403CB3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then jne 00403CD7h 2_2_00403CB3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then mov eax, 0042B000h 2_2_00403CB3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then je 00403D37h 2_2_00403CB3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then xor dword ptr [eax], ecx 2_2_00403CB3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then add eax, 04h 2_2_00403CB3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then jne 00403D1Fh 2_2_00403CB3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then popad 2_2_00403CB3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then mov ecx, dword ptr [eax+04h] 2_2_00403D50
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then add ebx, 04h 2_2_00403D50
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then jl 00403D74h 2_2_00403D50
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then add eax, 0Ch 2_2_00403D50
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then popad 2_2_00403D50
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then pop edi 2_2_00403DC3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then mov ebx, 00408F6Ch 2_2_00403DC3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then sub ecx, eax 2_2_00403DC3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then xor edx, edx 2_2_00403DC3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then push eax 2_2_00403DC3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then div edi 2_2_00403DC3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then xchg eax, ecx 2_2_00403DC3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then add eax, edi 2_2_00403DC3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then loop 00403E23h 2_2_00403DC3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then mov eax, 0042B000h 2_2_00403DC3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then mov ebx, 0042E3D0h 2_2_00403DC3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then sub ecx, eax 2_2_00403DC3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then xor edx, edx 2_2_00403DC3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then push eax 2_2_00403DC3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then div edi 2_2_00403DC3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then xchg eax, ecx 2_2_00403DC3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then add eax, edi 2_2_00403DC3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then loop 00403E83h 2_2_00403DC3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then popad 2_2_00403DC3
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then sub ecx, eax 2_2_0042FE60
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then push eax 2_2_0042FE60
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then div edi 2_2_0042FE60
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then add eax, edi 2_2_0042FE60
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then mov ebx, 0042E3D0h 2_2_0042FE60
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then sub ecx, eax 2_2_0042FE60
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then push eax 2_2_0042FE60
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: 4x nop then xor dword ptr [eax], esi 2_2_0042FE60
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then sub ecx, eax 3_2_00430068
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then push eax 3_2_00430068
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then xor dword ptr [eax], esi 3_2_00430068
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then add eax, 00403DAAh 3_2_0043000C
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then mov edx, dword ptr [eax+08h] 3_2_0043000C
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then xor dword ptr [ebx], edx 3_2_0043000C
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then je 00403D01h 3_2_00403CB3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then xor dword ptr [eax], ecx 3_2_00403CB3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then inc eax 3_2_00403CB3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then jne 00403CD7h 3_2_00403CB3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then mov eax, 0042B000h 3_2_00403CB3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then je 00403D37h 3_2_00403CB3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then xor dword ptr [eax], ecx 3_2_00403CB3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then add eax, 04h 3_2_00403CB3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then jne 00403D1Fh 3_2_00403CB3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then popad 3_2_00403CB3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then mov ecx, dword ptr [eax+04h] 3_2_00403D50
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then add ebx, 04h 3_2_00403D50
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then jl 00403D74h 3_2_00403D50
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then add eax, 0Ch 3_2_00403D50
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then popad 3_2_00403D50
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then pop edi 3_2_00403DC3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then mov ebx, 00408F6Ch 3_2_00403DC3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then sub ecx, eax 3_2_00403DC3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then xor edx, edx 3_2_00403DC3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then push eax 3_2_00403DC3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then div edi 3_2_00403DC3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then xchg eax, ecx 3_2_00403DC3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then add eax, edi 3_2_00403DC3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then loop 00403E23h 3_2_00403DC3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then mov eax, 0042B000h 3_2_00403DC3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then mov ebx, 0042E3D0h 3_2_00403DC3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then sub ecx, eax 3_2_00403DC3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then xor edx, edx 3_2_00403DC3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then push eax 3_2_00403DC3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then div edi 3_2_00403DC3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then xchg eax, ecx 3_2_00403DC3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then add eax, edi 3_2_00403DC3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then loop 00403E83h 3_2_00403DC3
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: 4x nop then popad 3_2_00403DC3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then sub ecx, eax 4_2_0043006E
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then push eax 4_2_0043006E
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then xor dword ptr [eax], esi 4_2_0043006E
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then mov ebx, dword ptr [eax] 4_2_0043000C
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then xor dword ptr [ebx], edx 4_2_0043000C
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then je 00403D01h 4_2_00403CB3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then xor dword ptr [eax], ecx 4_2_00403CB3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then inc eax 4_2_00403CB3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then jne 00403CD7h 4_2_00403CB3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then mov eax, 0042B000h 4_2_00403CB3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then je 00403D37h 4_2_00403CB3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then xor dword ptr [eax], ecx 4_2_00403CB3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then add eax, 04h 4_2_00403CB3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then jne 00403D1Fh 4_2_00403CB3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then popad 4_2_00403CB3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then mov ecx, dword ptr [eax+04h] 4_2_00403D50
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then add ebx, 04h 4_2_00403D50
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then jl 00403D74h 4_2_00403D50
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then add eax, 0Ch 4_2_00403D50
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then popad 4_2_00403D50
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then pop edi 4_2_00403DC3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then mov ebx, 00408F6Ch 4_2_00403DC3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then sub ecx, eax 4_2_00403DC3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then xor edx, edx 4_2_00403DC3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then push eax 4_2_00403DC3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then div edi 4_2_00403DC3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then xchg eax, ecx 4_2_00403DC3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then add eax, edi 4_2_00403DC3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then loop 00403E23h 4_2_00403DC3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then mov eax, 0042B000h 4_2_00403DC3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then mov ebx, 0042E3D0h 4_2_00403DC3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then sub ecx, eax 4_2_00403DC3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then xor edx, edx 4_2_00403DC3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then push eax 4_2_00403DC3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then div edi 4_2_00403DC3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then xchg eax, ecx 4_2_00403DC3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then add eax, edi 4_2_00403DC3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then loop 00403E83h 4_2_00403DC3
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: 4x nop then popad 4_2_00403DC3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then pushad 5_2_00430000
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then cmp eax, ebx 5_2_00430000
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then je 00430084h 5_2_00430000
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then xor dword ptr [eax], esi 5_2_0043009F
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then je 00403D01h 5_2_00403CB3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then xor dword ptr [eax], ecx 5_2_00403CB3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then inc eax 5_2_00403CB3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then jne 00403CD7h 5_2_00403CB3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then mov eax, 0042B000h 5_2_00403CB3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then je 00403D37h 5_2_00403CB3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then xor dword ptr [eax], ecx 5_2_00403CB3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then add eax, 04h 5_2_00403CB3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then jne 00403D1Fh 5_2_00403CB3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then popad 5_2_00403CB3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then mov ecx, dword ptr [eax+04h] 5_2_00403D50
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then add ebx, 04h 5_2_00403D50
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then jl 00403D74h 5_2_00403D50
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then add eax, 0Ch 5_2_00403D50
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then popad 5_2_00403D50
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then pop edi 5_2_00403DC3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then mov ebx, 00408F6Ch 5_2_00403DC3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then sub ecx, eax 5_2_00403DC3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then xor edx, edx 5_2_00403DC3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then push eax 5_2_00403DC3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then div edi 5_2_00403DC3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then xchg eax, ecx 5_2_00403DC3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then add eax, edi 5_2_00403DC3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then loop 00403E23h 5_2_00403DC3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then mov eax, 0042B000h 5_2_00403DC3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then mov ebx, 0042E3D0h 5_2_00403DC3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then sub ecx, eax 5_2_00403DC3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then xor edx, edx 5_2_00403DC3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then push eax 5_2_00403DC3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then div edi 5_2_00403DC3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then xchg eax, ecx 5_2_00403DC3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then add eax, edi 5_2_00403DC3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then loop 00403E83h 5_2_00403DC3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then popad 5_2_00403DC3
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then cmp eax, ebx 5_2_0042FE60
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: 4x nop then je 00430084h 5_2_0042FE60
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then mov esi, 6D212EB7h 6_2_00430000
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then xor edx, edx 6_2_00430000
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then div edi 6_2_00430000
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then xchg eax, ecx 6_2_00430000
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then popad 6_2_00430000
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then je 00403D01h 6_2_00403CB3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then xor dword ptr [eax], ecx 6_2_00403CB3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then inc eax 6_2_00403CB3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then jne 00403CD7h 6_2_00403CB3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then mov eax, 0042B000h 6_2_00403CB3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then je 00403D37h 6_2_00403CB3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then xor dword ptr [eax], ecx 6_2_00403CB3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then add eax, 04h 6_2_00403CB3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then jne 00403D1Fh 6_2_00403CB3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then popad 6_2_00403CB3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then mov ecx, dword ptr [eax+04h] 6_2_00403D50
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then add ebx, 04h 6_2_00403D50
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then jl 00403D74h 6_2_00403D50
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then add eax, 0Ch 6_2_00403D50
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then popad 6_2_00403D50
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then pop edi 6_2_00403DC3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then mov ebx, 00408F6Ch 6_2_00403DC3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then sub ecx, eax 6_2_00403DC3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then xor edx, edx 6_2_00403DC3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then push eax 6_2_00403DC3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then div edi 6_2_00403DC3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then xchg eax, ecx 6_2_00403DC3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then add eax, edi 6_2_00403DC3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then loop 00403E23h 6_2_00403DC3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then mov eax, 0042B000h 6_2_00403DC3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then mov ebx, 0042E3D0h 6_2_00403DC3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then sub ecx, eax 6_2_00403DC3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then xor edx, edx 6_2_00403DC3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then push eax 6_2_00403DC3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then div edi 6_2_00403DC3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then xchg eax, ecx 6_2_00403DC3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then add eax, edi 6_2_00403DC3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then loop 00403E83h 6_2_00403DC3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then popad 6_2_00403DC3
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then mov esi, 6D212EB7h 6_2_0042FE60
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then xor edx, edx 6_2_0042FE60
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then div edi 6_2_0042FE60
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then xchg eax, ecx 6_2_0042FE60
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: 4x nop then popad 6_2_0042FE60
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then pushad 7_2_00430000
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then div edi 7_2_004300A0
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then xchg eax, ecx 7_2_004300A0
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then popad 7_2_004300A0
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then je 00403D01h 7_2_00403CB3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then xor dword ptr [eax], ecx 7_2_00403CB3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then inc eax 7_2_00403CB3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then jne 00403CD7h 7_2_00403CB3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then mov eax, 0042B000h 7_2_00403CB3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then je 00403D37h 7_2_00403CB3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then xor dword ptr [eax], ecx 7_2_00403CB3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then add eax, 04h 7_2_00403CB3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then jne 00403D1Fh 7_2_00403CB3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then popad 7_2_00403CB3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then mov ecx, dword ptr [eax+04h] 7_2_00403D50
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then add ebx, 04h 7_2_00403D50
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then jl 00403D74h 7_2_00403D50
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then add eax, 0Ch 7_2_00403D50
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then popad 7_2_00403D50
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then pop edi 7_2_00403DC3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then mov ebx, 00408F6Ch 7_2_00403DC3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then sub ecx, eax 7_2_00403DC3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then xor edx, edx 7_2_00403DC3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then push eax 7_2_00403DC3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then div edi 7_2_00403DC3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then xchg eax, ecx 7_2_00403DC3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then add eax, edi 7_2_00403DC3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then loop 00403E23h 7_2_00403DC3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then mov eax, 0042B000h 7_2_00403DC3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then mov ebx, 0042E3D0h 7_2_00403DC3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then sub ecx, eax 7_2_00403DC3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then xor edx, edx 7_2_00403DC3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then push eax 7_2_00403DC3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then div edi 7_2_00403DC3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then xchg eax, ecx 7_2_00403DC3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then add eax, edi 7_2_00403DC3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then loop 00403E83h 7_2_00403DC3
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: 4x nop then popad 7_2_00403DC3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then xor dword ptr [eax], ecx 8_2_00430000
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then je 00430084h 8_2_00430000
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then add eax, 04h 8_2_00430000
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then div edi 8_2_004300A0
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then xchg eax, ecx 8_2_004300A0
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then popad 8_2_004300A0
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then je 00403D01h 8_2_00403CB3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then xor dword ptr [eax], ecx 8_2_00403CB3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then inc eax 8_2_00403CB3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then jne 00403CD7h 8_2_00403CB3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then mov eax, 0042B000h 8_2_00403CB3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then je 00403D37h 8_2_00403CB3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then xor dword ptr [eax], ecx 8_2_00403CB3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then add eax, 04h 8_2_00403CB3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then jne 00403D1Fh 8_2_00403CB3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then popad 8_2_00403CB3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then mov ecx, dword ptr [eax+04h] 8_2_00403D50
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then add ebx, 04h 8_2_00403D50
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then jl 00403D74h 8_2_00403D50
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then add eax, 0Ch 8_2_00403D50
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then popad 8_2_00403D50
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then pop edi 8_2_00403DC3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then mov ebx, 00408F6Ch 8_2_00403DC3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then sub ecx, eax 8_2_00403DC3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then xor edx, edx 8_2_00403DC3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then push eax 8_2_00403DC3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then div edi 8_2_00403DC3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then xchg eax, ecx 8_2_00403DC3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then add eax, edi 8_2_00403DC3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then loop 00403E23h 8_2_00403DC3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then mov eax, 0042B000h 8_2_00403DC3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then mov ebx, 0042E3D0h 8_2_00403DC3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then sub ecx, eax 8_2_00403DC3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then xor edx, edx 8_2_00403DC3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then push eax 8_2_00403DC3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then div edi 8_2_00403DC3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then xchg eax, ecx 8_2_00403DC3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then add eax, edi 8_2_00403DC3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then loop 00403E83h 8_2_00403DC3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then popad 8_2_00403DC3
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then xor dword ptr [eax], ecx 8_2_0042FE60
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then je 00430084h 8_2_0042FE60
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: 4x nop then add eax, 04h 8_2_0042FE60
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then pushad 9_2_00430000
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then xor dword ptr [eax], ecx 9_2_00430000
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then inc eax 9_2_00430000
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then test eax, eax 9_2_00430000
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then xor dword ptr [eax], ecx 9_2_00430000
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then jne 0043006Ch 9_2_00430000
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then div edi 9_2_004300A0
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then xchg eax, ecx 9_2_004300A0
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then popad 9_2_004300A0
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then je 00403D01h 9_2_00403CB3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then xor dword ptr [eax], ecx 9_2_00403CB3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then inc eax 9_2_00403CB3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then jne 00403CD7h 9_2_00403CB3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then mov eax, 0042B000h 9_2_00403CB3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then je 00403D37h 9_2_00403CB3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then xor dword ptr [eax], ecx 9_2_00403CB3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then add eax, 04h 9_2_00403CB3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then jne 00403D1Fh 9_2_00403CB3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then popad 9_2_00403CB3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then mov ecx, dword ptr [eax+04h] 9_2_00403D50
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then add ebx, 04h 9_2_00403D50
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then jl 00403D74h 9_2_00403D50
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then add eax, 0Ch 9_2_00403D50
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then popad 9_2_00403D50
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then pop edi 9_2_00403DC3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then mov ebx, 00408F6Ch 9_2_00403DC3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then sub ecx, eax 9_2_00403DC3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then xor edx, edx 9_2_00403DC3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then push eax 9_2_00403DC3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then div edi 9_2_00403DC3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then xchg eax, ecx 9_2_00403DC3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then add eax, edi 9_2_00403DC3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then loop 00403E23h 9_2_00403DC3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then mov eax, 0042B000h 9_2_00403DC3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then mov ebx, 0042E3D0h 9_2_00403DC3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then sub ecx, eax 9_2_00403DC3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then xor edx, edx 9_2_00403DC3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then push eax 9_2_00403DC3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then div edi 9_2_00403DC3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then xchg eax, ecx 9_2_00403DC3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then add eax, edi 9_2_00403DC3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then loop 00403E83h 9_2_00403DC3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then popad 9_2_00403DC3
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then xor dword ptr [eax], ecx 9_2_0042FE60
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then inc eax 9_2_0042FE60
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then test eax, eax 9_2_0042FE60
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then xor dword ptr [eax], ecx 9_2_0042FE60
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: 4x nop then jne 0043006Ch 9_2_0042FE60
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then mov eax, 00401000h 10_2_00430000
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then xor edx, edx 10_2_00430000
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then mov eax, 0042B000h 10_2_00430000
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then cmp eax, 00000000h 10_2_00430000
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then mov ebx, 0042E3D0h 10_2_00430000
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then mov ecx, ebx 10_2_00430000
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then sub ecx, eax 10_2_00430000
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then pop eax 10_2_00430000
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then xor dword ptr [eax], esi 10_2_00430000
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then je 00403D01h 10_2_00403CB3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then xor dword ptr [eax], ecx 10_2_00403CB3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then inc eax 10_2_00403CB3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then jne 00403CD7h 10_2_00403CB3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then mov eax, 0042B000h 10_2_00403CB3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then je 00403D37h 10_2_00403CB3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then xor dword ptr [eax], ecx 10_2_00403CB3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then add eax, 04h 10_2_00403CB3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then jne 00403D1Fh 10_2_00403CB3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then popad 10_2_00403CB3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then mov ecx, dword ptr [eax+04h] 10_2_00403D50
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then add ebx, 04h 10_2_00403D50
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then jl 00403D74h 10_2_00403D50
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then add eax, 0Ch 10_2_00403D50
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then popad 10_2_00403D50
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then pop edi 10_2_00403DC3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then mov ebx, 00408F6Ch 10_2_00403DC3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then sub ecx, eax 10_2_00403DC3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then xor edx, edx 10_2_00403DC3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then push eax 10_2_00403DC3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then div edi 10_2_00403DC3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then xchg eax, ecx 10_2_00403DC3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then add eax, edi 10_2_00403DC3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then loop 00403E23h 10_2_00403DC3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then mov eax, 0042B000h 10_2_00403DC3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then mov ebx, 0042E3D0h 10_2_00403DC3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then sub ecx, eax 10_2_00403DC3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then xor edx, edx 10_2_00403DC3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then push eax 10_2_00403DC3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then div edi 10_2_00403DC3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then xchg eax, ecx 10_2_00403DC3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then add eax, edi 10_2_00403DC3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then loop 00403E83h 10_2_00403DC3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then popad 10_2_00403DC3
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then xor edx, edx 10_2_0042FE60
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then mov eax, 0042B000h 10_2_0042FE60
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then cmp eax, 00000000h 10_2_0042FE60
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then mov ebx, 0042E3D0h 10_2_0042FE60
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then mov ecx, ebx 10_2_0042FE60
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then sub ecx, eax 10_2_0042FE60
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then pop eax 10_2_0042FE60
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: 4x nop then xor dword ptr [eax], esi 10_2_0042FE60
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then sub ecx, eax 11_2_00430068
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then pop eax 11_2_00430068
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then xor dword ptr [eax], esi 11_2_00430068
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then mov ebx, dword ptr [eax] 11_2_0043000C
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then cmp ebx, ecx 11_2_0043000C
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then je 00403D01h 11_2_00403CB3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then xor dword ptr [eax], ecx 11_2_00403CB3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then inc eax 11_2_00403CB3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then jne 00403CD7h 11_2_00403CB3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then mov eax, 0042B000h 11_2_00403CB3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then je 00403D37h 11_2_00403CB3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then xor dword ptr [eax], ecx 11_2_00403CB3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then add eax, 04h 11_2_00403CB3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then jne 00403D1Fh 11_2_00403CB3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then popad 11_2_00403CB3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then mov ecx, dword ptr [eax+04h] 11_2_00403D50
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then add ebx, 04h 11_2_00403D50
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then jl 00403D74h 11_2_00403D50
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then add eax, 0Ch 11_2_00403D50
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then popad 11_2_00403D50
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then pop edi 11_2_00403DC3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then mov ebx, 00408F6Ch 11_2_00403DC3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then sub ecx, eax 11_2_00403DC3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then xor edx, edx 11_2_00403DC3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then push eax 11_2_00403DC3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then div edi 11_2_00403DC3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then xchg eax, ecx 11_2_00403DC3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then add eax, edi 11_2_00403DC3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then loop 00403E23h 11_2_00403DC3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then mov eax, 0042B000h 11_2_00403DC3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then mov ebx, 0042E3D0h 11_2_00403DC3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then sub ecx, eax 11_2_00403DC3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then xor edx, edx 11_2_00403DC3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then push eax 11_2_00403DC3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then div edi 11_2_00403DC3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then xchg eax, ecx 11_2_00403DC3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then add eax, edi 11_2_00403DC3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then loop 00403E83h 11_2_00403DC3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then popad 11_2_00403DC3
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: 4x nop then call 0043000Ch 11_2_0042FE60
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then pushad 12_2_00430000
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then pop edi 12_2_00430000
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then cmp eax, 00000000h 12_2_00430000
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then xor edx, edx 12_2_00430000
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then div edi 12_2_00430000
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then xchg eax, ecx 12_2_00430000
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then je 004300D2h 12_2_00430000
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then xor edx, edx 12_2_00430000
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then div edi 12_2_00430000
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then xor dword ptr [eax], esi 12_2_00430000
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then je 00403D01h 12_2_00403CB3
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then xor dword ptr [eax], ecx 12_2_00403CB3
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then inc eax 12_2_00403CB3
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then jne 00403CD7h 12_2_00403CB3
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then mov eax, 0042B000h 12_2_00403CB3
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then je 00403D37h 12_2_00403CB3
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then xor dword ptr [eax], ecx 12_2_00403CB3
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then add eax, 04h 12_2_00403CB3
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then jne 00403D1Fh 12_2_00403CB3
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then popad 12_2_00403CB3
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then mov ecx, dword ptr [eax+04h] 12_2_00403D50
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then add ebx, 04h 12_2_00403D50
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then jl 00403D74h 12_2_00403D50
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then add eax, 0Ch 12_2_00403D50
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then popad 12_2_00403D50
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then pop edi 12_2_00403DC3
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then mov ebx, 00408F6Ch 12_2_00403DC3
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then sub ecx, eax 12_2_00403DC3
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then xor edx, edx 12_2_00403DC3
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then push eax 12_2_00403DC3
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then div edi 12_2_00403DC3
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: 4x nop then xchg eax, ecx 12_2_00403DC3
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://asechka.ru/index.php
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://color-bank.ru/index.php
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://crutop.nu
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://crutop.nu/index.htm
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://crutop.nu/index.php
Source: f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe, 0000000B.00000002.1529920319.000000000042B000.00000004.00000001.01000000.0000000D.sdmp, Mbhkpnhb.exe, 0000000C.00000002.1529698700.000000000042B000.00000004.00000001.01000000.0000000E.sdmp, Mkqoicnb.exe, 0000000D.00000002.1529483835.000000000042B000.00000004.00000001.01000000.0000000F.sdmp, Mdicai32.exe, 0000000E.00000002.1529310966.000000000042B000.00000004.00000001.01000000.00000010.sdmp, Mfhplllf.exe, 0000000F.00000002.1528520201.000000000042B000.00000004.00000001.01000000.00000011.sdmp, Nncepn32.exe, 00000010.00000002.1528306477.000000000042B000.00000004.00000001.01000000.00000012.sdmp, Nmdeneap.exe, 00000011.00000002.1527938847.000000000042B000.00000004.00000001.01000000.00000013.sdmp, Nfmigk32.exe, 00000012.00000002.1527733036.000000000042B000.00000004.00000001.01000000.00000014.sdmp, Nnhnkmek.exe, 00000013.00000002.1527145102.000000000042B000.00000004.00000001.01000000.00000015.sdmp, Ninbhfea.exe, 00000014.00000002.1526975636.000000000042B000.00000004.00000001.01000000.00000016.sdmp, Nfacbjdk.exe, 00000015.00000002.1526575725.000000000042B000.00000004.00000001.01000000.00000017.sdmp String found in binary or memory: http://crutop.nu/index.phphttp://crutop.ru/index.phphttp://mazafaka.ru/index.phphttp://color-bank.ru
Source: f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe, 0000000B.00000002.1529920319.000000000042B000.00000004.00000001.01000000.0000000D.sdmp, Mbhkpnhb.exe, 0000000C.00000002.1529698700.000000000042B000.00000004.00000001.01000000.0000000E.sdmp, Mkqoicnb.exe, 0000000D.00000002.1529483835.000000000042B000.00000004.00000001.01000000.0000000F.sdmp, Mdicai32.exe, 0000000E.00000002.1529310966.000000000042B000.00000004.00000001.01000000.00000010.sdmp, Mfhplllf.exe, 0000000F.00000002.1528520201.000000000042B000.00000004.00000001.01000000.00000011.sdmp, Nncepn32.exe, 00000010.00000002.1528306477.000000000042B000.00000004.00000001.01000000.00000012.sdmp, Nmdeneap.exe, 00000011.00000002.1527938847.000000000042B000.00000004.00000001.01000000.00000013.sdmp, Nfmigk32.exe, 00000012.00000002.1527733036.000000000042B000.00000004.00000001.01000000.00000014.sdmp, Nnhnkmek.exe, 00000013.00000002.1527145102.000000000042B000.00000004.00000001.01000000.00000015.sdmp, Ninbhfea.exe, 00000014.00000002.1526975636.000000000042B000.00000004.00000001.01000000.00000016.sdmp, Nfacbjdk.exe, 00000015.00000002.1526575725.000000000042B000.00000004.00000001.01000000.00000017.sdmp String found in binary or memory: http://crutop.nuAWM
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://crutop.ru/index.htm
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://crutop.ru/index.php
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://cvv.ru/index.htm
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://cvv.ru/index.php
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://devx.nm.ru/index.php
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://fethard.biz/index.htm
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://fethard.biz/index.php
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://filesearch.ru/index.php
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://fuck.ru/index.php
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://gaz-prom.ru/index.htm
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://goldensand.ru/index.php
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://hackers.lv/index.php
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://kadet.ru/index.htm
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://kavkaz.ru/index.htm
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://kidos-bank.ru/index.htm
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://konfiskat.org/index.htm
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://ldark.nm.ru/index.htm
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://lovingod.host.sk/index.php
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://mazafaka.ru/index.htm
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://mazafaka.ru/index.php
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://parex-bank.ru/index.htm
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://potleaf.chat.ru/index.htm
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://promo.ru/index.htm
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://ros-neftbank.ru/index.php
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://trojan.ru/index.php
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://www.redline.ru/index.php
Source: f6t9qa761D.exe, f6t9qa761D.exe, 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, Jagibbdg.exe, Jagibbdg.exe, 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, Jokilfca.exe, Jokilfca.exe, 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, Kegnnphk.exe, Kegnnphk.exe, 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, Knccbbff.exe, Knccbbff.exe, 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, Kkgclgep.exe, Kkgclgep.exe, 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, Kkipaf32.exe, Kkipaf32.exe, 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, Loplncai.exe, Loplncai.exe, 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, Mlfimg32.exe, Mlfimg32.exe, 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, Mhmiah32.exe, Mhmiah32.exe, 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, Mddjfiih.exe String found in binary or memory: http://xware.cjb.net/index.htm

E-Banking Fraud
barindex
Yara detected Njrat
Source: Yara match File source: f6t9qa761D.exe, type: SAMPLE
Source: Yara match File source: 15.3.Mfhplllf.exe.4ea6cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.3.Mkqoicnb.exe.78a1dc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.3.Kkgclgep.exe.4fa5d4.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.3.Knccbbff.exe.57956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.3.Oiibddkd.exe.84a1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.3.Bmfpbogh.exe.7a956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.3.Plfjan32.exe.67956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.3.Abnopf32.exe.689284.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.3.Mlfimg32.exe.7aa1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.Jagibbdg.exe.53a6dc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.Jokilfca.exe.77a334.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.3.Oiibddkd.exe.84a1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.3.Loplncai.exe.5a9704.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.3.Kegnnphk.exe.7c956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 30.3.Pnkdgk32.exe.73956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.3.Onigbk32.exe.6aa354.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.3.Oiehie32.exe.74a33c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Mfhplllf.exe.4ea6cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 38.3.Boepdgoi.exe.5c956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.3.Knccbbff.exe.57956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.3.Plaafobm.exe.81956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.f6t9qa761D.exe.4d973c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.3.Ninbhfea.exe.7ea344.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.3.Loplncai.exe.5a9704.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.3.Mddjfiih.exe.5ca984.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.3.Plfjan32.exe.67956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.3.Mdicai32.exe.7fa354.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.3.Ofmbni32.exe.48a5d4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.3.Mhmiah32.exe.5ea1dc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.3.Nfacbjdk.exe.6197d4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.3.Nfmigk32.exe.63a1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.3.Mhmiah32.exe.5ea1dc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.3.Mbhkpnhb.exe.4e9744.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.3.Kkipaf32.exe.61956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.3.Oleakplj.exe.6b908c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.f6t9qa761D.exe.4d973c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.3.Aiejgqbd.exe.6aa334.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 35.3.Apmfnklc.exe.52967c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.3.Oleakplj.exe.6b908c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.3.Abgiogom.exe.519824.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.3.Afeaee32.exe.6aa1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 38.3.Boepdgoi.exe.5c956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 35.3.Apmfnklc.exe.52967c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.3.Mdicai32.exe.7fa354.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.3.Obmmbkej.exe.61956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.3.Nfmigk32.exe.63a1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.3.Abgiogom.exe.519824.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.3.Kkgclgep.exe.4fa5d4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.3.Ninbhfea.exe.7ea344.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.3.Kegnnphk.exe.7c956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.3.Npjgkp32.exe.52a33c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.3.Plaafobm.exe.81956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.3.Nmdeneap.exe.61a1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.3.Nmdeneap.exe.61a1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.3.Nncepn32.exe.61a33c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.3.Mddjfiih.exe.5ca984.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.3.Nnhnkmek.exe.4ea1c4.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.3.Afeaee32.exe.6aa1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.3.Opldpphi.exe.62a1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.3.Ofmbni32.exe.48a5d4.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.3.Npjgkp32.exe.52a33c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.3.Nfacbjdk.exe.6197d4.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.3.Bmfpbogh.exe.7a956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.Jokilfca.exe.77a334.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.3.Mlfimg32.exe.7aa1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.3.Mbhkpnhb.exe.4e9744.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.3.Aiejgqbd.exe.6aa334.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.3.Oiehie32.exe.74a33c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.3.Opldpphi.exe.62a1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 30.3.Pnkdgk32.exe.73956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.Jagibbdg.exe.53a6dc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.3.Mkqoicnb.exe.78a1dc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.3.Kkipaf32.exe.61956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.3.Abnopf32.exe.689284.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.3.Obmmbkej.exe.61956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.3.Nncepn32.exe.61a33c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.3.Onigbk32.exe.6aa354.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.3.Nnhnkmek.exe.4ea1c4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001A.00000003.1413094066.0000000000696000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.1401676955.0000000000745000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.1408558477.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.1388062598.0000000000556000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000003.1414686039.0000000000805000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000003.1419724385.0000000000716000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.1401384736.00000000004C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000003.1408231486.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.1384605197.0000000000517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000003.1414648666.0000000000827000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1382620236.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.1416962414.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.1398787103.0000000000787000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000003.1411146589.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.1385339329.0000000000736000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.1404507070.00000000005D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000003.1388400520.00000000004D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.1400431531.00000000005A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000003.1414919528.0000000000467000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1403643696.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.1430537589.0000000000666000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000003.1429745266.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.1416821350.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000003.1411099654.0000000000607000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000003.1397065400.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.1428633163.0000000000506000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000003.1406624266.0000000000617000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.1403408472.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000003.1411928431.0000000000727000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.1383486321.0000000000517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.1385969006.0000000000757000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.1427802477.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000003.1411397694.0000000000706000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000003.1407697621.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000003.1426128043.0000000000656000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000003.1407230240.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.1402396137.0000000000767000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.1399746300.00000000005C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000003.1390029708.00000000004D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.1427760940.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000003.1405915319.00000000005D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1383183359.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.1426482415.00000000004F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000003.1429702535.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.1404835697.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.1400042225.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.1424740554.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000003.1406660618.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.1398838683.0000000000765000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.1399107397.00000000005A5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000003.1397600415.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000003.1415881163.0000000000467000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.1396799040.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.1429984432.0000000000666000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000003.1431367294.00000000005A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.1386806651.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.1428040087.0000000000506000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000003.1405881703.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.1410331324.0000000000507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.1403263169.00000000007D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000003.1406890372.00000000004A5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.1409810870.00000000004E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000003.1412836135.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000003.1413699839.0000000000696000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000003.1431993392.0000000000786000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1404271803.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.1427016535.00000000004F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.1409534659.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: f6t9qa761D.exe PID: 7816, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Jagibbdg.exe PID: 7860, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Jokilfca.exe PID: 7876, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Kegnnphk.exe PID: 7892, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Knccbbff.exe PID: 7908, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Kkgclgep.exe PID: 7924, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Kkipaf32.exe PID: 7956, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Loplncai.exe PID: 7984, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mlfimg32.exe PID: 8000, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mhmiah32.exe PID: 8016, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mddjfiih.exe PID: 8032, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mbhkpnhb.exe PID: 8048, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mkqoicnb.exe PID: 8064, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mdicai32.exe PID: 8080, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mfhplllf.exe PID: 8100, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nncepn32.exe PID: 8116, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nmdeneap.exe PID: 8132, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nfmigk32.exe PID: 8148, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nnhnkmek.exe PID: 8168, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Ninbhfea.exe PID: 8184, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nfacbjdk.exe PID: 7192, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Npjgkp32.exe PID: 7244, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Opldpphi.exe PID: 7288, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Oiehie32.exe PID: 7340, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Obmmbkej.exe PID: 7384, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Oleakplj.exe PID: 7432, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Oiibddkd.exe PID: 7476, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Ofmbni32.exe PID: 7528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Onigbk32.exe PID: 7580, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Pnkdgk32.exe PID: 7628, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Plaafobm.exe PID: 1668, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Plfjan32.exe PID: 1672, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Abgiogom.exe PID: 2540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Afeaee32.exe PID: 6736, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Apmfnklc.exe PID: 5756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Aiejgqbd.exe PID: 5820, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Abnopf32.exe PID: 932, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Boepdgoi.exe PID: 5860, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Bmfpbogh.exe PID: 6704, type: MEMORYSTR
Source: Yara match File source: C:\Windows\SysWOW64\Pnkdgk32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Aiejgqbd.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Knccbbff.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mhmiah32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Nncepn32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Onigbk32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mdicai32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Npjgkp32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Opldpphi.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Kkgclgep.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Nnhnkmek.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Kegnnphk.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Afeaee32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Nfacbjdk.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Kkipaf32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Plaafobm.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Oleakplj.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mlfimg32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Oiibddkd.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Plfjan32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mfhplllf.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Bmfpbogh.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Obmmbkej.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Abnopf32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Beadgadc.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Jagibbdg.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mbhkpnhb.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Abgiogom.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mkqoicnb.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Nfmigk32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Loplncai.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Ofmbni32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Apmfnklc.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Jokilfca.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Nmdeneap.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Oiehie32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Boepdgoi.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mddjfiih.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Ninbhfea.exe, type: DROPPED

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: f6t9qa761D.exe, type: SAMPLE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: f6t9qa761D.exe, type: SAMPLE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: f6t9qa761D.exe, type: SAMPLE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: f6t9qa761D.exe, type: SAMPLE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 15.3.Mfhplllf.exe.4ea6cc.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 15.3.Mfhplllf.exe.4ea6cc.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 15.3.Mfhplllf.exe.4ea6cc.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 15.3.Mfhplllf.exe.4ea6cc.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 15.3.Mfhplllf.exe.4ea6cc.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 13.3.Mkqoicnb.exe.78a1dc.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 13.3.Mkqoicnb.exe.78a1dc.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 13.3.Mkqoicnb.exe.78a1dc.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 13.3.Mkqoicnb.exe.78a1dc.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 13.3.Mkqoicnb.exe.78a1dc.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 6.3.Kkgclgep.exe.4fa5d4.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 6.3.Kkgclgep.exe.4fa5d4.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 6.3.Kkgclgep.exe.4fa5d4.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 6.3.Kkgclgep.exe.4fa5d4.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 6.3.Kkgclgep.exe.4fa5d4.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 5.3.Knccbbff.exe.57956c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 5.3.Knccbbff.exe.57956c.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 5.3.Knccbbff.exe.57956c.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 5.3.Knccbbff.exe.57956c.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 5.3.Knccbbff.exe.57956c.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 27.3.Oiibddkd.exe.84a1cc.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 27.3.Oiibddkd.exe.84a1cc.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 39.3.Bmfpbogh.exe.7a956c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 27.3.Oiibddkd.exe.84a1cc.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 39.3.Bmfpbogh.exe.7a956c.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 27.3.Oiibddkd.exe.84a1cc.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 39.3.Bmfpbogh.exe.7a956c.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 27.3.Oiibddkd.exe.84a1cc.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 39.3.Bmfpbogh.exe.7a956c.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 39.3.Bmfpbogh.exe.7a956c.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 32.3.Plfjan32.exe.67956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 32.3.Plfjan32.exe.67956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 32.3.Plfjan32.exe.67956c.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 32.3.Plfjan32.exe.67956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 37.3.Abnopf32.exe.689284.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 37.3.Abnopf32.exe.689284.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 37.3.Abnopf32.exe.689284.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 37.3.Abnopf32.exe.689284.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 37.3.Abnopf32.exe.689284.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 9.3.Mlfimg32.exe.7aa1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 9.3.Mlfimg32.exe.7aa1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 9.3.Mlfimg32.exe.7aa1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 9.3.Mlfimg32.exe.7aa1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 2.3.Jagibbdg.exe.53a6dc.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 2.3.Jagibbdg.exe.53a6dc.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 2.3.Jagibbdg.exe.53a6dc.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 2.3.Jagibbdg.exe.53a6dc.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 2.3.Jagibbdg.exe.53a6dc.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 3.3.Jokilfca.exe.77a334.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 3.3.Jokilfca.exe.77a334.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 3.3.Jokilfca.exe.77a334.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 3.3.Jokilfca.exe.77a334.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 3.3.Jokilfca.exe.77a334.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 27.3.Oiibddkd.exe.84a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 27.3.Oiibddkd.exe.84a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 27.3.Oiibddkd.exe.84a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 27.3.Oiibddkd.exe.84a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 8.3.Loplncai.exe.5a9704.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 8.3.Loplncai.exe.5a9704.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 8.3.Loplncai.exe.5a9704.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 8.3.Loplncai.exe.5a9704.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 8.3.Loplncai.exe.5a9704.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.3.Kegnnphk.exe.7c956c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 4.3.Kegnnphk.exe.7c956c.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 4.3.Kegnnphk.exe.7c956c.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 4.3.Kegnnphk.exe.7c956c.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 4.3.Kegnnphk.exe.7c956c.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 30.3.Pnkdgk32.exe.73956c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 30.3.Pnkdgk32.exe.73956c.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 30.3.Pnkdgk32.exe.73956c.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 30.3.Pnkdgk32.exe.73956c.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 30.3.Pnkdgk32.exe.73956c.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 29.3.Onigbk32.exe.6aa354.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 29.3.Onigbk32.exe.6aa354.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 29.3.Onigbk32.exe.6aa354.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 29.3.Onigbk32.exe.6aa354.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 24.3.Oiehie32.exe.74a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 24.3.Oiehie32.exe.74a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 24.3.Oiehie32.exe.74a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 24.3.Oiehie32.exe.74a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 15.3.Mfhplllf.exe.4ea6cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 15.3.Mfhplllf.exe.4ea6cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 15.3.Mfhplllf.exe.4ea6cc.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 15.3.Mfhplllf.exe.4ea6cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 38.3.Boepdgoi.exe.5c956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 38.3.Boepdgoi.exe.5c956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 38.3.Boepdgoi.exe.5c956c.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 38.3.Boepdgoi.exe.5c956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 5.3.Knccbbff.exe.57956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 5.3.Knccbbff.exe.57956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 5.3.Knccbbff.exe.57956c.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 5.3.Knccbbff.exe.57956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 31.3.Plaafobm.exe.81956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 31.3.Plaafobm.exe.81956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 31.3.Plaafobm.exe.81956c.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 31.3.Plaafobm.exe.81956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 1.3.f6t9qa761D.exe.4d973c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 1.3.f6t9qa761D.exe.4d973c.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 1.3.f6t9qa761D.exe.4d973c.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 1.3.f6t9qa761D.exe.4d973c.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 20.3.Ninbhfea.exe.7ea344.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 20.3.Ninbhfea.exe.7ea344.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 20.3.Ninbhfea.exe.7ea344.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 20.3.Ninbhfea.exe.7ea344.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 8.3.Loplncai.exe.5a9704.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 8.3.Loplncai.exe.5a9704.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 8.3.Loplncai.exe.5a9704.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 8.3.Loplncai.exe.5a9704.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 11.3.Mddjfiih.exe.5ca984.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 11.3.Mddjfiih.exe.5ca984.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 11.3.Mddjfiih.exe.5ca984.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 11.3.Mddjfiih.exe.5ca984.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 11.3.Mddjfiih.exe.5ca984.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 32.3.Plfjan32.exe.67956c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 32.3.Plfjan32.exe.67956c.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 32.3.Plfjan32.exe.67956c.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 32.3.Plfjan32.exe.67956c.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 32.3.Plfjan32.exe.67956c.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 14.3.Mdicai32.exe.7fa354.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 14.3.Mdicai32.exe.7fa354.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 14.3.Mdicai32.exe.7fa354.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 14.3.Mdicai32.exe.7fa354.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 28.3.Ofmbni32.exe.48a5d4.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 28.3.Ofmbni32.exe.48a5d4.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 28.3.Ofmbni32.exe.48a5d4.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 28.3.Ofmbni32.exe.48a5d4.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 10.3.Mhmiah32.exe.5ea1dc.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 10.3.Mhmiah32.exe.5ea1dc.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 21.3.Nfacbjdk.exe.6197d4.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 10.3.Mhmiah32.exe.5ea1dc.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 21.3.Nfacbjdk.exe.6197d4.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 21.3.Nfacbjdk.exe.6197d4.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 21.3.Nfacbjdk.exe.6197d4.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 10.3.Mhmiah32.exe.5ea1dc.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 10.3.Mhmiah32.exe.5ea1dc.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 18.3.Nfmigk32.exe.63a1cc.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 18.3.Nfmigk32.exe.63a1cc.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 18.3.Nfmigk32.exe.63a1cc.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 18.3.Nfmigk32.exe.63a1cc.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 18.3.Nfmigk32.exe.63a1cc.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 10.3.Mhmiah32.exe.5ea1dc.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 10.3.Mhmiah32.exe.5ea1dc.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 10.3.Mhmiah32.exe.5ea1dc.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 10.3.Mhmiah32.exe.5ea1dc.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 12.3.Mbhkpnhb.exe.4e9744.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 12.3.Mbhkpnhb.exe.4e9744.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 12.3.Mbhkpnhb.exe.4e9744.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 12.3.Mbhkpnhb.exe.4e9744.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 12.3.Mbhkpnhb.exe.4e9744.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 7.3.Kkipaf32.exe.61956c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 7.3.Kkipaf32.exe.61956c.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 7.3.Kkipaf32.exe.61956c.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 7.3.Kkipaf32.exe.61956c.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 7.3.Kkipaf32.exe.61956c.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 26.3.Oleakplj.exe.6b908c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 26.3.Oleakplj.exe.6b908c.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 26.3.Oleakplj.exe.6b908c.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 26.3.Oleakplj.exe.6b908c.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 26.3.Oleakplj.exe.6b908c.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 1.3.f6t9qa761D.exe.4d973c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 1.3.f6t9qa761D.exe.4d973c.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 1.3.f6t9qa761D.exe.4d973c.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 1.3.f6t9qa761D.exe.4d973c.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 1.3.f6t9qa761D.exe.4d973c.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 36.3.Aiejgqbd.exe.6aa334.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 36.3.Aiejgqbd.exe.6aa334.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 36.3.Aiejgqbd.exe.6aa334.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 36.3.Aiejgqbd.exe.6aa334.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 36.3.Aiejgqbd.exe.6aa334.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 35.3.Apmfnklc.exe.52967c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 35.3.Apmfnklc.exe.52967c.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 35.3.Apmfnklc.exe.52967c.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 35.3.Apmfnklc.exe.52967c.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 35.3.Apmfnklc.exe.52967c.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 26.3.Oleakplj.exe.6b908c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 26.3.Oleakplj.exe.6b908c.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 26.3.Oleakplj.exe.6b908c.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 26.3.Oleakplj.exe.6b908c.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 33.3.Abgiogom.exe.519824.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 34.3.Afeaee32.exe.6aa1cc.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 33.3.Abgiogom.exe.519824.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 33.3.Abgiogom.exe.519824.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 34.3.Afeaee32.exe.6aa1cc.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 34.3.Afeaee32.exe.6aa1cc.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 33.3.Abgiogom.exe.519824.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 33.3.Abgiogom.exe.519824.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 34.3.Afeaee32.exe.6aa1cc.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 34.3.Afeaee32.exe.6aa1cc.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 38.3.Boepdgoi.exe.5c956c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 38.3.Boepdgoi.exe.5c956c.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 38.3.Boepdgoi.exe.5c956c.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 38.3.Boepdgoi.exe.5c956c.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 38.3.Boepdgoi.exe.5c956c.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 35.3.Apmfnklc.exe.52967c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 35.3.Apmfnklc.exe.52967c.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 35.3.Apmfnklc.exe.52967c.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 35.3.Apmfnklc.exe.52967c.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 14.3.Mdicai32.exe.7fa354.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 14.3.Mdicai32.exe.7fa354.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 14.3.Mdicai32.exe.7fa354.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 14.3.Mdicai32.exe.7fa354.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 14.3.Mdicai32.exe.7fa354.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 25.3.Obmmbkej.exe.61956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 25.3.Obmmbkej.exe.61956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 25.3.Obmmbkej.exe.61956c.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 25.3.Obmmbkej.exe.61956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 18.3.Nfmigk32.exe.63a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 18.3.Nfmigk32.exe.63a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 18.3.Nfmigk32.exe.63a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 18.3.Nfmigk32.exe.63a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 33.3.Abgiogom.exe.519824.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 33.3.Abgiogom.exe.519824.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 33.3.Abgiogom.exe.519824.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 33.3.Abgiogom.exe.519824.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 6.3.Kkgclgep.exe.4fa5d4.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 6.3.Kkgclgep.exe.4fa5d4.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 6.3.Kkgclgep.exe.4fa5d4.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 6.3.Kkgclgep.exe.4fa5d4.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 20.3.Ninbhfea.exe.7ea344.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 20.3.Ninbhfea.exe.7ea344.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 20.3.Ninbhfea.exe.7ea344.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 20.3.Ninbhfea.exe.7ea344.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 20.3.Ninbhfea.exe.7ea344.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 4.3.Kegnnphk.exe.7c956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 4.3.Kegnnphk.exe.7c956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 4.3.Kegnnphk.exe.7c956c.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 4.3.Kegnnphk.exe.7c956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 22.3.Npjgkp32.exe.52a33c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 22.3.Npjgkp32.exe.52a33c.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 22.3.Npjgkp32.exe.52a33c.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 22.3.Npjgkp32.exe.52a33c.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 22.3.Npjgkp32.exe.52a33c.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 31.3.Plaafobm.exe.81956c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 31.3.Plaafobm.exe.81956c.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 31.3.Plaafobm.exe.81956c.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 31.3.Plaafobm.exe.81956c.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 31.3.Plaafobm.exe.81956c.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 17.3.Nmdeneap.exe.61a1cc.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 17.3.Nmdeneap.exe.61a1cc.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 17.3.Nmdeneap.exe.61a1cc.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 17.3.Nmdeneap.exe.61a1cc.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 17.3.Nmdeneap.exe.61a1cc.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 17.3.Nmdeneap.exe.61a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 17.3.Nmdeneap.exe.61a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 17.3.Nmdeneap.exe.61a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 17.3.Nmdeneap.exe.61a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 16.3.Nncepn32.exe.61a33c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 16.3.Nncepn32.exe.61a33c.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 16.3.Nncepn32.exe.61a33c.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 16.3.Nncepn32.exe.61a33c.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 16.3.Nncepn32.exe.61a33c.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 11.3.Mddjfiih.exe.5ca984.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 11.3.Mddjfiih.exe.5ca984.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 11.3.Mddjfiih.exe.5ca984.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 11.3.Mddjfiih.exe.5ca984.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 19.3.Nnhnkmek.exe.4ea1c4.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 19.3.Nnhnkmek.exe.4ea1c4.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 19.3.Nnhnkmek.exe.4ea1c4.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 19.3.Nnhnkmek.exe.4ea1c4.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 19.3.Nnhnkmek.exe.4ea1c4.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 34.3.Afeaee32.exe.6aa1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 23.3.Opldpphi.exe.62a1cc.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 34.3.Afeaee32.exe.6aa1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 34.3.Afeaee32.exe.6aa1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 34.3.Afeaee32.exe.6aa1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 23.3.Opldpphi.exe.62a1cc.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 23.3.Opldpphi.exe.62a1cc.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 23.3.Opldpphi.exe.62a1cc.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 23.3.Opldpphi.exe.62a1cc.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 28.3.Ofmbni32.exe.48a5d4.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 28.3.Ofmbni32.exe.48a5d4.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 28.3.Ofmbni32.exe.48a5d4.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 28.3.Ofmbni32.exe.48a5d4.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 28.3.Ofmbni32.exe.48a5d4.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 22.3.Npjgkp32.exe.52a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 22.3.Npjgkp32.exe.52a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 22.3.Npjgkp32.exe.52a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 22.3.Npjgkp32.exe.52a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 21.3.Nfacbjdk.exe.6197d4.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 21.3.Nfacbjdk.exe.6197d4.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 21.3.Nfacbjdk.exe.6197d4.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 21.3.Nfacbjdk.exe.6197d4.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 21.3.Nfacbjdk.exe.6197d4.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 39.3.Bmfpbogh.exe.7a956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 39.3.Bmfpbogh.exe.7a956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 39.3.Bmfpbogh.exe.7a956c.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 39.3.Bmfpbogh.exe.7a956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 3.3.Jokilfca.exe.77a334.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 9.3.Mlfimg32.exe.7aa1cc.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 3.3.Jokilfca.exe.77a334.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 9.3.Mlfimg32.exe.7aa1cc.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 3.3.Jokilfca.exe.77a334.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 3.3.Jokilfca.exe.77a334.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 9.3.Mlfimg32.exe.7aa1cc.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 9.3.Mlfimg32.exe.7aa1cc.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 9.3.Mlfimg32.exe.7aa1cc.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 12.3.Mbhkpnhb.exe.4e9744.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 12.3.Mbhkpnhb.exe.4e9744.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 12.3.Mbhkpnhb.exe.4e9744.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 12.3.Mbhkpnhb.exe.4e9744.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 36.3.Aiejgqbd.exe.6aa334.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 36.3.Aiejgqbd.exe.6aa334.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 36.3.Aiejgqbd.exe.6aa334.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 36.3.Aiejgqbd.exe.6aa334.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 24.3.Oiehie32.exe.74a33c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 24.3.Oiehie32.exe.74a33c.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 24.3.Oiehie32.exe.74a33c.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 24.3.Oiehie32.exe.74a33c.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 24.3.Oiehie32.exe.74a33c.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 23.3.Opldpphi.exe.62a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 23.3.Opldpphi.exe.62a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 23.3.Opldpphi.exe.62a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 23.3.Opldpphi.exe.62a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 30.3.Pnkdgk32.exe.73956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 2.3.Jagibbdg.exe.53a6dc.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 30.3.Pnkdgk32.exe.73956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 2.3.Jagibbdg.exe.53a6dc.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 2.3.Jagibbdg.exe.53a6dc.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 2.3.Jagibbdg.exe.53a6dc.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 30.3.Pnkdgk32.exe.73956c.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 30.3.Pnkdgk32.exe.73956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 13.3.Mkqoicnb.exe.78a1dc.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 7.3.Kkipaf32.exe.61956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 13.3.Mkqoicnb.exe.78a1dc.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 7.3.Kkipaf32.exe.61956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 7.3.Kkipaf32.exe.61956c.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 7.3.Kkipaf32.exe.61956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 13.3.Mkqoicnb.exe.78a1dc.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 13.3.Mkqoicnb.exe.78a1dc.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 37.3.Abnopf32.exe.689284.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 37.3.Abnopf32.exe.689284.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 37.3.Abnopf32.exe.689284.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 37.3.Abnopf32.exe.689284.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 25.3.Obmmbkej.exe.61956c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 25.3.Obmmbkej.exe.61956c.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 25.3.Obmmbkej.exe.61956c.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 25.3.Obmmbkej.exe.61956c.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 25.3.Obmmbkej.exe.61956c.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 16.3.Nncepn32.exe.61a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 16.3.Nncepn32.exe.61a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 16.3.Nncepn32.exe.61a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 16.3.Nncepn32.exe.61a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 29.3.Onigbk32.exe.6aa354.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 29.3.Onigbk32.exe.6aa354.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 29.3.Onigbk32.exe.6aa354.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 29.3.Onigbk32.exe.6aa354.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 29.3.Onigbk32.exe.6aa354.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 19.3.Nnhnkmek.exe.4ea1c4.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 19.3.Nnhnkmek.exe.4ea1c4.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 19.3.Nnhnkmek.exe.4ea1c4.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 19.3.Nnhnkmek.exe.4ea1c4.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0000001A.00000003.1413094066.0000000000696000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0000001A.00000003.1413094066.0000000000696000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000001A.00000003.1413094066.0000000000696000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000003.1401676955.0000000000745000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0000000D.00000003.1401676955.0000000000745000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000000D.00000003.1401676955.0000000000745000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000003.1408558477.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000015.00000003.1408558477.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000015.00000003.1408558477.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000003.1388062598.0000000000556000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000005.00000003.1388062598.0000000000556000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000005.00000003.1388062598.0000000000556000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0000001B.00000003.1414686039.0000000000805000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0000001B.00000003.1414686039.0000000000805000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000001B.00000003.1414686039.0000000000805000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0000001E.00000003.1419724385.0000000000716000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0000001E.00000003.1419724385.0000000000716000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000001E.00000003.1419724385.0000000000716000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000003.1401384736.00000000004C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0000000C.00000003.1401384736.00000000004C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000000C.00000003.1401384736.00000000004C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000014.00000003.1408231486.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000014.00000003.1408231486.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000014.00000003.1408231486.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000003.1384605197.0000000000517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000002.00000003.1384605197.0000000000517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000002.00000003.1384605197.0000000000517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0000001B.00000003.1414648666.0000000000827000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0000001B.00000003.1414648666.0000000000827000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000001B.00000003.1414648666.0000000000827000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000003.1382620236.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000001.00000003.1382620236.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000001.00000003.1382620236.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0000001D.00000003.1416962414.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0000001D.00000003.1416962414.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000001D.00000003.1416962414.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000003.1398787103.0000000000787000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000009.00000003.1398787103.0000000000787000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000009.00000003.1398787103.0000000000787000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000017.00000003.1411146589.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000017.00000003.1411146589.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000017.00000003.1411146589.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000003.1385339329.0000000000736000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000003.00000003.1385339329.0000000000736000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000003.00000003.1385339329.0000000000736000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000003.1404507070.00000000005D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000010.00000003.1404507070.00000000005D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000010.00000003.1404507070.00000000005D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000003.1388400520.00000000004D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000006.00000003.1388400520.00000000004D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000006.00000003.1388400520.00000000004D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000003.1400431531.00000000005A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0000000B.00000003.1400431531.00000000005A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000000B.00000003.1400431531.00000000005A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0000001C.00000003.1414919528.0000000000467000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0000001C.00000003.1414919528.0000000000467000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000001C.00000003.1414919528.0000000000467000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000003.1403643696.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0000000F.00000003.1403643696.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000000F.00000003.1403643696.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000025.00000003.1430537589.0000000000666000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000025.00000003.1430537589.0000000000666000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000025.00000003.1430537589.0000000000666000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000024.00000003.1429745266.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000024.00000003.1429745266.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000024.00000003.1429745266.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0000001D.00000003.1416821350.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0000001D.00000003.1416821350.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000001D.00000003.1416821350.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000017.00000003.1411099654.0000000000607000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000017.00000003.1411099654.0000000000607000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000017.00000003.1411099654.0000000000607000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000003.1397065400.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000023.00000003.1428633163.0000000000506000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000008.00000003.1397065400.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000023.00000003.1428633163.0000000000506000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000023.00000003.1428633163.0000000000506000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000003.1397065400.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000012.00000003.1406624266.0000000000617000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000012.00000003.1406624266.0000000000617000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000012.00000003.1406624266.0000000000617000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0000000E.00000003.1403408472.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0000000E.00000003.1403408472.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000000E.00000003.1403408472.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000018.00000003.1411928431.0000000000727000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000018.00000003.1411928431.0000000000727000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000018.00000003.1411928431.0000000000727000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000003.1383486321.0000000000517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000002.00000003.1383486321.0000000000517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000002.00000003.1383486321.0000000000517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000003.1385969006.0000000000757000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000003.00000003.1385969006.0000000000757000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000003.00000003.1385969006.0000000000757000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000022.00000003.1427802477.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000022.00000003.1427802477.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000022.00000003.1427802477.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000018.00000003.1411397694.0000000000706000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000018.00000003.1411397694.0000000000706000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000018.00000003.1411397694.0000000000706000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000014.00000003.1407697621.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000014.00000003.1407697621.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000014.00000003.1407697621.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000020.00000003.1426128043.0000000000656000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000020.00000003.1426128043.0000000000656000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000020.00000003.1426128043.0000000000656000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000003.1407230240.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000013.00000003.1407230240.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000013.00000003.1407230240.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000003.1402396137.0000000000767000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0000000D.00000003.1402396137.0000000000767000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000000D.00000003.1402396137.0000000000767000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000003.1399746300.00000000005C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0000000A.00000003.1399746300.00000000005C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000000A.00000003.1399746300.00000000005C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000003.1390029708.00000000004D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000006.00000003.1390029708.00000000004D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000006.00000003.1390029708.00000000004D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000022.00000003.1427760940.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000022.00000003.1427760940.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000022.00000003.1427760940.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000003.1405915319.00000000005D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000011.00000003.1405915319.00000000005D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000011.00000003.1405915319.00000000005D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000003.1383183359.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000001.00000003.1383183359.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000001.00000003.1383183359.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000021.00000003.1426482415.00000000004F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000021.00000003.1426482415.00000000004F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000021.00000003.1426482415.00000000004F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000024.00000003.1429702535.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000024.00000003.1429702535.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000024.00000003.1429702535.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000003.1404835697.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000010.00000003.1404835697.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000010.00000003.1404835697.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000003.1400042225.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0000000B.00000003.1400042225.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000000B.00000003.1400042225.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0000001F.00000003.1424740554.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0000001F.00000003.1424740554.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000001F.00000003.1424740554.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000012.00000003.1406660618.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000012.00000003.1406660618.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000012.00000003.1406660618.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000003.1398838683.0000000000765000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
PE file has a writeable .text section
Source: f6t9qa761D.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Jagibbdg.exe.1.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Jokilfca.exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Kegnnphk.exe.3.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Knccbbff.exe.4.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Kkgclgep.exe.5.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Kkipaf32.exe.6.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Loplncai.exe.7.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Mlfimg32.exe.8.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Mhmiah32.exe.9.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Mddjfiih.exe.10.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Mbhkpnhb.exe.11.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Mkqoicnb.exe.12.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Mdicai32.exe.13.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Mfhplllf.exe.14.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Nncepn32.exe.15.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Nmdeneap.exe.16.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Nfmigk32.exe.17.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Nnhnkmek.exe.18.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Ninbhfea.exe.19.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Nfacbjdk.exe.20.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Npjgkp32.exe.21.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Opldpphi.exe.22.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Oiehie32.exe.23.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Obmmbkej.exe.24.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Oleakplj.exe.25.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Oiibddkd.exe.26.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Ofmbni32.exe.27.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Onigbk32.exe.28.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Pnkdgk32.exe.29.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Plaafobm.exe.30.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Plfjan32.exe.31.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Abgiogom.exe.32.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Afeaee32.exe.33.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Apmfnklc.exe.34.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Aiejgqbd.exe.35.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Abnopf32.exe.36.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Boepdgoi.exe.37.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Bmfpbogh.exe.38.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Beadgadc.exe.39.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Creates files inside the system directory
Source: C:\Users\user\Desktop\f6t9qa761D.exe File created: C:\Windows\SysWOW64\Jagibbdg.exe Jump to behavior
Source: C:\Users\user\Desktop\f6t9qa761D.exe File created: C:\Windows\SysWOW64\Jagibbdg.exe:Zone.Identifier:$DATA Jump to behavior
Source: C:\Users\user\Desktop\f6t9qa761D.exe File created: C:\Windows\SysWOW64\Doaepp32.dll Jump to behavior
Source: C:\Windows\SysWOW64\Jagibbdg.exe File created: C:\Windows\SysWOW64\Jokilfca.exe Jump to behavior
Source: C:\Windows\SysWOW64\Jagibbdg.exe File created: C:\Windows\SysWOW64\Clajoglf.dll Jump to behavior
Source: C:\Windows\SysWOW64\Jokilfca.exe File created: C:\Windows\SysWOW64\Kegnnphk.exe Jump to behavior
Source: C:\Windows\SysWOW64\Jokilfca.exe File created: C:\Windows\SysWOW64\Flbkld32.dll Jump to behavior
Source: C:\Windows\SysWOW64\Kegnnphk.exe File created: C:\Windows\SysWOW64\Knccbbff.exe Jump to behavior
Source: C:\Windows\SysWOW64\Kegnnphk.exe File created: C:\Windows\SysWOW64\Fkcpdl32.dll Jump to behavior
Source: C:\Windows\SysWOW64\Knccbbff.exe File created: C:\Windows\SysWOW64\Kkgclgep.exe Jump to behavior
Source: C:\Windows\SysWOW64\Knccbbff.exe File created: C:\Windows\SysWOW64\Qanqbgdb.dll Jump to behavior
Source: C:\Windows\SysWOW64\Kkgclgep.exe File created: C:\Windows\SysWOW64\Kkipaf32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Kkgclgep.exe File created: C:\Windows\SysWOW64\Kbelgk32.dll Jump to behavior
Source: C:\Windows\SysWOW64\Kkipaf32.exe File created: C:\Windows\SysWOW64\Loplncai.exe Jump to behavior
Source: C:\Windows\SysWOW64\Kkipaf32.exe File created: C:\Windows\SysWOW64\Eoifoe32.dll Jump to behavior
Source: C:\Windows\SysWOW64\Loplncai.exe File created: C:\Windows\SysWOW64\Mlfimg32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Loplncai.exe File created: C:\Windows\SysWOW64\Jflaad32.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mlfimg32.exe File created: C:\Windows\SysWOW64\Mhmiah32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Mlfimg32.exe File created: C:\Windows\SysWOW64\Imjgmahp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mhmiah32.exe File created: C:\Windows\SysWOW64\Mddjfiih.exe Jump to behavior
Source: C:\Windows\SysWOW64\Mhmiah32.exe File created: C:\Windows\SysWOW64\Ekdhoi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mddjfiih.exe File created: C:\Windows\SysWOW64\Mbhkpnhb.exe Jump to behavior
Source: C:\Windows\SysWOW64\Mddjfiih.exe File created: C:\Windows\SysWOW64\Makogp32.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe File created: C:\Windows\SysWOW64\Mkqoicnb.exe Jump to behavior
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe File created: C:\Windows\SysWOW64\Gkehlfaa.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mkqoicnb.exe File created: C:\Windows\SysWOW64\Mdicai32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Mkqoicnb.exe File created: C:\Windows\SysWOW64\Ihifngfk.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mdicai32.exe File created: C:\Windows\SysWOW64\Mfhplllf.exe Jump to behavior
Source: C:\Windows\SysWOW64\Mdicai32.exe File created: C:\Windows\SysWOW64\Eeflcm32.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mfhplllf.exe File created: C:\Windows\SysWOW64\Nncepn32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Mfhplllf.exe File created: C:\Windows\SysWOW64\Gfhipbln.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nncepn32.exe File created: C:\Windows\SysWOW64\Nmdeneap.exe Jump to behavior
Source: C:\Windows\SysWOW64\Nncepn32.exe File created: C:\Windows\SysWOW64\Efhade32.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nmdeneap.exe File created: C:\Windows\SysWOW64\Nfmigk32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Nmdeneap.exe File created: C:\Windows\SysWOW64\Jhemcd32.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nfmigk32.exe File created: C:\Windows\SysWOW64\Nnhnkmek.exe Jump to behavior
Source: C:\Windows\SysWOW64\Nfmigk32.exe File created: C:\Windows\SysWOW64\Eakcoodc.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nnhnkmek.exe File created: C:\Windows\SysWOW64\Ninbhfea.exe Jump to behavior
Source: C:\Windows\SysWOW64\Nnhnkmek.exe File created: C:\Windows\SysWOW64\Nnglhjfe.dll Jump to behavior
Source: C:\Windows\SysWOW64\Ninbhfea.exe File created: C:\Windows\SysWOW64\Nfacbjdk.exe Jump to behavior
Source: C:\Windows\SysWOW64\Ninbhfea.exe File created: C:\Windows\SysWOW64\Okilnjci.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nfacbjdk.exe File created: C:\Windows\SysWOW64\Npjgkp32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Nfacbjdk.exe File created: C:\Windows\SysWOW64\Abagca32.dll Jump to behavior
Source: C:\Windows\SysWOW64\Npjgkp32.exe File created: C:\Windows\SysWOW64\Opldpphi.exe Jump to behavior
Source: C:\Windows\SysWOW64\Npjgkp32.exe File created: C:\Windows\SysWOW64\Caghjf32.dll Jump to behavior
Source: C:\Windows\SysWOW64\Opldpphi.exe File created: C:\Windows\SysWOW64\Oiehie32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Opldpphi.exe File created: C:\Windows\SysWOW64\Pppjem32.dll Jump to behavior
Source: C:\Windows\SysWOW64\Oiehie32.exe File created: C:\Windows\SysWOW64\Obmmbkej.exe Jump to behavior
Source: C:\Windows\SysWOW64\Oiehie32.exe File created: C:\Windows\SysWOW64\Jpegka32.dll Jump to behavior
Source: C:\Windows\SysWOW64\Obmmbkej.exe File created: C:\Windows\SysWOW64\Oleakplj.exe Jump to behavior
Source: C:\Windows\SysWOW64\Obmmbkej.exe File created: C:\Windows\SysWOW64\Kkqaeb32.dll Jump to behavior
Source: C:\Windows\SysWOW64\Oleakplj.exe File created: C:\Windows\SysWOW64\Oiibddkd.exe Jump to behavior
Source: C:\Windows\SysWOW64\Oleakplj.exe File created: C:\Windows\SysWOW64\Njcedipl.dll Jump to behavior
Source: C:\Windows\SysWOW64\Oiibddkd.exe File created: C:\Windows\SysWOW64\Ofmbni32.exe
Source: C:\Windows\SysWOW64\Oiibddkd.exe File created: C:\Windows\SysWOW64\Jdlgaj32.dll
Source: C:\Windows\SysWOW64\Ofmbni32.exe File created: C:\Windows\SysWOW64\Onigbk32.exe
Source: C:\Windows\SysWOW64\Ofmbni32.exe File created: C:\Windows\SysWOW64\Fompebbg.dll
Source: C:\Windows\SysWOW64\Onigbk32.exe File created: C:\Windows\SysWOW64\Pnkdgk32.exe
Source: C:\Windows\SysWOW64\Onigbk32.exe File created: C:\Windows\SysWOW64\Efljmjpm.dll
Source: C:\Windows\SysWOW64\Pnkdgk32.exe File created: C:\Windows\SysWOW64\Plaafobm.exe
Source: C:\Windows\SysWOW64\Pnkdgk32.exe File created: C:\Windows\SysWOW64\Gdcmha32.dll
Source: C:\Windows\SysWOW64\Plaafobm.exe File created: C:\Windows\SysWOW64\Plfjan32.exe
Source: C:\Windows\SysWOW64\Plaafobm.exe File created: C:\Windows\SysWOW64\Khhkcgiq.dll
Source: C:\Windows\SysWOW64\Plfjan32.exe File created: C:\Windows\SysWOW64\Abgiogom.exe
Source: C:\Windows\SysWOW64\Plfjan32.exe File created: C:\Windows\SysWOW64\Bkmjkjhd.dll
Source: C:\Windows\SysWOW64\Abgiogom.exe File created: C:\Windows\SysWOW64\Afeaee32.exe
Source: C:\Windows\SysWOW64\Abgiogom.exe File created: C:\Windows\SysWOW64\Kkpgnmhh.dll
Source: C:\Windows\SysWOW64\Afeaee32.exe File created: C:\Windows\SysWOW64\Apmfnklc.exe
Source: C:\Windows\SysWOW64\Afeaee32.exe File created: C:\Windows\SysWOW64\Cjemgabj.dll
Source: C:\Windows\SysWOW64\Apmfnklc.exe File created: C:\Windows\SysWOW64\Aiejgqbd.exe
Source: C:\Windows\SysWOW64\Apmfnklc.exe File created: C:\Windows\SysWOW64\Akecacdm.dll
Source: C:\Windows\SysWOW64\Aiejgqbd.exe File created: C:\Windows\SysWOW64\Abnopf32.exe
Source: C:\Windows\SysWOW64\Aiejgqbd.exe File created: C:\Windows\SysWOW64\Cboabb32.dll
Source: C:\Windows\SysWOW64\Abnopf32.exe File created: C:\Windows\SysWOW64\Boepdgoi.exe
Source: C:\Windows\SysWOW64\Abnopf32.exe File created: C:\Windows\SysWOW64\Nikaqk32.dll
Source: C:\Windows\SysWOW64\Boepdgoi.exe File created: C:\Windows\SysWOW64\Bmfpbogh.exe
Source: C:\Windows\SysWOW64\Boepdgoi.exe File created: C:\Windows\SysWOW64\Folfac32.dll
Source: C:\Windows\SysWOW64\Bmfpbogh.exe File created: C:\Windows\SysWOW64\Beadgadc.exe
Source: C:\Windows\SysWOW64\Bmfpbogh.exe File created: C:\Windows\SysWOW64\Pilbmhcp.dll
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\Aiejgqbd.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Aiejgqbd.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Nnhnkmek.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Nnhnkmek.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Nfacbjdk.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Nfacbjdk.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Pnkdgk32.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Pnkdgk32.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Users\user\Desktop\f6t9qa761D.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Apmfnklc.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Apmfnklc.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Npjgkp32.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Npjgkp32.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Mdicai32.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Mdicai32.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Mlfimg32.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Jagibbdg.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Abnopf32.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Abnopf32.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Kkgclgep.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Bmfpbogh.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Bmfpbogh.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Oiibddkd.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Oiibddkd.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Mfhplllf.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Mfhplllf.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Knccbbff.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Abgiogom.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Abgiogom.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Opldpphi.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Opldpphi.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Afeaee32.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Afeaee32.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Boepdgoi.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Boepdgoi.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Mhmiah32.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Plfjan32.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Plfjan32.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Mkqoicnb.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Mkqoicnb.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Mddjfiih.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Oleakplj.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Oleakplj.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Ofmbni32.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Ofmbni32.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Onigbk32.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Onigbk32.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Nfmigk32.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Nfmigk32.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Plaafobm.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Plaafobm.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Jokilfca.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Ninbhfea.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Ninbhfea.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Nmdeneap.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Nmdeneap.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Loplncai.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Obmmbkej.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Obmmbkej.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Nncepn32.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Nncepn32.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Kegnnphk.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Oiehie32.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Oiehie32.exe Code function: String function: 00408F18 appears 42 times
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: String function: 00408A60 appears 31 times
Source: C:\Windows\SysWOW64\Kkipaf32.exe Code function: String function: 00408F18 appears 42 times
Uses 32bit PE files
Source: f6t9qa761D.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Yara signature match
Source: f6t9qa761D.exe, type: SAMPLE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: f6t9qa761D.exe, type: SAMPLE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: f6t9qa761D.exe, type: SAMPLE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: f6t9qa761D.exe, type: SAMPLE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 15.3.Mfhplllf.exe.4ea6cc.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 15.3.Mfhplllf.exe.4ea6cc.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.3.Mfhplllf.exe.4ea6cc.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 15.3.Mfhplllf.exe.4ea6cc.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 15.3.Mfhplllf.exe.4ea6cc.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 13.3.Mkqoicnb.exe.78a1dc.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 13.3.Mkqoicnb.exe.78a1dc.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.3.Mkqoicnb.exe.78a1dc.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 13.3.Mkqoicnb.exe.78a1dc.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 13.3.Mkqoicnb.exe.78a1dc.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 6.3.Kkgclgep.exe.4fa5d4.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 6.3.Kkgclgep.exe.4fa5d4.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 6.3.Kkgclgep.exe.4fa5d4.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 6.3.Kkgclgep.exe.4fa5d4.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 6.3.Kkgclgep.exe.4fa5d4.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 5.3.Knccbbff.exe.57956c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 5.3.Knccbbff.exe.57956c.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.3.Knccbbff.exe.57956c.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 5.3.Knccbbff.exe.57956c.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 5.3.Knccbbff.exe.57956c.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 27.3.Oiibddkd.exe.84a1cc.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 27.3.Oiibddkd.exe.84a1cc.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 39.3.Bmfpbogh.exe.7a956c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 27.3.Oiibddkd.exe.84a1cc.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 39.3.Bmfpbogh.exe.7a956c.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 27.3.Oiibddkd.exe.84a1cc.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 39.3.Bmfpbogh.exe.7a956c.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 27.3.Oiibddkd.exe.84a1cc.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 39.3.Bmfpbogh.exe.7a956c.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 39.3.Bmfpbogh.exe.7a956c.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 32.3.Plfjan32.exe.67956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 32.3.Plfjan32.exe.67956c.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 32.3.Plfjan32.exe.67956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 32.3.Plfjan32.exe.67956c.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 37.3.Abnopf32.exe.689284.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 37.3.Abnopf32.exe.689284.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 37.3.Abnopf32.exe.689284.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 37.3.Abnopf32.exe.689284.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 37.3.Abnopf32.exe.689284.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 9.3.Mlfimg32.exe.7aa1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 9.3.Mlfimg32.exe.7aa1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 9.3.Mlfimg32.exe.7aa1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 9.3.Mlfimg32.exe.7aa1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 2.3.Jagibbdg.exe.53a6dc.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 2.3.Jagibbdg.exe.53a6dc.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.3.Jagibbdg.exe.53a6dc.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 2.3.Jagibbdg.exe.53a6dc.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 2.3.Jagibbdg.exe.53a6dc.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 3.3.Jokilfca.exe.77a334.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 3.3.Jokilfca.exe.77a334.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.3.Jokilfca.exe.77a334.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 3.3.Jokilfca.exe.77a334.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 3.3.Jokilfca.exe.77a334.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 27.3.Oiibddkd.exe.84a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 27.3.Oiibddkd.exe.84a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 27.3.Oiibddkd.exe.84a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 27.3.Oiibddkd.exe.84a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 8.3.Loplncai.exe.5a9704.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 8.3.Loplncai.exe.5a9704.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.3.Loplncai.exe.5a9704.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 8.3.Loplncai.exe.5a9704.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 8.3.Loplncai.exe.5a9704.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.3.Kegnnphk.exe.7c956c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 4.3.Kegnnphk.exe.7c956c.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.3.Kegnnphk.exe.7c956c.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 4.3.Kegnnphk.exe.7c956c.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 4.3.Kegnnphk.exe.7c956c.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 30.3.Pnkdgk32.exe.73956c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 30.3.Pnkdgk32.exe.73956c.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 30.3.Pnkdgk32.exe.73956c.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 30.3.Pnkdgk32.exe.73956c.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 30.3.Pnkdgk32.exe.73956c.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 29.3.Onigbk32.exe.6aa354.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 29.3.Onigbk32.exe.6aa354.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 29.3.Onigbk32.exe.6aa354.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 29.3.Onigbk32.exe.6aa354.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 24.3.Oiehie32.exe.74a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 24.3.Oiehie32.exe.74a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 24.3.Oiehie32.exe.74a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 24.3.Oiehie32.exe.74a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 15.3.Mfhplllf.exe.4ea6cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 15.3.Mfhplllf.exe.4ea6cc.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 15.3.Mfhplllf.exe.4ea6cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 15.3.Mfhplllf.exe.4ea6cc.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 38.3.Boepdgoi.exe.5c956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 38.3.Boepdgoi.exe.5c956c.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 38.3.Boepdgoi.exe.5c956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 38.3.Boepdgoi.exe.5c956c.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 5.3.Knccbbff.exe.57956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 5.3.Knccbbff.exe.57956c.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 5.3.Knccbbff.exe.57956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 5.3.Knccbbff.exe.57956c.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 31.3.Plaafobm.exe.81956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 31.3.Plaafobm.exe.81956c.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 31.3.Plaafobm.exe.81956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 31.3.Plaafobm.exe.81956c.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 1.3.f6t9qa761D.exe.4d973c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 1.3.f6t9qa761D.exe.4d973c.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 1.3.f6t9qa761D.exe.4d973c.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 1.3.f6t9qa761D.exe.4d973c.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 20.3.Ninbhfea.exe.7ea344.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 20.3.Ninbhfea.exe.7ea344.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 20.3.Ninbhfea.exe.7ea344.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 20.3.Ninbhfea.exe.7ea344.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 8.3.Loplncai.exe.5a9704.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 8.3.Loplncai.exe.5a9704.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 8.3.Loplncai.exe.5a9704.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 8.3.Loplncai.exe.5a9704.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 11.3.Mddjfiih.exe.5ca984.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 11.3.Mddjfiih.exe.5ca984.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.3.Mddjfiih.exe.5ca984.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 11.3.Mddjfiih.exe.5ca984.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 11.3.Mddjfiih.exe.5ca984.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 32.3.Plfjan32.exe.67956c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 32.3.Plfjan32.exe.67956c.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 32.3.Plfjan32.exe.67956c.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 32.3.Plfjan32.exe.67956c.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 32.3.Plfjan32.exe.67956c.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 14.3.Mdicai32.exe.7fa354.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 14.3.Mdicai32.exe.7fa354.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 14.3.Mdicai32.exe.7fa354.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 14.3.Mdicai32.exe.7fa354.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 28.3.Ofmbni32.exe.48a5d4.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 28.3.Ofmbni32.exe.48a5d4.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 28.3.Ofmbni32.exe.48a5d4.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 28.3.Ofmbni32.exe.48a5d4.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 10.3.Mhmiah32.exe.5ea1dc.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 10.3.Mhmiah32.exe.5ea1dc.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.3.Nfacbjdk.exe.6197d4.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 10.3.Mhmiah32.exe.5ea1dc.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 21.3.Nfacbjdk.exe.6197d4.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 21.3.Nfacbjdk.exe.6197d4.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 21.3.Nfacbjdk.exe.6197d4.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 10.3.Mhmiah32.exe.5ea1dc.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 10.3.Mhmiah32.exe.5ea1dc.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 18.3.Nfmigk32.exe.63a1cc.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 18.3.Nfmigk32.exe.63a1cc.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.3.Nfmigk32.exe.63a1cc.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 18.3.Nfmigk32.exe.63a1cc.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 18.3.Nfmigk32.exe.63a1cc.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 10.3.Mhmiah32.exe.5ea1dc.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 10.3.Mhmiah32.exe.5ea1dc.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 10.3.Mhmiah32.exe.5ea1dc.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 10.3.Mhmiah32.exe.5ea1dc.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 12.3.Mbhkpnhb.exe.4e9744.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 12.3.Mbhkpnhb.exe.4e9744.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.3.Mbhkpnhb.exe.4e9744.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 12.3.Mbhkpnhb.exe.4e9744.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 12.3.Mbhkpnhb.exe.4e9744.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 7.3.Kkipaf32.exe.61956c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 7.3.Kkipaf32.exe.61956c.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.3.Kkipaf32.exe.61956c.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 7.3.Kkipaf32.exe.61956c.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 7.3.Kkipaf32.exe.61956c.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 26.3.Oleakplj.exe.6b908c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 26.3.Oleakplj.exe.6b908c.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 26.3.Oleakplj.exe.6b908c.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 26.3.Oleakplj.exe.6b908c.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 26.3.Oleakplj.exe.6b908c.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 1.3.f6t9qa761D.exe.4d973c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 1.3.f6t9qa761D.exe.4d973c.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.3.f6t9qa761D.exe.4d973c.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 1.3.f6t9qa761D.exe.4d973c.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 1.3.f6t9qa761D.exe.4d973c.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 36.3.Aiejgqbd.exe.6aa334.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 36.3.Aiejgqbd.exe.6aa334.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 36.3.Aiejgqbd.exe.6aa334.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 36.3.Aiejgqbd.exe.6aa334.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 36.3.Aiejgqbd.exe.6aa334.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 35.3.Apmfnklc.exe.52967c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 35.3.Apmfnklc.exe.52967c.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 35.3.Apmfnklc.exe.52967c.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 35.3.Apmfnklc.exe.52967c.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 35.3.Apmfnklc.exe.52967c.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 26.3.Oleakplj.exe.6b908c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 26.3.Oleakplj.exe.6b908c.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 26.3.Oleakplj.exe.6b908c.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 26.3.Oleakplj.exe.6b908c.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 33.3.Abgiogom.exe.519824.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 34.3.Afeaee32.exe.6aa1cc.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 33.3.Abgiogom.exe.519824.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 33.3.Abgiogom.exe.519824.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 34.3.Afeaee32.exe.6aa1cc.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.3.Afeaee32.exe.6aa1cc.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 33.3.Abgiogom.exe.519824.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 33.3.Abgiogom.exe.519824.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 34.3.Afeaee32.exe.6aa1cc.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 34.3.Afeaee32.exe.6aa1cc.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 38.3.Boepdgoi.exe.5c956c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 38.3.Boepdgoi.exe.5c956c.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 38.3.Boepdgoi.exe.5c956c.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 38.3.Boepdgoi.exe.5c956c.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 38.3.Boepdgoi.exe.5c956c.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 35.3.Apmfnklc.exe.52967c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 35.3.Apmfnklc.exe.52967c.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 35.3.Apmfnklc.exe.52967c.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 35.3.Apmfnklc.exe.52967c.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 14.3.Mdicai32.exe.7fa354.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 14.3.Mdicai32.exe.7fa354.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.3.Mdicai32.exe.7fa354.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 14.3.Mdicai32.exe.7fa354.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 14.3.Mdicai32.exe.7fa354.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 25.3.Obmmbkej.exe.61956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 25.3.Obmmbkej.exe.61956c.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 25.3.Obmmbkej.exe.61956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 25.3.Obmmbkej.exe.61956c.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 18.3.Nfmigk32.exe.63a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 18.3.Nfmigk32.exe.63a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 18.3.Nfmigk32.exe.63a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 18.3.Nfmigk32.exe.63a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 33.3.Abgiogom.exe.519824.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 33.3.Abgiogom.exe.519824.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 33.3.Abgiogom.exe.519824.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 33.3.Abgiogom.exe.519824.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 6.3.Kkgclgep.exe.4fa5d4.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 6.3.Kkgclgep.exe.4fa5d4.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 6.3.Kkgclgep.exe.4fa5d4.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 6.3.Kkgclgep.exe.4fa5d4.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 20.3.Ninbhfea.exe.7ea344.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 20.3.Ninbhfea.exe.7ea344.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 20.3.Ninbhfea.exe.7ea344.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 20.3.Ninbhfea.exe.7ea344.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 20.3.Ninbhfea.exe.7ea344.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 4.3.Kegnnphk.exe.7c956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 4.3.Kegnnphk.exe.7c956c.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 4.3.Kegnnphk.exe.7c956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 4.3.Kegnnphk.exe.7c956c.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 22.3.Npjgkp32.exe.52a33c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 22.3.Npjgkp32.exe.52a33c.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 22.3.Npjgkp32.exe.52a33c.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 22.3.Npjgkp32.exe.52a33c.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 22.3.Npjgkp32.exe.52a33c.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 31.3.Plaafobm.exe.81956c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 31.3.Plaafobm.exe.81956c.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 31.3.Plaafobm.exe.81956c.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 31.3.Plaafobm.exe.81956c.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 31.3.Plaafobm.exe.81956c.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 17.3.Nmdeneap.exe.61a1cc.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 17.3.Nmdeneap.exe.61a1cc.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.3.Nmdeneap.exe.61a1cc.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 17.3.Nmdeneap.exe.61a1cc.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 17.3.Nmdeneap.exe.61a1cc.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 17.3.Nmdeneap.exe.61a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 17.3.Nmdeneap.exe.61a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 17.3.Nmdeneap.exe.61a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 17.3.Nmdeneap.exe.61a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 16.3.Nncepn32.exe.61a33c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 16.3.Nncepn32.exe.61a33c.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 16.3.Nncepn32.exe.61a33c.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 16.3.Nncepn32.exe.61a33c.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 16.3.Nncepn32.exe.61a33c.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 11.3.Mddjfiih.exe.5ca984.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 11.3.Mddjfiih.exe.5ca984.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 11.3.Mddjfiih.exe.5ca984.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 11.3.Mddjfiih.exe.5ca984.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 19.3.Nnhnkmek.exe.4ea1c4.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 19.3.Nnhnkmek.exe.4ea1c4.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.3.Nnhnkmek.exe.4ea1c4.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 19.3.Nnhnkmek.exe.4ea1c4.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 19.3.Nnhnkmek.exe.4ea1c4.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 34.3.Afeaee32.exe.6aa1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 23.3.Opldpphi.exe.62a1cc.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 34.3.Afeaee32.exe.6aa1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 34.3.Afeaee32.exe.6aa1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 34.3.Afeaee32.exe.6aa1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 23.3.Opldpphi.exe.62a1cc.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 23.3.Opldpphi.exe.62a1cc.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 23.3.Opldpphi.exe.62a1cc.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 23.3.Opldpphi.exe.62a1cc.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 28.3.Ofmbni32.exe.48a5d4.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 28.3.Ofmbni32.exe.48a5d4.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 28.3.Ofmbni32.exe.48a5d4.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 28.3.Ofmbni32.exe.48a5d4.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 28.3.Ofmbni32.exe.48a5d4.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 22.3.Npjgkp32.exe.52a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 22.3.Npjgkp32.exe.52a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 22.3.Npjgkp32.exe.52a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 22.3.Npjgkp32.exe.52a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 21.3.Nfacbjdk.exe.6197d4.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 21.3.Nfacbjdk.exe.6197d4.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.3.Nfacbjdk.exe.6197d4.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 21.3.Nfacbjdk.exe.6197d4.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 21.3.Nfacbjdk.exe.6197d4.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 39.3.Bmfpbogh.exe.7a956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 39.3.Bmfpbogh.exe.7a956c.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 39.3.Bmfpbogh.exe.7a956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 39.3.Bmfpbogh.exe.7a956c.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 3.3.Jokilfca.exe.77a334.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 9.3.Mlfimg32.exe.7aa1cc.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 3.3.Jokilfca.exe.77a334.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 9.3.Mlfimg32.exe.7aa1cc.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.3.Jokilfca.exe.77a334.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 3.3.Jokilfca.exe.77a334.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 9.3.Mlfimg32.exe.7aa1cc.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 9.3.Mlfimg32.exe.7aa1cc.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 9.3.Mlfimg32.exe.7aa1cc.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 12.3.Mbhkpnhb.exe.4e9744.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 12.3.Mbhkpnhb.exe.4e9744.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 12.3.Mbhkpnhb.exe.4e9744.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 12.3.Mbhkpnhb.exe.4e9744.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 36.3.Aiejgqbd.exe.6aa334.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 36.3.Aiejgqbd.exe.6aa334.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 36.3.Aiejgqbd.exe.6aa334.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 36.3.Aiejgqbd.exe.6aa334.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 24.3.Oiehie32.exe.74a33c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 24.3.Oiehie32.exe.74a33c.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 24.3.Oiehie32.exe.74a33c.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 24.3.Oiehie32.exe.74a33c.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 24.3.Oiehie32.exe.74a33c.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 23.3.Opldpphi.exe.62a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 23.3.Opldpphi.exe.62a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 23.3.Opldpphi.exe.62a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 23.3.Opldpphi.exe.62a1cc.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 30.3.Pnkdgk32.exe.73956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 2.3.Jagibbdg.exe.53a6dc.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 30.3.Pnkdgk32.exe.73956c.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 2.3.Jagibbdg.exe.53a6dc.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 2.3.Jagibbdg.exe.53a6dc.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 2.3.Jagibbdg.exe.53a6dc.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 30.3.Pnkdgk32.exe.73956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 30.3.Pnkdgk32.exe.73956c.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 13.3.Mkqoicnb.exe.78a1dc.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 7.3.Kkipaf32.exe.61956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 13.3.Mkqoicnb.exe.78a1dc.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 7.3.Kkipaf32.exe.61956c.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 7.3.Kkipaf32.exe.61956c.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 7.3.Kkipaf32.exe.61956c.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 13.3.Mkqoicnb.exe.78a1dc.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 13.3.Mkqoicnb.exe.78a1dc.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 37.3.Abnopf32.exe.689284.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 37.3.Abnopf32.exe.689284.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 37.3.Abnopf32.exe.689284.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 37.3.Abnopf32.exe.689284.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 25.3.Obmmbkej.exe.61956c.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 25.3.Obmmbkej.exe.61956c.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 25.3.Obmmbkej.exe.61956c.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 25.3.Obmmbkej.exe.61956c.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 25.3.Obmmbkej.exe.61956c.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 16.3.Nncepn32.exe.61a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 16.3.Nncepn32.exe.61a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 16.3.Nncepn32.exe.61a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 16.3.Nncepn32.exe.61a33c.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 29.3.Onigbk32.exe.6aa354.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 29.3.Onigbk32.exe.6aa354.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 29.3.Onigbk32.exe.6aa354.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 29.3.Onigbk32.exe.6aa354.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 29.3.Onigbk32.exe.6aa354.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 19.3.Nnhnkmek.exe.4ea1c4.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 19.3.Nnhnkmek.exe.4ea1c4.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 19.3.Nnhnkmek.exe.4ea1c4.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 19.3.Nnhnkmek.exe.4ea1c4.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0000001A.00000003.1413094066.0000000000696000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0000001A.00000003.1413094066.0000000000696000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000001A.00000003.1413094066.0000000000696000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0000000D.00000003.1401676955.0000000000745000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0000000D.00000003.1401676955.0000000000745000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000000D.00000003.1401676955.0000000000745000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000015.00000003.1408558477.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000015.00000003.1408558477.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000015.00000003.1408558477.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000005.00000003.1388062598.0000000000556000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000005.00000003.1388062598.0000000000556000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000005.00000003.1388062598.0000000000556000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0000001B.00000003.1414686039.0000000000805000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0000001B.00000003.1414686039.0000000000805000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000001B.00000003.1414686039.0000000000805000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0000001E.00000003.1419724385.0000000000716000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0000001E.00000003.1419724385.0000000000716000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000001E.00000003.1419724385.0000000000716000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0000000C.00000003.1401384736.00000000004C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0000000C.00000003.1401384736.00000000004C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000000C.00000003.1401384736.00000000004C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000014.00000003.1408231486.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000014.00000003.1408231486.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000014.00000003.1408231486.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000002.00000003.1384605197.0000000000517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000002.00000003.1384605197.0000000000517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000002.00000003.1384605197.0000000000517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0000001B.00000003.1414648666.0000000000827000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0000001B.00000003.1414648666.0000000000827000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000001B.00000003.1414648666.0000000000827000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000001.00000003.1382620236.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000001.00000003.1382620236.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000001.00000003.1382620236.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0000001D.00000003.1416962414.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0000001D.00000003.1416962414.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000001D.00000003.1416962414.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000009.00000003.1398787103.0000000000787000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000009.00000003.1398787103.0000000000787000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000009.00000003.1398787103.0000000000787000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000017.00000003.1411146589.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000017.00000003.1411146589.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000017.00000003.1411146589.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000003.00000003.1385339329.0000000000736000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000003.00000003.1385339329.0000000000736000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000003.00000003.1385339329.0000000000736000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000010.00000003.1404507070.00000000005D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000010.00000003.1404507070.00000000005D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000010.00000003.1404507070.00000000005D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000006.00000003.1388400520.00000000004D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000006.00000003.1388400520.00000000004D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000006.00000003.1388400520.00000000004D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0000000B.00000003.1400431531.00000000005A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0000000B.00000003.1400431531.00000000005A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000000B.00000003.1400431531.00000000005A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0000001C.00000003.1414919528.0000000000467000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0000001C.00000003.1414919528.0000000000467000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000001C.00000003.1414919528.0000000000467000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0000000F.00000003.1403643696.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0000000F.00000003.1403643696.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000000F.00000003.1403643696.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000025.00000003.1430537589.0000000000666000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000025.00000003.1430537589.0000000000666000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000025.00000003.1430537589.0000000000666000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000024.00000003.1429745266.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000024.00000003.1429745266.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000024.00000003.1429745266.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0000001D.00000003.1416821350.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0000001D.00000003.1416821350.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000001D.00000003.1416821350.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000017.00000003.1411099654.0000000000607000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000017.00000003.1411099654.0000000000607000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000017.00000003.1411099654.0000000000607000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000008.00000003.1397065400.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000023.00000003.1428633163.0000000000506000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000008.00000003.1397065400.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000023.00000003.1428633163.0000000000506000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000023.00000003.1428633163.0000000000506000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000008.00000003.1397065400.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000012.00000003.1406624266.0000000000617000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000012.00000003.1406624266.0000000000617000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000012.00000003.1406624266.0000000000617000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0000000E.00000003.1403408472.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0000000E.00000003.1403408472.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000000E.00000003.1403408472.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000018.00000003.1411928431.0000000000727000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000018.00000003.1411928431.0000000000727000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000018.00000003.1411928431.0000000000727000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000002.00000003.1383486321.0000000000517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000002.00000003.1383486321.0000000000517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000002.00000003.1383486321.0000000000517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000003.00000003.1385969006.0000000000757000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000003.00000003.1385969006.0000000000757000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000003.00000003.1385969006.0000000000757000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000022.00000003.1427802477.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000022.00000003.1427802477.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000022.00000003.1427802477.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000018.00000003.1411397694.0000000000706000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000018.00000003.1411397694.0000000000706000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000018.00000003.1411397694.0000000000706000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000014.00000003.1407697621.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000014.00000003.1407697621.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000014.00000003.1407697621.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000020.00000003.1426128043.0000000000656000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000020.00000003.1426128043.0000000000656000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000020.00000003.1426128043.0000000000656000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000013.00000003.1407230240.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000013.00000003.1407230240.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000013.00000003.1407230240.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0000000D.00000003.1402396137.0000000000767000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0000000D.00000003.1402396137.0000000000767000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000000D.00000003.1402396137.0000000000767000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0000000A.00000003.1399746300.00000000005C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0000000A.00000003.1399746300.00000000005C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000000A.00000003.1399746300.00000000005C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000006.00000003.1390029708.00000000004D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000006.00000003.1390029708.00000000004D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000006.00000003.1390029708.00000000004D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000022.00000003.1427760940.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000022.00000003.1427760940.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000022.00000003.1427760940.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000011.00000003.1405915319.00000000005D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000011.00000003.1405915319.00000000005D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000011.00000003.1405915319.00000000005D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000001.00000003.1383183359.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000001.00000003.1383183359.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000001.00000003.1383183359.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000021.00000003.1426482415.00000000004F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000021.00000003.1426482415.00000000004F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000021.00000003.1426482415.00000000004F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000024.00000003.1429702535.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000024.00000003.1429702535.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000024.00000003.1429702535.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000010.00000003.1404835697.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000010.00000003.1404835697.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000010.00000003.1404835697.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0000000B.00000003.1400042225.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0000000B.00000003.1400042225.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000000B.00000003.1400042225.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0000001F.00000003.1424740554.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0000001F.00000003.1424740554.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000001F.00000003.1424740554.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000012.00000003.1406660618.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000012.00000003.1406660618.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000012.00000003.1406660618.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000009.00000003.1398838683.0000000000765000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: classification engine Classification label: mal100.troj.evad.winEXE@78/79@0/0
Source: f6t9qa761D.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Users\user\Desktop\f6t9qa761D.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: f6t9qa761D.exe Virustotal: Detection: 91%
Source: f6t9qa761D.exe ReversingLabs: Detection: 100%
Source: C:\Users\user\Desktop\f6t9qa761D.exe File read: C:\Users\user\Desktop\f6t9qa761D.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\f6t9qa761D.exe "C:\Users\user\Desktop\f6t9qa761D.exe"
Source: C:\Users\user\Desktop\f6t9qa761D.exe Process created: C:\Windows\SysWOW64\Jagibbdg.exe C:\Windows\system32\Jagibbdg.exe
Source: C:\Windows\SysWOW64\Jagibbdg.exe Process created: C:\Windows\SysWOW64\Jokilfca.exe C:\Windows\system32\Jokilfca.exe
Source: C:\Windows\SysWOW64\Jokilfca.exe Process created: C:\Windows\SysWOW64\Kegnnphk.exe C:\Windows\system32\Kegnnphk.exe
Source: C:\Windows\SysWOW64\Kegnnphk.exe Process created: C:\Windows\SysWOW64\Knccbbff.exe C:\Windows\system32\Knccbbff.exe
Source: C:\Windows\SysWOW64\Knccbbff.exe Process created: C:\Windows\SysWOW64\Kkgclgep.exe C:\Windows\system32\Kkgclgep.exe
Source: C:\Windows\SysWOW64\Kkgclgep.exe Process created: C:\Windows\SysWOW64\Kkipaf32.exe C:\Windows\system32\Kkipaf32.exe
Source: C:\Windows\SysWOW64\Kkipaf32.exe Process created: C:\Windows\SysWOW64\Loplncai.exe C:\Windows\system32\Loplncai.exe
Source: C:\Windows\SysWOW64\Loplncai.exe Process created: C:\Windows\SysWOW64\Mlfimg32.exe C:\Windows\system32\Mlfimg32.exe
Source: C:\Windows\SysWOW64\Mlfimg32.exe Process created: C:\Windows\SysWOW64\Mhmiah32.exe C:\Windows\system32\Mhmiah32.exe
Source: C:\Windows\SysWOW64\Mhmiah32.exe Process created: C:\Windows\SysWOW64\Mddjfiih.exe C:\Windows\system32\Mddjfiih.exe
Source: C:\Windows\SysWOW64\Mddjfiih.exe Process created: C:\Windows\SysWOW64\Mbhkpnhb.exe C:\Windows\system32\Mbhkpnhb.exe
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Process created: C:\Windows\SysWOW64\Mkqoicnb.exe C:\Windows\system32\Mkqoicnb.exe
Source: C:\Windows\SysWOW64\Mkqoicnb.exe Process created: C:\Windows\SysWOW64\Mdicai32.exe C:\Windows\system32\Mdicai32.exe
Source: C:\Windows\SysWOW64\Mdicai32.exe Process created: C:\Windows\SysWOW64\Mfhplllf.exe C:\Windows\system32\Mfhplllf.exe
Source: C:\Windows\SysWOW64\Mfhplllf.exe Process created: C:\Windows\SysWOW64\Nncepn32.exe C:\Windows\system32\Nncepn32.exe
Source: C:\Windows\SysWOW64\Nncepn32.exe Process created: C:\Windows\SysWOW64\Nmdeneap.exe C:\Windows\system32\Nmdeneap.exe
Source: C:\Windows\SysWOW64\Nmdeneap.exe Process created: C:\Windows\SysWOW64\Nfmigk32.exe C:\Windows\system32\Nfmigk32.exe
Source: C:\Windows\SysWOW64\Nfmigk32.exe Process created: C:\Windows\SysWOW64\Nnhnkmek.exe C:\Windows\system32\Nnhnkmek.exe
Source: C:\Windows\SysWOW64\Nnhnkmek.exe Process created: C:\Windows\SysWOW64\Ninbhfea.exe C:\Windows\system32\Ninbhfea.exe
Source: C:\Windows\SysWOW64\Ninbhfea.exe Process created: C:\Windows\SysWOW64\Nfacbjdk.exe C:\Windows\system32\Nfacbjdk.exe
Source: C:\Windows\SysWOW64\Nfacbjdk.exe Process created: C:\Windows\SysWOW64\Npjgkp32.exe C:\Windows\system32\Npjgkp32.exe
Source: C:\Windows\SysWOW64\Npjgkp32.exe Process created: C:\Windows\SysWOW64\Opldpphi.exe C:\Windows\system32\Opldpphi.exe
Source: C:\Windows\SysWOW64\Opldpphi.exe Process created: C:\Windows\SysWOW64\Oiehie32.exe C:\Windows\system32\Oiehie32.exe
Source: C:\Windows\SysWOW64\Oiehie32.exe Process created: C:\Windows\SysWOW64\Obmmbkej.exe C:\Windows\system32\Obmmbkej.exe
Source: C:\Windows\SysWOW64\Obmmbkej.exe Process created: C:\Windows\SysWOW64\Oleakplj.exe C:\Windows\system32\Oleakplj.exe
Source: C:\Windows\SysWOW64\Oleakplj.exe Process created: C:\Windows\SysWOW64\Oiibddkd.exe C:\Windows\system32\Oiibddkd.exe
Source: C:\Windows\SysWOW64\Oiibddkd.exe Process created: C:\Windows\SysWOW64\Ofmbni32.exe C:\Windows\system32\Ofmbni32.exe
Source: C:\Windows\SysWOW64\Ofmbni32.exe Process created: C:\Windows\SysWOW64\Onigbk32.exe C:\Windows\system32\Onigbk32.exe
Source: C:\Windows\SysWOW64\Onigbk32.exe Process created: C:\Windows\SysWOW64\Pnkdgk32.exe C:\Windows\system32\Pnkdgk32.exe
Source: C:\Windows\SysWOW64\Pnkdgk32.exe Process created: C:\Windows\SysWOW64\Plaafobm.exe C:\Windows\system32\Plaafobm.exe
Source: C:\Windows\SysWOW64\Plaafobm.exe Process created: C:\Windows\SysWOW64\Plfjan32.exe C:\Windows\system32\Plfjan32.exe
Source: C:\Windows\SysWOW64\Plfjan32.exe Process created: C:\Windows\SysWOW64\Abgiogom.exe C:\Windows\system32\Abgiogom.exe
Source: C:\Windows\SysWOW64\Abgiogom.exe Process created: C:\Windows\SysWOW64\Afeaee32.exe C:\Windows\system32\Afeaee32.exe
Source: C:\Windows\SysWOW64\Afeaee32.exe Process created: C:\Windows\SysWOW64\Apmfnklc.exe C:\Windows\system32\Apmfnklc.exe
Source: C:\Windows\SysWOW64\Apmfnklc.exe Process created: C:\Windows\SysWOW64\Aiejgqbd.exe C:\Windows\system32\Aiejgqbd.exe
Source: C:\Windows\SysWOW64\Aiejgqbd.exe Process created: C:\Windows\SysWOW64\Abnopf32.exe C:\Windows\system32\Abnopf32.exe
Source: C:\Windows\SysWOW64\Abnopf32.exe Process created: C:\Windows\SysWOW64\Boepdgoi.exe C:\Windows\system32\Boepdgoi.exe
Source: C:\Windows\SysWOW64\Boepdgoi.exe Process created: C:\Windows\SysWOW64\Bmfpbogh.exe C:\Windows\system32\Bmfpbogh.exe
Source: C:\Users\user\Desktop\f6t9qa761D.exe Process created: C:\Windows\SysWOW64\Jagibbdg.exe C:\Windows\system32\Jagibbdg.exe Jump to behavior
Source: C:\Windows\SysWOW64\Jagibbdg.exe Process created: C:\Windows\SysWOW64\Jokilfca.exe C:\Windows\system32\Jokilfca.exe Jump to behavior
Source: C:\Windows\SysWOW64\Jokilfca.exe Process created: C:\Windows\SysWOW64\Kegnnphk.exe C:\Windows\system32\Kegnnphk.exe Jump to behavior
Source: C:\Windows\SysWOW64\Kegnnphk.exe Process created: C:\Windows\SysWOW64\Knccbbff.exe C:\Windows\system32\Knccbbff.exe Jump to behavior
Source: C:\Windows\SysWOW64\Knccbbff.exe Process created: C:\Windows\SysWOW64\Kkgclgep.exe C:\Windows\system32\Kkgclgep.exe Jump to behavior
Source: C:\Windows\SysWOW64\Kkgclgep.exe Process created: C:\Windows\SysWOW64\Kkipaf32.exe C:\Windows\system32\Kkipaf32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Kkipaf32.exe Process created: C:\Windows\SysWOW64\Loplncai.exe C:\Windows\system32\Loplncai.exe Jump to behavior
Source: C:\Windows\SysWOW64\Loplncai.exe Process created: C:\Windows\SysWOW64\Mlfimg32.exe C:\Windows\system32\Mlfimg32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Mlfimg32.exe Process created: C:\Windows\SysWOW64\Mhmiah32.exe C:\Windows\system32\Mhmiah32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Mhmiah32.exe Process created: C:\Windows\SysWOW64\Mddjfiih.exe C:\Windows\system32\Mddjfiih.exe Jump to behavior
Source: C:\Windows\SysWOW64\Mddjfiih.exe Process created: C:\Windows\SysWOW64\Mbhkpnhb.exe C:\Windows\system32\Mbhkpnhb.exe Jump to behavior
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Process created: C:\Windows\SysWOW64\Mkqoicnb.exe C:\Windows\system32\Mkqoicnb.exe Jump to behavior
Source: C:\Windows\SysWOW64\Mkqoicnb.exe Process created: C:\Windows\SysWOW64\Mdicai32.exe C:\Windows\system32\Mdicai32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Mdicai32.exe Process created: C:\Windows\SysWOW64\Mfhplllf.exe C:\Windows\system32\Mfhplllf.exe Jump to behavior
Source: C:\Windows\SysWOW64\Mfhplllf.exe Process created: C:\Windows\SysWOW64\Nncepn32.exe C:\Windows\system32\Nncepn32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Nncepn32.exe Process created: C:\Windows\SysWOW64\Nmdeneap.exe C:\Windows\system32\Nmdeneap.exe Jump to behavior
Source: C:\Windows\SysWOW64\Nmdeneap.exe Process created: C:\Windows\SysWOW64\Nfmigk32.exe C:\Windows\system32\Nfmigk32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Nfmigk32.exe Process created: C:\Windows\SysWOW64\Nnhnkmek.exe C:\Windows\system32\Nnhnkmek.exe Jump to behavior
Source: C:\Windows\SysWOW64\Nnhnkmek.exe Process created: C:\Windows\SysWOW64\Ninbhfea.exe C:\Windows\system32\Ninbhfea.exe Jump to behavior
Source: C:\Windows\SysWOW64\Ninbhfea.exe Process created: C:\Windows\SysWOW64\Nfacbjdk.exe C:\Windows\system32\Nfacbjdk.exe Jump to behavior
Source: C:\Windows\SysWOW64\Nfacbjdk.exe Process created: C:\Windows\SysWOW64\Npjgkp32.exe C:\Windows\system32\Npjgkp32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Npjgkp32.exe Process created: C:\Windows\SysWOW64\Opldpphi.exe C:\Windows\system32\Opldpphi.exe Jump to behavior
Source: C:\Windows\SysWOW64\Opldpphi.exe Process created: C:\Windows\SysWOW64\Oiehie32.exe C:\Windows\system32\Oiehie32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Oiehie32.exe Process created: C:\Windows\SysWOW64\Obmmbkej.exe C:\Windows\system32\Obmmbkej.exe Jump to behavior
Source: C:\Windows\SysWOW64\Obmmbkej.exe Process created: C:\Windows\SysWOW64\Oleakplj.exe C:\Windows\system32\Oleakplj.exe Jump to behavior
Source: C:\Windows\SysWOW64\Oleakplj.exe Process created: C:\Windows\SysWOW64\Oiibddkd.exe C:\Windows\system32\Oiibddkd.exe Jump to behavior
Source: C:\Windows\SysWOW64\Oiibddkd.exe Process created: C:\Windows\SysWOW64\Ofmbni32.exe C:\Windows\system32\Ofmbni32.exe
Source: C:\Windows\SysWOW64\Ofmbni32.exe Process created: C:\Windows\SysWOW64\Onigbk32.exe C:\Windows\system32\Onigbk32.exe
Source: C:\Windows\SysWOW64\Onigbk32.exe Process created: C:\Windows\SysWOW64\Pnkdgk32.exe C:\Windows\system32\Pnkdgk32.exe
Source: C:\Windows\SysWOW64\Pnkdgk32.exe Process created: C:\Windows\SysWOW64\Plaafobm.exe C:\Windows\system32\Plaafobm.exe
Source: C:\Windows\SysWOW64\Plaafobm.exe Process created: C:\Windows\SysWOW64\Plfjan32.exe C:\Windows\system32\Plfjan32.exe
Source: C:\Windows\SysWOW64\Plfjan32.exe Process created: C:\Windows\SysWOW64\Abgiogom.exe C:\Windows\system32\Abgiogom.exe
Source: C:\Windows\SysWOW64\Abgiogom.exe Process created: C:\Windows\SysWOW64\Afeaee32.exe C:\Windows\system32\Afeaee32.exe
Source: C:\Windows\SysWOW64\Afeaee32.exe Process created: C:\Windows\SysWOW64\Apmfnklc.exe C:\Windows\system32\Apmfnklc.exe
Source: C:\Windows\SysWOW64\Apmfnklc.exe Process created: C:\Windows\SysWOW64\Aiejgqbd.exe C:\Windows\system32\Aiejgqbd.exe
Source: C:\Windows\SysWOW64\Aiejgqbd.exe Process created: C:\Windows\SysWOW64\Abnopf32.exe C:\Windows\system32\Abnopf32.exe
Source: C:\Windows\SysWOW64\Abnopf32.exe Process created: C:\Windows\SysWOW64\Boepdgoi.exe C:\Windows\system32\Boepdgoi.exe
Source: C:\Windows\SysWOW64\Boepdgoi.exe Process created: C:\Windows\SysWOW64\Bmfpbogh.exe C:\Windows\system32\Bmfpbogh.exe
Source: C:\Windows\SysWOW64\Bmfpbogh.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\f6t9qa761D.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\f6t9qa761D.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\f6t9qa761D.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Users\user\Desktop\f6t9qa761D.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Jagibbdg.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Jagibbdg.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Jagibbdg.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Jagibbdg.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Jokilfca.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Jokilfca.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Jokilfca.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Jokilfca.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Kegnnphk.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Kegnnphk.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Kegnnphk.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Kegnnphk.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Knccbbff.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Knccbbff.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Knccbbff.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Knccbbff.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Kkgclgep.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Kkgclgep.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Kkgclgep.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Kkgclgep.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Kkipaf32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Kkipaf32.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Kkipaf32.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Kkipaf32.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Loplncai.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Loplncai.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Loplncai.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Loplncai.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mlfimg32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mlfimg32.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mlfimg32.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mlfimg32.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mhmiah32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mhmiah32.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mhmiah32.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mhmiah32.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mddjfiih.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mddjfiih.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mddjfiih.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mddjfiih.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mkqoicnb.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mkqoicnb.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mkqoicnb.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mkqoicnb.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mdicai32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mdicai32.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mdicai32.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mdicai32.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mfhplllf.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mfhplllf.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mfhplllf.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Mfhplllf.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nncepn32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nncepn32.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nncepn32.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nncepn32.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nmdeneap.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nmdeneap.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nmdeneap.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nmdeneap.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nfmigk32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nfmigk32.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nfmigk32.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nfmigk32.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nnhnkmek.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nnhnkmek.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nnhnkmek.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nnhnkmek.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Ninbhfea.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Ninbhfea.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Ninbhfea.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Ninbhfea.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nfacbjdk.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nfacbjdk.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nfacbjdk.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Nfacbjdk.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Npjgkp32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Npjgkp32.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Npjgkp32.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Npjgkp32.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Opldpphi.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Opldpphi.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Opldpphi.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Opldpphi.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Oiehie32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Oiehie32.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Oiehie32.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Oiehie32.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Obmmbkej.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Obmmbkej.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Obmmbkej.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Obmmbkej.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Oleakplj.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\Oleakplj.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\Oleakplj.exe Section loaded: crtdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\Oleakplj.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\Oiibddkd.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Oiibddkd.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Oiibddkd.exe Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Oiibddkd.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Ofmbni32.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Ofmbni32.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Ofmbni32.exe Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Ofmbni32.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Onigbk32.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Onigbk32.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Onigbk32.exe Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Onigbk32.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Pnkdgk32.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Pnkdgk32.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Pnkdgk32.exe Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Pnkdgk32.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Plaafobm.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Plaafobm.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Plaafobm.exe Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Plaafobm.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Plfjan32.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Plfjan32.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Plfjan32.exe Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Plfjan32.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Abgiogom.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Abgiogom.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Abgiogom.exe Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Abgiogom.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Afeaee32.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Afeaee32.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Afeaee32.exe Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Afeaee32.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Apmfnklc.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Apmfnklc.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Apmfnklc.exe Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Apmfnklc.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Aiejgqbd.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Aiejgqbd.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Aiejgqbd.exe Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Aiejgqbd.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Abnopf32.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Abnopf32.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Abnopf32.exe Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Abnopf32.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Boepdgoi.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Boepdgoi.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Boepdgoi.exe Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Boepdgoi.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Bmfpbogh.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Bmfpbogh.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Bmfpbogh.exe Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Bmfpbogh.exe Section loaded: ntmarta.dll
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .fldo
PE file contains sections with non-standard names
Source: f6t9qa761D.exe Static PE information: section name: .fldo
Source: f6t9qa761D.exe Static PE information: section name: .l1
Source: Jagibbdg.exe.1.dr Static PE information: section name: .fldo
Source: Jagibbdg.exe.1.dr Static PE information: section name: .l1
Source: Jokilfca.exe.2.dr Static PE information: section name: .fldo
Source: Jokilfca.exe.2.dr Static PE information: section name: .l1
Source: Kegnnphk.exe.3.dr Static PE information: section name: .fldo
Source: Kegnnphk.exe.3.dr Static PE information: section name: .l1
Source: Knccbbff.exe.4.dr Static PE information: section name: .fldo
Source: Knccbbff.exe.4.dr Static PE information: section name: .l1
Source: Kkgclgep.exe.5.dr Static PE information: section name: .fldo
Source: Kkgclgep.exe.5.dr Static PE information: section name: .l1
Source: Kkipaf32.exe.6.dr Static PE information: section name: .fldo
Source: Kkipaf32.exe.6.dr Static PE information: section name: .l1
Source: Loplncai.exe.7.dr Static PE information: section name: .fldo
Source: Loplncai.exe.7.dr Static PE information: section name: .l1
Source: Mlfimg32.exe.8.dr Static PE information: section name: .fldo
Source: Mlfimg32.exe.8.dr Static PE information: section name: .l1
Source: Mhmiah32.exe.9.dr Static PE information: section name: .fldo
Source: Mhmiah32.exe.9.dr Static PE information: section name: .l1
Source: Mddjfiih.exe.10.dr Static PE information: section name: .fldo
Source: Mddjfiih.exe.10.dr Static PE information: section name: .l1
Source: Mbhkpnhb.exe.11.dr Static PE information: section name: .fldo
Source: Mbhkpnhb.exe.11.dr Static PE information: section name: .l1
Source: Mkqoicnb.exe.12.dr Static PE information: section name: .fldo
Source: Mkqoicnb.exe.12.dr Static PE information: section name: .l1
Source: Mdicai32.exe.13.dr Static PE information: section name: .fldo
Source: Mdicai32.exe.13.dr Static PE information: section name: .l1
Source: Mfhplllf.exe.14.dr Static PE information: section name: .fldo
Source: Mfhplllf.exe.14.dr Static PE information: section name: .l1
Source: Nncepn32.exe.15.dr Static PE information: section name: .fldo
Source: Nncepn32.exe.15.dr Static PE information: section name: .l1
Source: Nmdeneap.exe.16.dr Static PE information: section name: .fldo
Source: Nmdeneap.exe.16.dr Static PE information: section name: .l1
Source: Nfmigk32.exe.17.dr Static PE information: section name: .fldo
Source: Nfmigk32.exe.17.dr Static PE information: section name: .l1
Source: Nnhnkmek.exe.18.dr Static PE information: section name: .fldo
Source: Nnhnkmek.exe.18.dr Static PE information: section name: .l1
Source: Ninbhfea.exe.19.dr Static PE information: section name: .fldo
Source: Ninbhfea.exe.19.dr Static PE information: section name: .l1
Source: Nfacbjdk.exe.20.dr Static PE information: section name: .fldo
Source: Nfacbjdk.exe.20.dr Static PE information: section name: .l1
Source: Npjgkp32.exe.21.dr Static PE information: section name: .fldo
Source: Npjgkp32.exe.21.dr Static PE information: section name: .l1
Source: Opldpphi.exe.22.dr Static PE information: section name: .fldo
Source: Opldpphi.exe.22.dr Static PE information: section name: .l1
Source: Oiehie32.exe.23.dr Static PE information: section name: .fldo
Source: Oiehie32.exe.23.dr Static PE information: section name: .l1
Source: Obmmbkej.exe.24.dr Static PE information: section name: .fldo
Source: Obmmbkej.exe.24.dr Static PE information: section name: .l1
Source: Oleakplj.exe.25.dr Static PE information: section name: .fldo
Source: Oleakplj.exe.25.dr Static PE information: section name: .l1
Source: Oiibddkd.exe.26.dr Static PE information: section name: .fldo
Source: Oiibddkd.exe.26.dr Static PE information: section name: .l1
Source: Ofmbni32.exe.27.dr Static PE information: section name: .fldo
Source: Ofmbni32.exe.27.dr Static PE information: section name: .l1
Source: Onigbk32.exe.28.dr Static PE information: section name: .fldo
Source: Onigbk32.exe.28.dr Static PE information: section name: .l1
Source: Pnkdgk32.exe.29.dr Static PE information: section name: .fldo
Source: Pnkdgk32.exe.29.dr Static PE information: section name: .l1
Source: Plaafobm.exe.30.dr Static PE information: section name: .fldo
Source: Plaafobm.exe.30.dr Static PE information: section name: .l1
Source: Plfjan32.exe.31.dr Static PE information: section name: .fldo
Source: Plfjan32.exe.31.dr Static PE information: section name: .l1
Source: Abgiogom.exe.32.dr Static PE information: section name: .fldo
Source: Abgiogom.exe.32.dr Static PE information: section name: .l1
Source: Afeaee32.exe.33.dr Static PE information: section name: .fldo
Source: Afeaee32.exe.33.dr Static PE information: section name: .l1
Source: Apmfnklc.exe.34.dr Static PE information: section name: .fldo
Source: Apmfnklc.exe.34.dr Static PE information: section name: .l1
Source: Aiejgqbd.exe.35.dr Static PE information: section name: .fldo
Source: Aiejgqbd.exe.35.dr Static PE information: section name: .l1
Source: Abnopf32.exe.36.dr Static PE information: section name: .fldo
Source: Abnopf32.exe.36.dr Static PE information: section name: .l1
Source: Boepdgoi.exe.37.dr Static PE information: section name: .fldo
Source: Boepdgoi.exe.37.dr Static PE information: section name: .l1
Source: Bmfpbogh.exe.38.dr Static PE information: section name: .fldo
Source: Bmfpbogh.exe.38.dr Static PE information: section name: .l1
Source: Beadgadc.exe.39.dr Static PE information: section name: .fldo
Source: Beadgadc.exe.39.dr Static PE information: section name: .l1
Source: f6t9qa761D.exe Static PE information: section name: .text entropy: 7.129435722610816
Source: Jagibbdg.exe.1.dr Static PE information: section name: .text entropy: 7.162455714032348
Source: Jokilfca.exe.2.dr Static PE information: section name: .text entropy: 7.15982708692499
Source: Kegnnphk.exe.3.dr Static PE information: section name: .text entropy: 7.162131595786184
Source: Knccbbff.exe.4.dr Static PE information: section name: .text entropy: 7.16380020135791
Source: Kkgclgep.exe.5.dr Static PE information: section name: .text entropy: 7.199588493733589
Source: Kkipaf32.exe.6.dr Static PE information: section name: .text entropy: 7.158411480101382
Source: Loplncai.exe.7.dr Static PE information: section name: .text entropy: 7.111314339012284
Source: Mlfimg32.exe.8.dr Static PE information: section name: .text entropy: 7.20545575363383
Source: Mhmiah32.exe.9.dr Static PE information: section name: .text entropy: 7.111854620392808
Source: Mddjfiih.exe.10.dr Static PE information: section name: .text entropy: 7.17622940485195
Source: Mbhkpnhb.exe.11.dr Static PE information: section name: .text entropy: 7.161093985501556
Source: Mkqoicnb.exe.12.dr Static PE information: section name: .text entropy: 6.949372414467907
Source: Mdicai32.exe.13.dr Static PE information: section name: .text entropy: 7.183156955694525
Source: Mfhplllf.exe.14.dr Static PE information: section name: .text entropy: 7.181495996708354
Source: Nncepn32.exe.15.dr Static PE information: section name: .text entropy: 7.152756617942734
Source: Nmdeneap.exe.16.dr Static PE information: section name: .text entropy: 7.174675474540074
Source: Nfmigk32.exe.17.dr Static PE information: section name: .text entropy: 7.13576525796639
Source: Nnhnkmek.exe.18.dr Static PE information: section name: .text entropy: 7.159687221034241
Source: Ninbhfea.exe.19.dr Static PE information: section name: .text entropy: 7.168950881448808
Source: Nfacbjdk.exe.20.dr Static PE information: section name: .text entropy: 6.915128603158092
Source: Npjgkp32.exe.21.dr Static PE information: section name: .text entropy: 7.099734896483985
Source: Opldpphi.exe.22.dr Static PE information: section name: .text entropy: 7.160455727491319
Source: Oiehie32.exe.23.dr Static PE information: section name: .text entropy: 6.969272790137508
Source: Obmmbkej.exe.24.dr Static PE information: section name: .text entropy: 7.119068507640744
Source: Oleakplj.exe.25.dr Static PE information: section name: .text entropy: 7.149858436442656
Source: Oiibddkd.exe.26.dr Static PE information: section name: .text entropy: 7.1400998969697005
Source: Ofmbni32.exe.27.dr Static PE information: section name: .text entropy: 7.199901196794614
Source: Onigbk32.exe.28.dr Static PE information: section name: .text entropy: 7.148718122099703
Source: Pnkdgk32.exe.29.dr Static PE information: section name: .text entropy: 7.128193719864745
Source: Plaafobm.exe.30.dr Static PE information: section name: .text entropy: 7.123151697015828
Source: Plfjan32.exe.31.dr Static PE information: section name: .text entropy: 7.1645055122231325
Source: Abgiogom.exe.32.dr Static PE information: section name: .text entropy: 7.15783186302685
Source: Afeaee32.exe.33.dr Static PE information: section name: .text entropy: 7.133443618227196
Source: Apmfnklc.exe.34.dr Static PE information: section name: .text entropy: 7.148829340156794
Source: Aiejgqbd.exe.35.dr Static PE information: section name: .text entropy: 7.073021381214775
Source: Abnopf32.exe.36.dr Static PE information: section name: .text entropy: 7.180049933586281
Source: Boepdgoi.exe.37.dr Static PE information: section name: .text entropy: 7.062278259438176
Source: Bmfpbogh.exe.38.dr Static PE information: section name: .text entropy: 7.159488419401522
Source: Beadgadc.exe.39.dr Static PE information: section name: .text entropy: 7.1897567359449726

Persistence and Installation Behavior
barindex
Drops executables to the windows directory (C:\Windows) and starts them
Source: C:\Windows\SysWOW64\Ninbhfea.exe Executable created and started: C:\Windows\SysWOW64\Nfacbjdk.exe Jump to behavior
Source: C:\Windows\SysWOW64\Afeaee32.exe Executable created and started: C:\Windows\SysWOW64\Apmfnklc.exe
Source: C:\Windows\SysWOW64\Mkqoicnb.exe Executable created and started: C:\Windows\SysWOW64\Mdicai32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Loplncai.exe Executable created and started: C:\Windows\SysWOW64\Mlfimg32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Aiejgqbd.exe Executable created and started: C:\Windows\SysWOW64\Abnopf32.exe
Source: C:\Windows\SysWOW64\Mdicai32.exe Executable created and started: C:\Windows\SysWOW64\Mfhplllf.exe Jump to behavior
Source: C:\Windows\SysWOW64\Plfjan32.exe Executable created and started: C:\Windows\SysWOW64\Abgiogom.exe
Source: C:\Windows\SysWOW64\Npjgkp32.exe Executable created and started: C:\Windows\SysWOW64\Opldpphi.exe Jump to behavior
Source: C:\Windows\SysWOW64\Mhmiah32.exe Executable created and started: C:\Windows\SysWOW64\Mddjfiih.exe Jump to behavior
Source: C:\Windows\SysWOW64\Oiibddkd.exe Executable created and started: C:\Windows\SysWOW64\Ofmbni32.exe
Source: C:\Windows\SysWOW64\Nmdeneap.exe Executable created and started: C:\Windows\SysWOW64\Nfmigk32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Nnhnkmek.exe Executable created and started: C:\Windows\SysWOW64\Ninbhfea.exe Jump to behavior
Source: C:\Windows\SysWOW64\Kkipaf32.exe Executable created and started: C:\Windows\SysWOW64\Loplncai.exe Jump to behavior
Source: C:\Windows\SysWOW64\Oiehie32.exe Executable created and started: C:\Windows\SysWOW64\Obmmbkej.exe Jump to behavior
Source: C:\Windows\SysWOW64\Opldpphi.exe Executable created and started: C:\Windows\SysWOW64\Oiehie32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Kkgclgep.exe Executable created and started: C:\Windows\SysWOW64\Kkipaf32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Apmfnklc.exe Executable created and started: C:\Windows\SysWOW64\Aiejgqbd.exe
Source: C:\Windows\SysWOW64\Nfmigk32.exe Executable created and started: C:\Windows\SysWOW64\Nnhnkmek.exe Jump to behavior
Source: C:\Windows\SysWOW64\Onigbk32.exe Executable created and started: C:\Windows\SysWOW64\Pnkdgk32.exe
Source: C:\Windows\SysWOW64\Nfacbjdk.exe Executable created and started: C:\Windows\SysWOW64\Npjgkp32.exe Jump to behavior
Source: C:\Users\user\Desktop\f6t9qa761D.exe Executable created and started: C:\Windows\SysWOW64\Jagibbdg.exe Jump to behavior
Source: C:\Windows\SysWOW64\Knccbbff.exe Executable created and started: C:\Windows\SysWOW64\Kkgclgep.exe Jump to behavior
Source: C:\Windows\SysWOW64\Boepdgoi.exe Executable created and started: C:\Windows\SysWOW64\Bmfpbogh.exe
Source: C:\Windows\SysWOW64\Oleakplj.exe Executable created and started: C:\Windows\SysWOW64\Oiibddkd.exe Jump to behavior
Source: C:\Windows\SysWOW64\Kegnnphk.exe Executable created and started: C:\Windows\SysWOW64\Knccbbff.exe Jump to behavior
Source: C:\Windows\SysWOW64\Abgiogom.exe Executable created and started: C:\Windows\SysWOW64\Afeaee32.exe
Source: C:\Windows\SysWOW64\Abnopf32.exe Executable created and started: C:\Windows\SysWOW64\Boepdgoi.exe
Source: C:\Windows\SysWOW64\Mlfimg32.exe Executable created and started: C:\Windows\SysWOW64\Mhmiah32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Plaafobm.exe Executable created and started: C:\Windows\SysWOW64\Plfjan32.exe
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Executable created and started: C:\Windows\SysWOW64\Mkqoicnb.exe Jump to behavior
Source: C:\Windows\SysWOW64\Obmmbkej.exe Executable created and started: C:\Windows\SysWOW64\Oleakplj.exe Jump to behavior
Source: C:\Windows\SysWOW64\Ofmbni32.exe Executable created and started: C:\Windows\SysWOW64\Onigbk32.exe
Source: C:\Windows\SysWOW64\Pnkdgk32.exe Executable created and started: C:\Windows\SysWOW64\Plaafobm.exe
Source: C:\Windows\SysWOW64\Jagibbdg.exe Executable created and started: C:\Windows\SysWOW64\Jokilfca.exe Jump to behavior
Source: C:\Windows\SysWOW64\Nncepn32.exe Executable created and started: C:\Windows\SysWOW64\Nmdeneap.exe Jump to behavior
Source: C:\Windows\SysWOW64\Mfhplllf.exe Executable created and started: C:\Windows\SysWOW64\Nncepn32.exe Jump to behavior
Source: C:\Windows\SysWOW64\Mddjfiih.exe Executable created and started: C:\Windows\SysWOW64\Mbhkpnhb.exe Jump to behavior
Source: C:\Windows\SysWOW64\Jokilfca.exe Executable created and started: C:\Windows\SysWOW64\Kegnnphk.exe Jump to behavior
Drops PE files
Source: C:\Windows\SysWOW64\Nmdeneap.exe File created: C:\Windows\SysWOW64\Jhemcd32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Ninbhfea.exe File created: C:\Windows\SysWOW64\Nfacbjdk.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Afeaee32.exe File created: C:\Windows\SysWOW64\Apmfnklc.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Afeaee32.exe File created: C:\Windows\SysWOW64\Cjemgabj.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Oleakplj.exe File created: C:\Windows\SysWOW64\Njcedipl.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Mkqoicnb.exe File created: C:\Windows\SysWOW64\Mdicai32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Loplncai.exe File created: C:\Windows\SysWOW64\Mlfimg32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Plaafobm.exe File created: C:\Windows\SysWOW64\Khhkcgiq.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Aiejgqbd.exe File created: C:\Windows\SysWOW64\Abnopf32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Mfhplllf.exe File created: C:\Windows\SysWOW64\Gfhipbln.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Nnhnkmek.exe File created: C:\Windows\SysWOW64\Nnglhjfe.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Nfacbjdk.exe File created: C:\Windows\SysWOW64\Abagca32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Mdicai32.exe File created: C:\Windows\SysWOW64\Mfhplllf.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Plfjan32.exe File created: C:\Windows\SysWOW64\Abgiogom.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Npjgkp32.exe File created: C:\Windows\SysWOW64\Opldpphi.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Npjgkp32.exe File created: C:\Windows\SysWOW64\Caghjf32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Mhmiah32.exe File created: C:\Windows\SysWOW64\Mddjfiih.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Oiibddkd.exe File created: C:\Windows\SysWOW64\Ofmbni32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Jagibbdg.exe File created: C:\Windows\SysWOW64\Clajoglf.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Nmdeneap.exe File created: C:\Windows\SysWOW64\Nfmigk32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Apmfnklc.exe File created: C:\Windows\SysWOW64\Akecacdm.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Nnhnkmek.exe File created: C:\Windows\SysWOW64\Ninbhfea.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Nfmigk32.exe File created: C:\Windows\SysWOW64\Eakcoodc.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Kkipaf32.exe File created: C:\Windows\SysWOW64\Loplncai.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Oiehie32.exe File created: C:\Windows\SysWOW64\Obmmbkej.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Opldpphi.exe File created: C:\Windows\SysWOW64\Oiehie32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Kkgclgep.exe File created: C:\Windows\SysWOW64\Kkipaf32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Mkqoicnb.exe File created: C:\Windows\SysWOW64\Ihifngfk.dll Jump to dropped file
Source: C:\Users\user\Desktop\f6t9qa761D.exe File created: C:\Windows\SysWOW64\Doaepp32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Aiejgqbd.exe File created: C:\Windows\SysWOW64\Cboabb32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Kegnnphk.exe File created: C:\Windows\SysWOW64\Fkcpdl32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Apmfnklc.exe File created: C:\Windows\SysWOW64\Aiejgqbd.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Nfmigk32.exe File created: C:\Windows\SysWOW64\Nnhnkmek.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Onigbk32.exe File created: C:\Windows\SysWOW64\Pnkdgk32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Pnkdgk32.exe File created: C:\Windows\SysWOW64\Gdcmha32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Bmfpbogh.exe File created: C:\Windows\SysWOW64\Pilbmhcp.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Nfacbjdk.exe File created: C:\Windows\SysWOW64\Npjgkp32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Mddjfiih.exe File created: C:\Windows\SysWOW64\Makogp32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Obmmbkej.exe File created: C:\Windows\SysWOW64\Kkqaeb32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Kkgclgep.exe File created: C:\Windows\SysWOW64\Kbelgk32.dll Jump to dropped file
Source: C:\Users\user\Desktop\f6t9qa761D.exe File created: C:\Windows\SysWOW64\Jagibbdg.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe File created: C:\Windows\SysWOW64\Gkehlfaa.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Jokilfca.exe File created: C:\Windows\SysWOW64\Flbkld32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Knccbbff.exe File created: C:\Windows\SysWOW64\Kkgclgep.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Ninbhfea.exe File created: C:\Windows\SysWOW64\Okilnjci.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Boepdgoi.exe File created: C:\Windows\SysWOW64\Bmfpbogh.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Boepdgoi.exe File created: C:\Windows\SysWOW64\Folfac32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Oleakplj.exe File created: C:\Windows\SysWOW64\Oiibddkd.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Kegnnphk.exe File created: C:\Windows\SysWOW64\Knccbbff.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Abgiogom.exe File created: C:\Windows\SysWOW64\Kkpgnmhh.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Ofmbni32.exe File created: C:\Windows\SysWOW64\Fompebbg.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Loplncai.exe File created: C:\Windows\SysWOW64\Jflaad32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Oiibddkd.exe File created: C:\Windows\SysWOW64\Jdlgaj32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Onigbk32.exe File created: C:\Windows\SysWOW64\Efljmjpm.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Abgiogom.exe File created: C:\Windows\SysWOW64\Afeaee32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Abnopf32.exe File created: C:\Windows\SysWOW64\Boepdgoi.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Mlfimg32.exe File created: C:\Windows\SysWOW64\Mhmiah32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Plaafobm.exe File created: C:\Windows\SysWOW64\Plfjan32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Plfjan32.exe File created: C:\Windows\SysWOW64\Bkmjkjhd.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe File created: C:\Windows\SysWOW64\Mkqoicnb.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Obmmbkej.exe File created: C:\Windows\SysWOW64\Oleakplj.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Ofmbni32.exe File created: C:\Windows\SysWOW64\Onigbk32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Knccbbff.exe File created: C:\Windows\SysWOW64\Qanqbgdb.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Pnkdgk32.exe File created: C:\Windows\SysWOW64\Plaafobm.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Jagibbdg.exe File created: C:\Windows\SysWOW64\Jokilfca.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Oiehie32.exe File created: C:\Windows\SysWOW64\Jpegka32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Opldpphi.exe File created: C:\Windows\SysWOW64\Pppjem32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Kkipaf32.exe File created: C:\Windows\SysWOW64\Eoifoe32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Nncepn32.exe File created: C:\Windows\SysWOW64\Efhade32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Mhmiah32.exe File created: C:\Windows\SysWOW64\Ekdhoi32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Mdicai32.exe File created: C:\Windows\SysWOW64\Eeflcm32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Nncepn32.exe File created: C:\Windows\SysWOW64\Nmdeneap.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Bmfpbogh.exe File created: C:\Windows\SysWOW64\Beadgadc.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Mfhplllf.exe File created: C:\Windows\SysWOW64\Nncepn32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Mddjfiih.exe File created: C:\Windows\SysWOW64\Mbhkpnhb.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Jokilfca.exe File created: C:\Windows\SysWOW64\Kegnnphk.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Mlfimg32.exe File created: C:\Windows\SysWOW64\Imjgmahp.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Abnopf32.exe File created: C:\Windows\SysWOW64\Nikaqk32.dll Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\SysWOW64\Nmdeneap.exe File created: C:\Windows\SysWOW64\Jhemcd32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Ninbhfea.exe File created: C:\Windows\SysWOW64\Nfacbjdk.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Afeaee32.exe File created: C:\Windows\SysWOW64\Apmfnklc.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Afeaee32.exe File created: C:\Windows\SysWOW64\Cjemgabj.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Oleakplj.exe File created: C:\Windows\SysWOW64\Njcedipl.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Mkqoicnb.exe File created: C:\Windows\SysWOW64\Mdicai32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Loplncai.exe File created: C:\Windows\SysWOW64\Mlfimg32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Plaafobm.exe File created: C:\Windows\SysWOW64\Khhkcgiq.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Aiejgqbd.exe File created: C:\Windows\SysWOW64\Abnopf32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Mfhplllf.exe File created: C:\Windows\SysWOW64\Gfhipbln.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Nnhnkmek.exe File created: C:\Windows\SysWOW64\Nnglhjfe.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Nfacbjdk.exe File created: C:\Windows\SysWOW64\Abagca32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Mdicai32.exe File created: C:\Windows\SysWOW64\Mfhplllf.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Plfjan32.exe File created: C:\Windows\SysWOW64\Abgiogom.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Npjgkp32.exe File created: C:\Windows\SysWOW64\Opldpphi.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Npjgkp32.exe File created: C:\Windows\SysWOW64\Caghjf32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Mhmiah32.exe File created: C:\Windows\SysWOW64\Mddjfiih.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Oiibddkd.exe File created: C:\Windows\SysWOW64\Ofmbni32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Jagibbdg.exe File created: C:\Windows\SysWOW64\Clajoglf.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Nmdeneap.exe File created: C:\Windows\SysWOW64\Nfmigk32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Apmfnklc.exe File created: C:\Windows\SysWOW64\Akecacdm.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Nnhnkmek.exe File created: C:\Windows\SysWOW64\Ninbhfea.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Nfmigk32.exe File created: C:\Windows\SysWOW64\Eakcoodc.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Kkipaf32.exe File created: C:\Windows\SysWOW64\Loplncai.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Oiehie32.exe File created: C:\Windows\SysWOW64\Obmmbkej.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Opldpphi.exe File created: C:\Windows\SysWOW64\Oiehie32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Kkgclgep.exe File created: C:\Windows\SysWOW64\Kkipaf32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Mkqoicnb.exe File created: C:\Windows\SysWOW64\Ihifngfk.dll Jump to dropped file
Source: C:\Users\user\Desktop\f6t9qa761D.exe File created: C:\Windows\SysWOW64\Doaepp32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Aiejgqbd.exe File created: C:\Windows\SysWOW64\Cboabb32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Kegnnphk.exe File created: C:\Windows\SysWOW64\Fkcpdl32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Apmfnklc.exe File created: C:\Windows\SysWOW64\Aiejgqbd.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Nfmigk32.exe File created: C:\Windows\SysWOW64\Nnhnkmek.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Onigbk32.exe File created: C:\Windows\SysWOW64\Pnkdgk32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Pnkdgk32.exe File created: C:\Windows\SysWOW64\Gdcmha32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Bmfpbogh.exe File created: C:\Windows\SysWOW64\Pilbmhcp.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Nfacbjdk.exe File created: C:\Windows\SysWOW64\Npjgkp32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Mddjfiih.exe File created: C:\Windows\SysWOW64\Makogp32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Obmmbkej.exe File created: C:\Windows\SysWOW64\Kkqaeb32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Kkgclgep.exe File created: C:\Windows\SysWOW64\Kbelgk32.dll Jump to dropped file
Source: C:\Users\user\Desktop\f6t9qa761D.exe File created: C:\Windows\SysWOW64\Jagibbdg.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe File created: C:\Windows\SysWOW64\Gkehlfaa.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Jokilfca.exe File created: C:\Windows\SysWOW64\Flbkld32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Knccbbff.exe File created: C:\Windows\SysWOW64\Kkgclgep.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Ninbhfea.exe File created: C:\Windows\SysWOW64\Okilnjci.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Boepdgoi.exe File created: C:\Windows\SysWOW64\Bmfpbogh.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Boepdgoi.exe File created: C:\Windows\SysWOW64\Folfac32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Oleakplj.exe File created: C:\Windows\SysWOW64\Oiibddkd.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Kegnnphk.exe File created: C:\Windows\SysWOW64\Knccbbff.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Abgiogom.exe File created: C:\Windows\SysWOW64\Kkpgnmhh.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Ofmbni32.exe File created: C:\Windows\SysWOW64\Fompebbg.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Loplncai.exe File created: C:\Windows\SysWOW64\Jflaad32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Oiibddkd.exe File created: C:\Windows\SysWOW64\Jdlgaj32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Onigbk32.exe File created: C:\Windows\SysWOW64\Efljmjpm.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Abgiogom.exe File created: C:\Windows\SysWOW64\Afeaee32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Abnopf32.exe File created: C:\Windows\SysWOW64\Boepdgoi.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Mlfimg32.exe File created: C:\Windows\SysWOW64\Mhmiah32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Plaafobm.exe File created: C:\Windows\SysWOW64\Plfjan32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Plfjan32.exe File created: C:\Windows\SysWOW64\Bkmjkjhd.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe File created: C:\Windows\SysWOW64\Mkqoicnb.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Obmmbkej.exe File created: C:\Windows\SysWOW64\Oleakplj.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Ofmbni32.exe File created: C:\Windows\SysWOW64\Onigbk32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Knccbbff.exe File created: C:\Windows\SysWOW64\Qanqbgdb.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Pnkdgk32.exe File created: C:\Windows\SysWOW64\Plaafobm.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Jagibbdg.exe File created: C:\Windows\SysWOW64\Jokilfca.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Oiehie32.exe File created: C:\Windows\SysWOW64\Jpegka32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Opldpphi.exe File created: C:\Windows\SysWOW64\Pppjem32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Kkipaf32.exe File created: C:\Windows\SysWOW64\Eoifoe32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Nncepn32.exe File created: C:\Windows\SysWOW64\Efhade32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Mhmiah32.exe File created: C:\Windows\SysWOW64\Ekdhoi32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Mdicai32.exe File created: C:\Windows\SysWOW64\Eeflcm32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Nncepn32.exe File created: C:\Windows\SysWOW64\Nmdeneap.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Bmfpbogh.exe File created: C:\Windows\SysWOW64\Beadgadc.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Mfhplllf.exe File created: C:\Windows\SysWOW64\Nncepn32.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Mddjfiih.exe File created: C:\Windows\SysWOW64\Mbhkpnhb.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Jokilfca.exe File created: C:\Windows\SysWOW64\Kegnnphk.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Mlfimg32.exe File created: C:\Windows\SysWOW64\Imjgmahp.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Abnopf32.exe File created: C:\Windows\SysWOW64\Nikaqk32.dll Jump to dropped file

Boot Survival
barindex
Creates an undocumented autostart registry key
Source: C:\Users\user\Desktop\f6t9qa761D.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Web Event Logger Jump to behavior
Source: C:\Users\user\Desktop\f6t9qa761D.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Web Event Logger Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\SysWOW64\Kegnnphk.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Fkcpdl32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Nmdeneap.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Jhemcd32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Pnkdgk32.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Gdcmha32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Bmfpbogh.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Pilbmhcp.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Afeaee32.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Cjemgabj.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Oleakplj.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Njcedipl.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Obmmbkej.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Kkqaeb32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Mddjfiih.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Makogp32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Kkgclgep.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Kbelgk32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Plaafobm.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Khhkcgiq.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Nnhnkmek.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Nnglhjfe.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Mfhplllf.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Gfhipbln.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Mbhkpnhb.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Gkehlfaa.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Nfacbjdk.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Abagca32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Jokilfca.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Flbkld32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Boepdgoi.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Folfac32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Ninbhfea.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Okilnjci.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Abgiogom.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Kkpgnmhh.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Ofmbni32.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Fompebbg.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Oiibddkd.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Jdlgaj32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Loplncai.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Jflaad32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Onigbk32.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Efljmjpm.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Plfjan32.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Bkmjkjhd.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Npjgkp32.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Caghjf32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Jagibbdg.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Clajoglf.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Knccbbff.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Qanqbgdb.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Apmfnklc.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Akecacdm.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Oiehie32.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Jpegka32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Opldpphi.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Pppjem32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Nfmigk32.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Eakcoodc.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Kkipaf32.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Eoifoe32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Nncepn32.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Efhade32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Mhmiah32.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Ekdhoi32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Mdicai32.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Eeflcm32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Bmfpbogh.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Beadgadc.exe Jump to dropped file
Source: C:\Windows\SysWOW64\Mlfimg32.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Imjgmahp.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Mkqoicnb.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Ihifngfk.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Abnopf32.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Nikaqk32.dll Jump to dropped file
Source: C:\Users\user\Desktop\f6t9qa761D.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Doaepp32.dll Jump to dropped file
Source: C:\Windows\SysWOW64\Aiejgqbd.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\Cboabb32.dll Jump to dropped file

Stealing of Sensitive Information
barindex
Yara detected Berbew
Source: Yara match File source: 2.2.Jagibbdg.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.Knccbbff.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 30.2.Pnkdgk32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Nfmigk32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.2.Oiibddkd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.Nmdeneap.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.Mdicai32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.Onigbk32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.Loplncai.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.Nncepn32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.Mkqoicnb.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Kegnnphk.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.Nncepn32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.Opldpphi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.Npjgkp32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Mbhkpnhb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.Onigbk32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Nnhnkmek.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.Mhmiah32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.2.Plaafobm.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Nfacbjdk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Mbhkpnhb.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.Oleakplj.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.Npjgkp32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.Oiehie32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.Bmfpbogh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.Obmmbkej.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.2.Oiibddkd.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.Ninbhfea.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.2.Ofmbni32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.Mfhplllf.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.Mkqoicnb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.f6t9qa761D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.Ninbhfea.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.Jagibbdg.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.Obmmbkej.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.Kkgclgep.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.Mlfimg32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.Abgiogom.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.Afeaee32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Plfjan32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.Loplncai.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Nnhnkmek.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 30.2.Pnkdgk32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.2.Abnopf32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.Mfhplllf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 35.2.Apmfnklc.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.Mhmiah32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Nfacbjdk.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 35.2.Apmfnklc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.Abgiogom.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.Kkipaf32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 38.2.Boepdgoi.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.2.Ofmbni32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.2.Plaafobm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.Jokilfca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.Nmdeneap.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.Oiehie32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.Bmfpbogh.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.2.Aiejgqbd.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.Kkgclgep.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.Mdicai32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Nfmigk32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.Oleakplj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.2.Aiejgqbd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Mddjfiih.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.Opldpphi.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.Afeaee32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.Knccbbff.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Kegnnphk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.2.Abnopf32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.f6t9qa761D.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Mddjfiih.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 38.2.Boepdgoi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.Mlfimg32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.Kkipaf32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Plfjan32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.Jokilfca.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000011.00000002.1527938847.000000000042B000.00000004.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.1524475823.000000000042B000.00000004.00000001.01000000.00000021.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.1529310966.000000000042B000.00000004.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.1527145102.000000000042B000.00000004.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.1526975636.000000000042B000.00000004.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.1529698700.000000000042B000.00000004.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1529920319.000000000042B000.00000004.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.1525964158.000000000042B000.00000004.00000001.01000000.0000001A.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.1523895240.000000000042B000.00000004.00000001.01000000.00000025.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.1523541289.000000000042B000.00000004.00000001.01000000.00000027.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.1524873980.000000000042B000.00000004.00000001.01000000.0000001F.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000002.1524585062.000000000042B000.00000004.00000001.01000000.00000020.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.1523678753.000000000042B000.00000004.00000001.01000000.00000026.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.1524164394.000000000042B000.00000004.00000001.01000000.00000023.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000002.1523468407.000000000042B000.00000004.00000001.01000000.00000028.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.1525316582.000000000042B000.00000004.00000001.01000000.0000001D.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.1527733036.000000000042B000.00000004.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.1525532633.000000000042B000.00000004.00000001.01000000.0000001C.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.1523986875.000000000042B000.00000004.00000001.01000000.00000024.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.1524999550.000000000042B000.00000004.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.1526525662.000000000042B000.00000004.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.1529483835.000000000042B000.00000004.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.1528306477.000000000042B000.00000004.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.1528520201.000000000042B000.00000004.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.1524355050.000000000042B000.00000004.00000001.01000000.00000022.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.1525639358.000000000042B000.00000004.00000001.01000000.0000001B.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.1526209069.000000000042B000.00000004.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.1526575725.000000000042B000.00000004.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.1523166948.000000000042B000.00000004.00000001.01000000.00000029.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: f6t9qa761D.exe PID: 7816, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Jagibbdg.exe PID: 7860, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Jokilfca.exe PID: 7876, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Kegnnphk.exe PID: 7892, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Knccbbff.exe PID: 7908, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Kkgclgep.exe PID: 7924, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Kkipaf32.exe PID: 7956, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Loplncai.exe PID: 7984, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mlfimg32.exe PID: 8000, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mhmiah32.exe PID: 8016, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mddjfiih.exe PID: 8032, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mbhkpnhb.exe PID: 8048, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mkqoicnb.exe PID: 8064, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mdicai32.exe PID: 8080, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mfhplllf.exe PID: 8100, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nncepn32.exe PID: 8116, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nmdeneap.exe PID: 8132, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nfmigk32.exe PID: 8148, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nnhnkmek.exe PID: 8168, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Ninbhfea.exe PID: 8184, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nfacbjdk.exe PID: 7192, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Npjgkp32.exe PID: 7244, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Opldpphi.exe PID: 7288, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Oiehie32.exe PID: 7340, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Obmmbkej.exe PID: 7384, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Oleakplj.exe PID: 7432, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Oiibddkd.exe PID: 7476, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Ofmbni32.exe PID: 7528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Onigbk32.exe PID: 7580, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Pnkdgk32.exe PID: 7628, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Plaafobm.exe PID: 1668, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Plfjan32.exe PID: 1672, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Abgiogom.exe PID: 2540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Afeaee32.exe PID: 6736, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Apmfnklc.exe PID: 5756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Aiejgqbd.exe PID: 5820, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Abnopf32.exe PID: 932, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Boepdgoi.exe PID: 5860, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Bmfpbogh.exe PID: 6704, type: MEMORYSTR
Yara detected Njrat
Source: Yara match File source: f6t9qa761D.exe, type: SAMPLE
Source: Yara match File source: 15.3.Mfhplllf.exe.4ea6cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.3.Mkqoicnb.exe.78a1dc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.3.Kkgclgep.exe.4fa5d4.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.3.Knccbbff.exe.57956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.3.Oiibddkd.exe.84a1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.3.Bmfpbogh.exe.7a956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.3.Plfjan32.exe.67956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.3.Abnopf32.exe.689284.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.3.Mlfimg32.exe.7aa1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.Jagibbdg.exe.53a6dc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.Jokilfca.exe.77a334.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.3.Oiibddkd.exe.84a1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.3.Loplncai.exe.5a9704.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.3.Kegnnphk.exe.7c956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 30.3.Pnkdgk32.exe.73956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.3.Onigbk32.exe.6aa354.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.3.Oiehie32.exe.74a33c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Mfhplllf.exe.4ea6cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 38.3.Boepdgoi.exe.5c956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.3.Knccbbff.exe.57956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.3.Plaafobm.exe.81956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.f6t9qa761D.exe.4d973c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.3.Ninbhfea.exe.7ea344.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.3.Loplncai.exe.5a9704.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.3.Mddjfiih.exe.5ca984.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.3.Plfjan32.exe.67956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.3.Mdicai32.exe.7fa354.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.3.Ofmbni32.exe.48a5d4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.3.Mhmiah32.exe.5ea1dc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.3.Nfacbjdk.exe.6197d4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.3.Nfmigk32.exe.63a1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.3.Mhmiah32.exe.5ea1dc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.3.Mbhkpnhb.exe.4e9744.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.3.Kkipaf32.exe.61956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.3.Oleakplj.exe.6b908c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.f6t9qa761D.exe.4d973c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.3.Aiejgqbd.exe.6aa334.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 35.3.Apmfnklc.exe.52967c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.3.Oleakplj.exe.6b908c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.3.Abgiogom.exe.519824.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.3.Afeaee32.exe.6aa1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 38.3.Boepdgoi.exe.5c956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 35.3.Apmfnklc.exe.52967c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.3.Mdicai32.exe.7fa354.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.3.Obmmbkej.exe.61956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.3.Nfmigk32.exe.63a1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.3.Abgiogom.exe.519824.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.3.Kkgclgep.exe.4fa5d4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.3.Ninbhfea.exe.7ea344.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.3.Kegnnphk.exe.7c956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.3.Npjgkp32.exe.52a33c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.3.Plaafobm.exe.81956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.3.Nmdeneap.exe.61a1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.3.Nmdeneap.exe.61a1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.3.Nncepn32.exe.61a33c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.3.Mddjfiih.exe.5ca984.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.3.Nnhnkmek.exe.4ea1c4.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.3.Afeaee32.exe.6aa1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.3.Opldpphi.exe.62a1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.3.Ofmbni32.exe.48a5d4.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.3.Npjgkp32.exe.52a33c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.3.Nfacbjdk.exe.6197d4.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.3.Bmfpbogh.exe.7a956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.Jokilfca.exe.77a334.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.3.Mlfimg32.exe.7aa1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.3.Mbhkpnhb.exe.4e9744.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.3.Aiejgqbd.exe.6aa334.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.3.Oiehie32.exe.74a33c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.3.Opldpphi.exe.62a1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 30.3.Pnkdgk32.exe.73956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.Jagibbdg.exe.53a6dc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.3.Mkqoicnb.exe.78a1dc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.3.Kkipaf32.exe.61956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.3.Abnopf32.exe.689284.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.3.Obmmbkej.exe.61956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.3.Nncepn32.exe.61a33c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.3.Onigbk32.exe.6aa354.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.3.Nnhnkmek.exe.4ea1c4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001A.00000003.1413094066.0000000000696000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.1401676955.0000000000745000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.1408558477.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.1388062598.0000000000556000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000003.1414686039.0000000000805000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000003.1419724385.0000000000716000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.1401384736.00000000004C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000003.1408231486.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.1384605197.0000000000517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000003.1414648666.0000000000827000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1382620236.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.1416962414.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.1398787103.0000000000787000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000003.1411146589.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.1385339329.0000000000736000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.1404507070.00000000005D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000003.1388400520.00000000004D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.1400431531.00000000005A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000003.1414919528.0000000000467000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1403643696.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.1430537589.0000000000666000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000003.1429745266.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.1416821350.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000003.1411099654.0000000000607000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000003.1397065400.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.1428633163.0000000000506000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000003.1406624266.0000000000617000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.1403408472.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000003.1411928431.0000000000727000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.1383486321.0000000000517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.1385969006.0000000000757000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.1427802477.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000003.1411397694.0000000000706000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000003.1407697621.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000003.1426128043.0000000000656000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000003.1407230240.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.1402396137.0000000000767000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.1399746300.00000000005C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000003.1390029708.00000000004D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.1427760940.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000003.1405915319.00000000005D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1383183359.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.1426482415.00000000004F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000003.1429702535.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.1404835697.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.1400042225.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.1424740554.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000003.1406660618.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.1398838683.0000000000765000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.1399107397.00000000005A5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000003.1397600415.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000003.1415881163.0000000000467000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.1396799040.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.1429984432.0000000000666000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000003.1431367294.00000000005A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.1386806651.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.1428040087.0000000000506000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000003.1405881703.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.1410331324.0000000000507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.1403263169.00000000007D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000003.1406890372.00000000004A5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.1409810870.00000000004E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000003.1412836135.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000003.1413699839.0000000000696000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000003.1431993392.0000000000786000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1404271803.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.1427016535.00000000004F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.1409534659.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: f6t9qa761D.exe PID: 7816, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Jagibbdg.exe PID: 7860, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Jokilfca.exe PID: 7876, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Kegnnphk.exe PID: 7892, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Knccbbff.exe PID: 7908, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Kkgclgep.exe PID: 7924, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Kkipaf32.exe PID: 7956, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Loplncai.exe PID: 7984, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mlfimg32.exe PID: 8000, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mhmiah32.exe PID: 8016, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mddjfiih.exe PID: 8032, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mbhkpnhb.exe PID: 8048, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mkqoicnb.exe PID: 8064, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mdicai32.exe PID: 8080, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mfhplllf.exe PID: 8100, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nncepn32.exe PID: 8116, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nmdeneap.exe PID: 8132, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nfmigk32.exe PID: 8148, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nnhnkmek.exe PID: 8168, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Ninbhfea.exe PID: 8184, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nfacbjdk.exe PID: 7192, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Npjgkp32.exe PID: 7244, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Opldpphi.exe PID: 7288, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Oiehie32.exe PID: 7340, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Obmmbkej.exe PID: 7384, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Oleakplj.exe PID: 7432, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Oiibddkd.exe PID: 7476, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Ofmbni32.exe PID: 7528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Onigbk32.exe PID: 7580, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Pnkdgk32.exe PID: 7628, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Plaafobm.exe PID: 1668, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Plfjan32.exe PID: 1672, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Abgiogom.exe PID: 2540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Afeaee32.exe PID: 6736, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Apmfnklc.exe PID: 5756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Aiejgqbd.exe PID: 5820, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Abnopf32.exe PID: 932, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Boepdgoi.exe PID: 5860, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Bmfpbogh.exe PID: 6704, type: MEMORYSTR
Source: Yara match File source: C:\Windows\SysWOW64\Pnkdgk32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Aiejgqbd.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Knccbbff.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mhmiah32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Nncepn32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Onigbk32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mdicai32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Npjgkp32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Opldpphi.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Kkgclgep.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Nnhnkmek.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Kegnnphk.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Afeaee32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Nfacbjdk.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Kkipaf32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Plaafobm.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Oleakplj.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mlfimg32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Oiibddkd.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Plfjan32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mfhplllf.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Bmfpbogh.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Obmmbkej.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Abnopf32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Beadgadc.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Jagibbdg.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mbhkpnhb.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Abgiogom.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mkqoicnb.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Nfmigk32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Loplncai.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Ofmbni32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Apmfnklc.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Jokilfca.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Nmdeneap.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Oiehie32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Boepdgoi.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mddjfiih.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Ninbhfea.exe, type: DROPPED

Remote Access Functionality
barindex
Yara detected Berbew
Source: Yara match File source: 2.2.Jagibbdg.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.Knccbbff.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 30.2.Pnkdgk32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Nfmigk32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.2.Oiibddkd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.Nmdeneap.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.Mdicai32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.Onigbk32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.Loplncai.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.Nncepn32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.Mkqoicnb.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Kegnnphk.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.Nncepn32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.Opldpphi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.Npjgkp32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Mbhkpnhb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.Onigbk32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Nnhnkmek.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.Mhmiah32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.2.Plaafobm.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Nfacbjdk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Mbhkpnhb.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.Oleakplj.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.Npjgkp32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.Oiehie32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.Bmfpbogh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.Obmmbkej.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.2.Oiibddkd.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.Ninbhfea.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.2.Ofmbni32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.Mfhplllf.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.Mkqoicnb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.f6t9qa761D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.Ninbhfea.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.Jagibbdg.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.Obmmbkej.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.Kkgclgep.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.Mlfimg32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.Abgiogom.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.Afeaee32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Plfjan32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.Loplncai.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Nnhnkmek.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 30.2.Pnkdgk32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.2.Abnopf32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.Mfhplllf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 35.2.Apmfnklc.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.Mhmiah32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Nfacbjdk.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 35.2.Apmfnklc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.Abgiogom.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.Kkipaf32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 38.2.Boepdgoi.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.2.Ofmbni32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.2.Plaafobm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.Jokilfca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.Nmdeneap.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.Oiehie32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.Bmfpbogh.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.2.Aiejgqbd.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.Kkgclgep.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.Mdicai32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Nfmigk32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.Oleakplj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.2.Aiejgqbd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Mddjfiih.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.Opldpphi.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.Afeaee32.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.Knccbbff.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Kegnnphk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.2.Abnopf32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.f6t9qa761D.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Mddjfiih.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 38.2.Boepdgoi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.Mlfimg32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.Kkipaf32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Plfjan32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.Jokilfca.exe.42bdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000011.00000002.1527938847.000000000042B000.00000004.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1532010343.000000000042B000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.1524475823.000000000042B000.00000004.00000001.01000000.00000021.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1531486452.000000000042B000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.1529310966.000000000042B000.00000004.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.1527145102.000000000042B000.00000004.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.1526975636.000000000042B000.00000004.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.1529698700.000000000042B000.00000004.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1529920319.000000000042B000.00000004.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.1525964158.000000000042B000.00000004.00000001.01000000.0000001A.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.1523895240.000000000042B000.00000004.00000001.01000000.00000025.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.1523541289.000000000042B000.00000004.00000001.01000000.00000027.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1530709926.000000000042B000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.1524873980.000000000042B000.00000004.00000001.01000000.0000001F.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000002.1524585062.000000000042B000.00000004.00000001.01000000.00000020.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1531230341.000000000042B000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.1523678753.000000000042B000.00000004.00000001.01000000.00000026.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.1524164394.000000000042B000.00000004.00000001.01000000.00000023.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000002.1523468407.000000000042B000.00000004.00000001.01000000.00000028.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.1525316582.000000000042B000.00000004.00000001.01000000.0000001D.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.1527733036.000000000042B000.00000004.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.1525532633.000000000042B000.00000004.00000001.01000000.0000001C.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.1523986875.000000000042B000.00000004.00000001.01000000.00000024.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.1524999550.000000000042B000.00000004.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1532285107.000000000042B000.00000004.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.1526525662.000000000042B000.00000004.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.1529483835.000000000042B000.00000004.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.1528306477.000000000042B000.00000004.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1530845772.000000000042B000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.1528520201.000000000042B000.00000004.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.1524355050.000000000042B000.00000004.00000001.01000000.00000022.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1530482046.000000000042B000.00000004.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1530139190.000000000042B000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.1525639358.000000000042B000.00000004.00000001.01000000.0000001B.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.1526209069.000000000042B000.00000004.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.1526575725.000000000042B000.00000004.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.1523166948.000000000042B000.00000004.00000001.01000000.00000029.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1531795562.000000000042B000.00000004.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1531104979.000000000042B000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: f6t9qa761D.exe PID: 7816, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Jagibbdg.exe PID: 7860, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Jokilfca.exe PID: 7876, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Kegnnphk.exe PID: 7892, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Knccbbff.exe PID: 7908, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Kkgclgep.exe PID: 7924, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Kkipaf32.exe PID: 7956, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Loplncai.exe PID: 7984, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mlfimg32.exe PID: 8000, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mhmiah32.exe PID: 8016, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mddjfiih.exe PID: 8032, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mbhkpnhb.exe PID: 8048, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mkqoicnb.exe PID: 8064, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mdicai32.exe PID: 8080, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mfhplllf.exe PID: 8100, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nncepn32.exe PID: 8116, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nmdeneap.exe PID: 8132, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nfmigk32.exe PID: 8148, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nnhnkmek.exe PID: 8168, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Ninbhfea.exe PID: 8184, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nfacbjdk.exe PID: 7192, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Npjgkp32.exe PID: 7244, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Opldpphi.exe PID: 7288, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Oiehie32.exe PID: 7340, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Obmmbkej.exe PID: 7384, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Oleakplj.exe PID: 7432, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Oiibddkd.exe PID: 7476, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Ofmbni32.exe PID: 7528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Onigbk32.exe PID: 7580, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Pnkdgk32.exe PID: 7628, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Plaafobm.exe PID: 1668, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Plfjan32.exe PID: 1672, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Abgiogom.exe PID: 2540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Afeaee32.exe PID: 6736, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Apmfnklc.exe PID: 5756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Aiejgqbd.exe PID: 5820, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Abnopf32.exe PID: 932, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Boepdgoi.exe PID: 5860, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Bmfpbogh.exe PID: 6704, type: MEMORYSTR
Yara detected Njrat
Source: Yara match File source: f6t9qa761D.exe, type: SAMPLE
Source: Yara match File source: 15.3.Mfhplllf.exe.4ea6cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.3.Mkqoicnb.exe.78a1dc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.3.Kkgclgep.exe.4fa5d4.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.3.Knccbbff.exe.57956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.3.Oiibddkd.exe.84a1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.3.Bmfpbogh.exe.7a956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.3.Plfjan32.exe.67956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.3.Abnopf32.exe.689284.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.3.Mlfimg32.exe.7aa1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.Jagibbdg.exe.53a6dc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.Jokilfca.exe.77a334.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.3.Oiibddkd.exe.84a1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.3.Loplncai.exe.5a9704.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.3.Kegnnphk.exe.7c956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 30.3.Pnkdgk32.exe.73956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.3.Onigbk32.exe.6aa354.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.3.Oiehie32.exe.74a33c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Mfhplllf.exe.4ea6cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 38.3.Boepdgoi.exe.5c956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.3.Knccbbff.exe.57956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.3.Plaafobm.exe.81956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.f6t9qa761D.exe.4d973c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.3.Ninbhfea.exe.7ea344.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.3.Loplncai.exe.5a9704.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.3.Mddjfiih.exe.5ca984.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.3.Plfjan32.exe.67956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.3.Mdicai32.exe.7fa354.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.3.Ofmbni32.exe.48a5d4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.3.Mhmiah32.exe.5ea1dc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.3.Nfacbjdk.exe.6197d4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.3.Nfmigk32.exe.63a1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.3.Mhmiah32.exe.5ea1dc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.3.Mbhkpnhb.exe.4e9744.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.3.Kkipaf32.exe.61956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.3.Oleakplj.exe.6b908c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.f6t9qa761D.exe.4d973c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.3.Aiejgqbd.exe.6aa334.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 35.3.Apmfnklc.exe.52967c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.3.Oleakplj.exe.6b908c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.3.Abgiogom.exe.519824.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.3.Afeaee32.exe.6aa1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 38.3.Boepdgoi.exe.5c956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 35.3.Apmfnklc.exe.52967c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.3.Mdicai32.exe.7fa354.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.3.Obmmbkej.exe.61956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.3.Nfmigk32.exe.63a1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.3.Abgiogom.exe.519824.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.3.Kkgclgep.exe.4fa5d4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.3.Ninbhfea.exe.7ea344.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.3.Kegnnphk.exe.7c956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.3.Npjgkp32.exe.52a33c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.3.Plaafobm.exe.81956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.3.Nmdeneap.exe.61a1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.3.Nmdeneap.exe.61a1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.3.Nncepn32.exe.61a33c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.3.Mddjfiih.exe.5ca984.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.3.Nnhnkmek.exe.4ea1c4.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.3.Afeaee32.exe.6aa1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.3.Opldpphi.exe.62a1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.3.Ofmbni32.exe.48a5d4.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.3.Npjgkp32.exe.52a33c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.3.Nfacbjdk.exe.6197d4.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.3.Bmfpbogh.exe.7a956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.3.Jokilfca.exe.77a334.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.3.Mlfimg32.exe.7aa1cc.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.3.Mbhkpnhb.exe.4e9744.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.3.Aiejgqbd.exe.6aa334.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.3.Oiehie32.exe.74a33c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.3.Opldpphi.exe.62a1cc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 30.3.Pnkdgk32.exe.73956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.3.Jagibbdg.exe.53a6dc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.3.Mkqoicnb.exe.78a1dc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.3.Kkipaf32.exe.61956c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.3.Abnopf32.exe.689284.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.3.Obmmbkej.exe.61956c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.3.Nncepn32.exe.61a33c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.3.Onigbk32.exe.6aa354.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.3.Nnhnkmek.exe.4ea1c4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001A.00000003.1413094066.0000000000696000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.1401676955.0000000000745000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.1408558477.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.1388062598.0000000000556000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000003.1414686039.0000000000805000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000003.1419724385.0000000000716000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.1401384736.00000000004C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000003.1408231486.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.1384605197.0000000000517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000003.1414648666.0000000000827000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1382620236.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.1416962414.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.1398787103.0000000000787000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000003.1411146589.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.1385339329.0000000000736000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.1404507070.00000000005D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000003.1388400520.00000000004D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.1400431531.00000000005A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000003.1414919528.0000000000467000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1403643696.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.1430537589.0000000000666000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000003.1429745266.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.1416821350.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000003.1411099654.0000000000607000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000003.1397065400.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.1428633163.0000000000506000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000003.1406624266.0000000000617000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.1403408472.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000003.1411928431.0000000000727000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.1383486321.0000000000517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.1385969006.0000000000757000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.1427802477.0000000000665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000003.1411397694.0000000000706000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000003.1407697621.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000003.1426128043.0000000000656000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000003.1407230240.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.1402396137.0000000000767000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.1399746300.00000000005C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000003.1390029708.00000000004D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.1427760940.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000003.1405915319.00000000005D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1383183359.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.1426482415.00000000004F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000003.1429702535.0000000000687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.1404835697.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.1400042225.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.1424740554.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000003.1406660618.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.1398838683.0000000000765000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.1399107397.00000000005A5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000003.1397600415.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000003.1415881163.0000000000467000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.1396799040.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.1429984432.0000000000666000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000003.1431367294.00000000005A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.1386806651.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.1428040087.0000000000506000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000003.1405881703.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.1410331324.0000000000507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.1403263169.00000000007D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000003.1406890372.00000000004A5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.1409810870.00000000004E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000003.1412836135.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000003.1413699839.0000000000696000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000003.1431993392.0000000000786000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1404271803.00000000004C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.1427016535.00000000004F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.1409534659.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: f6t9qa761D.exe PID: 7816, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Jagibbdg.exe PID: 7860, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Jokilfca.exe PID: 7876, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Kegnnphk.exe PID: 7892, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Knccbbff.exe PID: 7908, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Kkgclgep.exe PID: 7924, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Kkipaf32.exe PID: 7956, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Loplncai.exe PID: 7984, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mlfimg32.exe PID: 8000, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mhmiah32.exe PID: 8016, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mddjfiih.exe PID: 8032, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mbhkpnhb.exe PID: 8048, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mkqoicnb.exe PID: 8064, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mdicai32.exe PID: 8080, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mfhplllf.exe PID: 8100, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nncepn32.exe PID: 8116, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nmdeneap.exe PID: 8132, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nfmigk32.exe PID: 8148, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nnhnkmek.exe PID: 8168, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Ninbhfea.exe PID: 8184, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Nfacbjdk.exe PID: 7192, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Npjgkp32.exe PID: 7244, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Opldpphi.exe PID: 7288, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Oiehie32.exe PID: 7340, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Obmmbkej.exe PID: 7384, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Oleakplj.exe PID: 7432, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Oiibddkd.exe PID: 7476, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Ofmbni32.exe PID: 7528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Onigbk32.exe PID: 7580, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Pnkdgk32.exe PID: 7628, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Plaafobm.exe PID: 1668, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Plfjan32.exe PID: 1672, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Abgiogom.exe PID: 2540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Afeaee32.exe PID: 6736, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Apmfnklc.exe PID: 5756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Aiejgqbd.exe PID: 5820, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Abnopf32.exe PID: 932, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Boepdgoi.exe PID: 5860, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Bmfpbogh.exe PID: 6704, type: MEMORYSTR
Source: Yara match File source: C:\Windows\SysWOW64\Pnkdgk32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Aiejgqbd.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Knccbbff.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mhmiah32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Nncepn32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Onigbk32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mdicai32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Npjgkp32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Opldpphi.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Kkgclgep.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Nnhnkmek.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Kegnnphk.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Afeaee32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Nfacbjdk.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Kkipaf32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Plaafobm.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Oleakplj.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mlfimg32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Oiibddkd.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Plfjan32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mfhplllf.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Bmfpbogh.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Obmmbkej.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Abnopf32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Beadgadc.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Jagibbdg.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mbhkpnhb.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Abgiogom.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mkqoicnb.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Nfmigk32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Loplncai.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Ofmbni32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Apmfnklc.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Jokilfca.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Nmdeneap.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Oiehie32.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Boepdgoi.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Mddjfiih.exe, type: DROPPED
Source: Yara match File source: C:\Windows\SysWOW64\Ninbhfea.exe, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1515137 Sample: f6t9qa761D.exe Startdate: 21/09/2024 Architecture: WINDOWS Score: 100 96 Multi AV Scanner detection for domain / URL 2->96 98 Malicious sample detected (through community Yara rule) 2->98 100 Antivirus detection for URL or domain 2->100 102 10 other signatures 2->102 14 f6t9qa761D.exe 3 3 2->14         started        process3 file4 82 C:\Windows\SysWOW64\Jagibbdg.exe, PE32 14->82 dropped 84 C:\Windows\SysWOW64\Doaepp32.dll, PE32 14->84 dropped 86 C:\Windows\...\Jagibbdg.exe:Zone.Identifier, ASCII 14->86 dropped 118 Creates an undocumented autostart registry key 14->118 120 Drops executables to the windows directory (C:\Windows) and starts them 14->120 18 Jagibbdg.exe 2 14->18         started        signatures5 process6 file7 54 C:\Windows\SysWOW64\Jokilfca.exe, PE32 18->54 dropped 56 C:\Windows\SysWOW64\Clajoglf.dll, PE32 18->56 dropped 104 Drops executables to the windows directory (C:\Windows) and starts them 18->104 22 Jokilfca.exe 2 18->22         started        signatures8 process9 file10 66 C:\Windows\SysWOW64\Kegnnphk.exe, PE32 22->66 dropped 68 C:\Windows\SysWOW64\Flbkld32.dll, PE32 22->68 dropped 110 Drops executables to the windows directory (C:\Windows) and starts them 22->110 26 Kegnnphk.exe 2 22->26         started        signatures11 process12 file13 74 C:\Windows\SysWOW64\Knccbbff.exe, PE32 26->74 dropped 76 C:\Windows\SysWOW64\Fkcpdl32.dll, PE32 26->76 dropped 114 Drops executables to the windows directory (C:\Windows) and starts them 26->114 30 Knccbbff.exe 2 26->30         started        signatures14 process15 file16 88 C:\Windows\SysWOW64\Qanqbgdb.dll, PE32 30->88 dropped 90 C:\Windows\SysWOW64\Kkgclgep.exe, PE32 30->90 dropped 122 Drops executables to the windows directory (C:\Windows) and starts them 30->122 34 Kkgclgep.exe 2 30->34         started        signatures17 process18 file19 58 C:\Windows\SysWOW64\Kkipaf32.exe, PE32 34->58 dropped 60 C:\Windows\SysWOW64\Kbelgk32.dll, PE32 34->60 dropped 106 Drops executables to the windows directory (C:\Windows) and starts them 34->106 38 Kkipaf32.exe 2 34->38         started        signatures20 process21 file22 70 C:\Windows\SysWOW64\Loplncai.exe, PE32 38->70 dropped 72 C:\Windows\SysWOW64oifoe32.dll, PE32 38->72 dropped 112 Drops executables to the windows directory (C:\Windows) and starts them 38->112 42 Loplncai.exe 2 38->42         started        signatures23 process24 file25 78 C:\Windows\SysWOW64\Mlfimg32.exe, PE32 42->78 dropped 80 C:\Windows\SysWOW64\Jflaad32.dll, PE32 42->80 dropped 116 Drops executables to the windows directory (C:\Windows) and starts them 42->116 46 Mlfimg32.exe 2 42->46         started        signatures26 process27 file28 92 C:\Windows\SysWOW64\Mhmiah32.exe, PE32 46->92 dropped 94 C:\Windows\SysWOW64\Imjgmahp.dll, PE32 46->94 dropped 124 Drops executables to the windows directory (C:\Windows) and starts them 46->124 50 Mhmiah32.exe 2 46->50         started        signatures29 process30 file31 62 C:\Windows\SysWOW64\Mddjfiih.exe, PE32 50->62 dropped 64 C:\Windows\SysWOW64kdhoi32.dll, PE32 50->64 dropped 108 Drops executables to the windows directory (C:\Windows) and starts them 50->108 signatures32
⊘No contacted IP infos